last executing test programs: 2.176905783s ago: executing program 2 (id=4260): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40, 0x1) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f00000003c0)={{0x1, 0x1, 0x18, r1, {0x9, 0x8}}, './file0\x00'}) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r5}, 0x10) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0xf1, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x4}]}}]}, 0x38}}, 0x0) 2.081481414s ago: executing program 2 (id=4263): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000380)='kmem_cache_free\x00', r0}, 0x10) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) mknodat$loop(0xffffffffffffff9c, 0x0, 0x6004, 0x1) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4000, 0x1fd) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r1, 0x401070cd, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x100, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0xb, 0xb76f}, 0x100002, 0x0, 0xfffffffc, 0x7, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004000000"], 0x48) gettid() timer_create(0x0, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) unshare(0x6020400) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000400)=[{&(0x7f0000000080)='|', 0x1}], 0x1, 0xc) 1.57392055s ago: executing program 4 (id=4268): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f3bbb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68000000000000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465a932b77a74e802a0dc6bf25d8a242bc6099ad2300000480006ef6c1ff0900ff0000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767192361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af740b5b7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48bc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1f001b2cd3170400000085be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe760e717a04becff0f719197724f4fce1093b62d7e8c7123d890cec55bf404e4e1f74b7eed82571be54c72d978cf906df08f11f1c4042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f871b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9f0390a6f01e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5eaff07000000000000b99c9cc0ad1857216f000000009191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a798de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270b939b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf01cfaed9ef0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546bb2e51935ab9067ec3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f626602111b40e761fd21081920382f14d12ca3c471c7868e7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df902aeec50e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec743af930cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd6d89f80a4377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f000000000100000000d77480e0345effff6413258d1f6eb190aa28cbb4bafe3436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fb03b84f63e022fe755f4007a4a899eaf52c4f491f1e97c862e29e4570600000091c691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104d74dc07748f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c7167d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c2499ce3ffe2fef03f7cdd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426cfce471fef821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ada08f5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba3c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63e4581d5cc41cbde2ba66adc1168070c8c6e18a6a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c514b37c668554d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c3340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a39938613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b909006f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f1400010000ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1b0100448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae05025040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483d02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e918d685a7b099a4f8ed654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732ab916a781b9912160a3fd2a2e74dd690c57bdfdc1f069f949170ef8cb9c13c12138116bca7a8c59363799be7005c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2c74664d60a4b9423f3297bc8eb91b4ee1d73272abbef3e7a828a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece58e752b47e6f677eff7c5c568a89d6e36b165c39132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae1676384ff799783f55d7e5a1a0920300000000000000d98440c355927629f2bcf9dc405a18ca0264400abf38e90000000000000000008faf2cddffbfa69bf32eb718e88ec75603ed7c7a8825ce0f27a114bd7a4ab74d0c7b8d90ccc1c3ca6620def782e24d75aed70eb676437f62677a69e0994cd82d72e95493c830fe9515329f40b7025326dec33a527c5d999298eaa3690fd0d38a02fc6e0bc16dbe19f353027edc014411e1138087221492f5d5e5cc9d0a1acd3f581eda9a807aa0e609f935f626d96351e0ff116686cbeb8939feecd5dac8cf45101942cc7cec21b7f337df5431bcf7e504b7c427f70a10e1cb8993a661306a0576b638a0171e6800b5b35589d676eb30ed1a72e8f7b057eb281c4504195635b6b285ebaba019913a2520e43ed790231f047f7d3789c10ae7d724929f77aec1d33d9587580268ee14396f71e7ef588cb2560d6bd0795a9b97281229eb16de086553469fad7214ffc3e416f8b8e442dce1d37f9b1c88a5d8a8d9f2fe45bd8df213ecb4194c8554aea13cadcd502e51f6fec80418e772b5bd8d0228949058038b185909ee542848680f9ad43f4057d676d5e21ae3d7e0e4a28c04f112a94707f032b35915e42993ff148291b8babe026646ee41905992db217561b90811c4702a14f312fe5d2ae7257db6be1034cc1c346b76a853ce274bf0435e18f7e86c660c18c80f30505dd4cf2ae2a1893b83c62d61bfeadc1f913e4cab2b897e096dd3fe3525090410cb23bab36cdf200a36014032cf6e5121803c5a0c4a273a19f340163fc6265425d513a1294b8439276394945d94a589708e32a1cb30f1fa4b2f08e01dc5e8c6732e6dc59b5c8cb400000000000000592c9b68f09c8f5ddb20b4ae08b4d9df548e5ed6cd47b91a4bea8b6aa52edf64576aef1e43f2958437fdc20fbbd0d4e13d8cce1193b2f9b4f107e25af178d056e1b1e40bd75b013f7484fae0bc447b1ffaf34819fe3ad1a634c94345e26e1e68dec08723a37b05d1594a66a4718a51d4d67fc880c9d640f4eacc509873f1a103c87f69"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x1400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0xaffffff7ffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x811e, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x1, 0x9}, 0x4110, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x56, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1}, &(0x7f0000000340), &(0x7f0000000380)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, 0x0, 0x10, &(0x7f0000002e00), 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r3, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2800004, 0x28011, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x52, &(0x7f0000000080)={0x0, 0x8b48, 0x2000, 0x0, 0x3d8}, &(0x7f0000ff0000), 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r4}, &(0x7f0000000040), 0x0}, 0x20) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) r6 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f00000003c0)='ceph\x00', 0x0, &(0x7f0000000400)="010000000037a788a11d1f000000000000006923c63a4541062101a59ea9cba39a989ca8c70b3692930208", 0x2b, r6) add_key(&(0x7f0000000180)='rxrpc_s\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="1b65a426838f2d31ac2c51df3ae0759bd35b3a37fc291d494c4bf31706278c8c1eb19deffe8d5334", 0x28, 0xfffffffffffffff9) socket$inet6_icmp(0xa, 0x2, 0x3a) 1.480030381s ago: executing program 0 (id=4270): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x17}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040840}, 0x4) creat(&(0x7f00000000c0)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x17, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES8=r0, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000002480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r4}, 0x10) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180), 0x18000, &(0x7f0000000780)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@afid={'afid', 0x3d, 0x80000000}}]}}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$NL802154_CMD_SET_CHANNEL(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x0, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x17}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040840}, 0x4) (async) creat(&(0x7f00000000c0)='./file0\x00', 0x0) (async) pipe2$9p(&(0x7f0000000000), 0x0) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x17, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES8=r0, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000002480)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, @void, @value}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r4}, 0x10) (async) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180), 0x18000, &(0x7f0000000780)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@afid={'afid', 0x3d, 0x80000000}}]}}) (async) 1.468225172s ago: executing program 0 (id=4271): socket$packet(0x11, 0xa, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000400)=@mangle={'mangle\x00', 0x44, 0x6, 0x390, 0x98, 0x260, 0x260, 0x260, 0x1c8, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x2f8, 0x6, 0x0, {[{{@ip={@empty, @multicast2, 0x0, 0x0, 'veth0_to_bridge\x00', 'veth0_to_bridge\x00', {}, {}, 0x6, 0x1}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x10}}}, {{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28}}, {{@ip={@multicast2, @rand_addr=0x64010182, 0x0, 0x0, 'pim6reg1\x00', 'macvtap0\x00', {0xff}, {}, 0x0, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@dev, @private, 0x0, 0x0, 'hsr0\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@local, @rand_addr, 0x0, 0x0, 'ip6erspan0\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x1}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020000000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000de0000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./bus\x00', 0x41, &(0x7f0000000080)={[{@errors_remount}, {@noload}, {@nogrpid}, {@noquota}, {@noblock_validity}, {}, {@mblk_io_submit}, {@acl}, {@resgid}], [], 0x3d}, 0x1, 0x51f, &(0x7f00000007c0)="$eJzs3UFsI1cZAOB/HDvd7KZNChygEqXQouwK1k4a2kY9lCIhOFUCyn0JiRNFceIodtpNVEFWHDgiIQRInMqFCxInTkioEheOCKkSnEGAQAi2cEACdirb4+xuMk6yG8fOJt8nTea955n3v+doxn7jp5kALqxnIuLViLiTpum1iJjIygvZErudpbXde7ffWmgtSaTp6/9IIsnKunWlbY/FlWy3SxHxlS9GfD05GLexvbM6X6tVN7N8pbm2UWls71xfWZtfri5X12dnZ16ce2nuhbnpvvRzPCJe+fxfvv+dn3zhlV9++s0/3vjb1W8kWXns68cDKh72YqfrpfZ7ce8Omw8Z7CwqtnuYGcvbYuRAya1TbhMAAL19ICI+ERHXYiJGDv86CwAAADyC0s+Ox/+S7m93B4z2KAcAAAAeIYX2HNikUM7m+45HoVAuR3sO74ficqFWbzQ/tVTfWl/szJWdjFJhaaVWnc7mCk9GKWnlZ9rpu/nn9+VnI+LJiPjexFg7X16o1xaHffEDAAAALogr+8b//57ojP8BAACAc2Zy2A0AAAAATp3xPwAAAJx/xv8AAABwrn3ptddaS9p9/vXiG9tbq/U3ri9WG6vlta2F8kJ9c6O8XK8vt+/Zt3ZUfbV6feMzsb51s9KsNpqVxvbOjbX61nrzxsp9j8AGAAAABujJj73z+yQidl8eay8to8fb9ZibAWdVcS+VZOucw/oPT3TWfx5Qo4CBGBl2A4ChKQ67AcDQlIbdAGDokiNe7zl55zfZ+uP9bQ8AANB/Ux/J//3/6OuCu4UBNA84RQ5iALh42t/zjzuT15cFOFdKZgDChXfi3/+PlKYP1CAAAKDvxttLUihnl/fGo1AolyMebz8WoJQsrdSq0xHxRET8bqL0WCs/094zOXLMAAAAAAAAAAAAAAAAAAAAAAAAAAB0pGkSKQAAAHCuRRT+mvyqcy//qYnnxvdfHxhN/jMR2SNC3/zR6z+4Od9sbs60yv+5V978YVb+/DCuYAAAAMCFUHyQjbvj9O44HgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD66b3bby10l0HG/fvnImIyL34xLrXXl6IUEZf/lUTxnv2SiBjpQ/yx1p8P58VPWs3aC5kXf+ztk8ffvXVo/JjM3oW8+FdOHh4utHda559X846/QjzTXucff8WI+/IPq/f5L/bOfyM9jv/HjxnjqXd/VukZ/1bEU8X88083ftIj/rN5Ff782weKvvbVnZ1e8dO3I6ZyP3+S+2JVmmsblcb2zvWVtfnl6nJ1fXZ25sW5l+ZemJuuLK3Uqtnf3Bjf/egv7hzW/8s94k8e0f/ncuobzSn7/7s3b3+wkyzlxb/6bE78X/842+Jg/EL22ffJLN16faqb3u2k7/X0T3/79GH9X+zR/6P+/1d7VbrPtS9/60/H3BQAGIDG9s7qfK1W3TwbiZej7zW3RvhD79ejl/hveiaacbqJb/a1wjRN09YxdYJ6khjcm5Ac3tRhn5kAAIB+u/ulf9gtAQAAAAAAAAAAAAAAAAAAgItrEHca2x9zdy+V9OMW2gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAffF+AAAA///0iOAC") r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sys_enter\x00', r2, 0x0, 0x3}, 0x18) munlock(&(0x7f00009c1000/0x3000)=nil, 0x3000) syz_emit_ethernet(0x64, &(0x7f0000000140)=ANY=[], 0x0) 1.423600432s ago: executing program 4 (id=4272): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000001c80)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x173b2a7e, @remote, 0x19}, 0x1c, 0x0, 0x0, &(0x7f00000020c0)=ANY=[@ANYBLOB="38020000000000002900000036000000004300000000000004013f040100c910ff010000000000000000000000000001c910fc0000000000000000000000800000000000000040000000000e07010101000000010000000200000000000000000000000000000001000000010000002000000000000000ffffffff00000000ffffffffffffff7f06aeb07c1c192077cc9e7c45705803ad5588ca8b194d23f748fe792cfa3d32221f25d73b8ffe64a4ddda6efcfb7483b588194d29c7a04395d8500965a9a1d07879040c44db1d5d6f618d2ab920f0bf168ddc9acc6a51edd1230760d4ae8bf30f5f82a78e8114849ee8e37364560400000035bfa8197ef2ba99103ee5f5aae28ec5c8e2675db11530f5c466d55f2244d479dc653c854406155eada3eaeb90d39149b8d13bab75a9bd1452c8c76284b9ddfbeff41344e64f1771d78a706e1c5a6d63f1c954e24a1e73f75c26e9f09ec9b606cc3470f11c4842db651926bd2263a4a0a8fe80de8b2f9cb176e51819d5f4d10a5d1f0488d5e46953fbfd750f6137fbebe89a8d462158a87f9622355104b4f68d7a6d3ad85c373ea52a25afad37ffb743a5c361158087904b09fcc806d032bac00ee0e0251fc032446e45a3e12417ff4703526ffc45f71567857777927903799e0ba453334186009d22e38099c67b5350c7e82136bba947a18fb61d36fcba1f9efe3d79485d06252702833dc8ee417f40bb9064878fb89dd75a49135e5df148c4ad1e1d5626b44c8112d822f4c9a05e693fd5ae5595627f8684016b37a2bf6d0040030000000000002900000037000000006500000000000000fb1a63687c244e6df3aecb13d6eb957495b669cc032f6d0a11a5e16eed9937b046c9dc1a61dcf9754b767df4735c3f8c37b4d5cd15a99c5a19cc62c921ad4e90d6e3695ec1891223a53600d5121b5735acafb556e22279975f958ad437c76573e544506e58455772eb11493af933099a5dc7e9e0c8b907e68e23e59d7b94bc774309e2047132758b60955301f277a9032b0bc47e660b243e9e2126733f13ab99055a0999068ada35a38d105a0100000000000000e28695ecae3944413b7764eefde26ed571d857b2cb2dd1b2a4a84c1fec0799cf90f57f7a6d35e2b60cd425b9372ae4a27f453e5d7da2eacd3b98cdb10cec9152d5829c251112e2a59ea0cd280f3d08849b6cd43d25e3dcd62f7c7dee6123a2682daf4aa9a856b31e9204c5c2b80b84dbeec05d93a64a550f1ebc326488cd620c6fe1aa266a0ce5b24be03b5037786e037cc85ed61f362e081fb694e12e54fcb9eb0f86d6d91fd159023a073278f84d6ada8f9aa25ec223d268f3291b25392c941740932bd1a82f40a8fc586db23d2f6240ce883e3c1dc1e0d07fc3aa73a9ac82a1538d129c9e66cb6a8100abe95bc4064581e8c01ce65ba3ea751db5d8c0a1173fe62b2fd2d415042a97ade4d274a466b6c597eed6bf5d7a305ead804c36b9e1c314b26676ed83412417610d3cf4d07e5b24cf3de9c790ae93850e0f8bba047b710cf340c78a80cef5f6665a647681ff5f7b6ecce8ab65e26406b6a6e0e72ff8501c545bffc00f034dc3a5b251390ae68bb61d936dc9a24e6f66c72e7911c51c716dfd4304566fb32e6c2745d232f990d0bbe0ddf9dc58398dda292c07b16da766a37c60bd9993b4f21e64103602000000db47d7990d5a007faccb2f86660079f2e229723bce870aec3f7f4e529c92add713590ce6c0ea1a0499fb76d32636cfd18b6b39fb48f1a6d46f6ae8f45c47ee8260f9531070d170ab92739be0bdf5b76f8a9b93a5e550dfecab79d2e46085a67024b6be883c79ade2873458fda5a7f4eb62b05634356ee3b45723f4cff19c654ad441ff5b8792df7f18d8418351e195151b1b3532e742a6525c86efdb29653f35ce8e0a41c8c6d39f39531e13aeb1172893eeedd83b6afb939f8e6abc5482696aa48918000000000000002900000037"], 0x590}}, {{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000001280)="a48c353171", 0x5}], 0x1}}], 0x2, 0x28048005) writev(r0, &(0x7f0000000d00)=[{&(0x7f0000000b00)="23ab00b4b9c3ac30", 0x8}], 0x1) (fail_nth: 1) 1.413303303s ago: executing program 0 (id=4273): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500001000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x8, 0x2, 0x4, 0x5, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r4, 0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe2, 0x0, 0x0, 0x0, 0x1}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) pread64(0xffffffffffffffff, &(0x7f0000000380)=""/87, 0x57, 0x80000000000) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x0, 0x0, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000001c0)={'gretap0\x00', &(0x7f00000000c0)={'ip_vti0\x00', 0x0, 0x80, 0x7800, 0x10001, 0x8000, {{0x16, 0x4, 0x3, 0x6, 0x58, 0x66, 0x0, 0x2, 0x4, 0x0, @empty, @private=0xa010102, {[@noop, @noop, @timestamp={0x44, 0x14, 0x69, 0x0, 0x6, [0x7, 0x7, 0x0, 0x20]}, @ra={0x94, 0x4, 0x1}, @timestamp={0x44, 0x18, 0xb4, 0x0, 0x7, [0x1, 0x0, 0xe, 0x6, 0x8]}, @rr={0x7, 0xf, 0xff, [@private=0xa010102, @dev={0xac, 0x14, 0x14, 0xa}, @empty]}]}}}}}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r9, {}, {}, {0xfff3}}}, 0x24}}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000001600010000000000000000000a0400000000000014000100ff010000000000000000000000000001150002"], 0x44}}, 0x0) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d530494d) 1.123775036s ago: executing program 4 (id=4274): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40, 0x1) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r4}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0xf1, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x4}]}}]}, 0x38}}, 0x0) 1.122833236s ago: executing program 2 (id=4275): bpf$TOKEN_CREATE(0x24, &(0x7f0000000400), 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1500000005000000010001000900000001", @ANYRES32, @ANYBLOB="00000012000000000000000000bb000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r2, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10) listen(r2, 0xda90) accept4(r2, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffff"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000940)={&(0x7f0000000640)='console\x00', r4}, 0x10) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000003c0)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014000d000a000d0000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a3200000000140000001100"], 0x54}, 0x1, 0x0, 0x0, 0x20048004}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002580)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000080a01010000000000000000020000000900010073797a300000000038000000060a17d50000000000000000020000000900020073797a32000000000900010073797a30000000000c0003400000000000000002"], 0xcdc}}, 0x0) 1.089907266s ago: executing program 0 (id=4276): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0xfffffffffffffffe) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={r3, 0xe0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540), ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000009c0)=[0x0], 0x0, 0x76, &(0x7f0000000600)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x0, 0x0, &(0x7f0000000680), 0x8, 0xa5, 0x8, 0x8, &(0x7f00000006c0)}}, 0x10) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000840)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1, 0x5, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x48) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f00000001c0), 0x2, 0x51a, &(0x7f0000001200)="$eJzs3U9sI1cZAPBvJsnam6ZNCj0AKnQphQWt1k68bVT1QjlVCFVC9MhhGxInimLHUeyUJuwhe+SORCVOcOLMAYkDUk/ckTjAjUs5IBVYgRokJFx5bGedP06sbGJv499PGvnNvLG/93Y071mfN/MCGFu3ImI/Im5ExLsRMds5nnS2eLO9tc775NGD5YNHD5aTaDbf+WeS1beORc97Wp7pfGY+In7wVsSPkmNB/xRR393bWKpUytudQ8VGdatY3927u15dWiuvlTdLpcWFxfnX771WurS+vlT9zcc3I+L3v/vyR3/c/9ZPWs2a6dT19uMytbs+dRinZTIivncVwUZgotOfGxd584XexGVKI+JzEfFydv/PxkR2NY86epm+PcTWAQBXodmcjeZs7z4AcN2lWQ4sSQudXMBMpGmh0M7hvRDTaaVWb9xZre1srrRzZXMxla6uV8rznVzhXEwlq+uT5YWs3N2vlEvH9u9FxPMR8bPczWy/sFyrrIzyiw8AjLFnjs3//8m1538A4JrLPy7mRtkOAGB48qNuAAAwdOZ/ABg/5n8AGD/mfwAYP+Z/ABg/5n8AGCvff/vt1tY86Dz/euW93Z2N2nt3V8r1jUJ1Z7mwXNveKqzVamvZM3uq531epVbbWng1dt4vNsr1RrG+u3e/WtvZbNzPnut9vzw1lF4BAGd5/qUP/5JExP4bN7Mtep73f+5c/eJVtw64SumoGwCMzMSoGwCMzMnVvoBxIR8P4+v/zWYzetbujYiHh6Weh4H2/S9CHwwUJrVuKDx9bn/xCfL/wGea/D+Mr4vl/32Xh+tA/h/GV7OZWPMfAMaMHD+QnFPf+/v/fLNnZ7Df/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBamsm2JC101gKfiTQtFCKejYi5mEpW1yvl+Yh4LiL+nJvKtfYXIsK6QQDwWZb+Pems/3V79pWZ47U3cv/NZa8R8eNfvPPz95caje2FiBvJvw6PNz7oHC+Nov0AwHm683R3Hu/65NGD5e42zPZ8/J324qKtuAedrV0zGZPZaz7LNUz/O+nst7W+r0xcQvz9hxHxhdP6n2S5kbnOyqfH47diPzvU+OmR+GlW135t/Vt8/hLaAuPmw9b48+Zp918at7LX0+//fDZCPbnu+HdwYvxLD8e/iT7j361BY7z6h++eONicbdc9jPjSZMRB98N7xp9u/KRP/FcGjP/XF7/ycr+65i8jbsdp/U+OxCo2qlvF+u7e3fXq0lp5rbxZKi0uLM6/fu+1UjHLURe7meqT/vHGnef6xW/1f7pP/Pw5/f/6gP3/1f/e/eFXz4j/za+dfv1fOCN+a078xoDxl6Z/m+9X14q/0qf/513/OwPG/+hveysDngoADEF9d29jqVIpbz95IX/mOellhBigkETsX3GIx4Xcr3/61vkn54bWngsWol/VxNPSwmtTyD0dzRigMOqRCbhqj2/6UbcEAAAAAAAAAAAAAADoZxh/TjTqPgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB9fRoAAP//j4/W2A==") r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') r5 = open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x1) sendfile(r5, r4, 0x0, 0x80000000) lchown(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) 1.026391057s ago: executing program 4 (id=4277): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x8000, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x141842, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) ioctl$FICLONE(r1, 0x40049409, r2) mount_setattr(r0, &(0x7f0000000440)='./file0\x00', 0x200, &(0x7f0000000480)={0xfb, 0x100080, 0xc0000, {r2}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) fstat(r3, &(0x7f0000000500)) 875.325559ms ago: executing program 4 (id=4279): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000440)={0xffffffffffffffff}) connect$pppoe(r0, &(0x7f0000000740)={0x18, 0x0, {0x2, @broadcast, 'veth1\x00'}}, 0x1e) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x1, 0x0, 0x1b, 0x0, 0x0, 0x102, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x400}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x5, 0x0}, 0x8) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000940), &(0x7f0000000980)='syzkaller\x00', 0x2d0, 0x2a, &(0x7f0000000a00)=""/42, 0x40f00, 0x31, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0x2, 0x1}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x5, 0x401, 0x5}, 0x10, r3, 0x0, 0x0, &(0x7f0000000ac0)=[0xffffffffffffffff, r2, r2, r2, r2, r2], 0x0, 0x10, 0x401, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f0000001fee)='R\x10rust\xe3cusg\x91\xdeeH\xe5+\xf0', 0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000780), r4) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r4, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000007c0)={0x14, r5, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='kfree\x00', 0xffffffffffffffff, 0x0, 0x6}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000019c0)={0x28, r6, 0xacf5e67dd0b583a1, 0x70bd29, 0x0, {{0x5}, {@val={0x7}, @val={0xc}}}}, 0x28}}, 0x0) socket$rxrpc(0x21, 0x2, 0x2) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f00000006c0)='./bus\x00', 0x200015, &(0x7f0000000240)={[{@orlov}, {@resgid}, {@norecovery}, {@commit={'commit', 0x3d, 0x5}}, {@nombcache}]}, 0x8, 0x61c, &(0x7f0000001900)="$eJzs3c1vVFUbAPDn3n7Svq9TiFFxIU2MgURpaQFDjImwJwQ/dq4qLQQplNAaLZJYEtyYGDcuTFy5EP8LJXHrwp1x4caVISHGsBBDZMydmVum05kyLTOdMvP7JZeec2/nnjPNPDxnzpx7J4CeNZ79k0bsjYjLSUSh6lh/VA6Ol3/v7l/XzmRbEsXi238mce2TZKX6XEnl52jlwf8WIvk5jdjTt77dxeWrF2bm5+euVOqTSxcvTy4uXz14/uLMublzc5emX50+dvTI0WNThx7r+aVV5ZM33v+w8Nmpd7/9+n4y9d1vp5I4Hg8qfcueV+1jhyKiTtebNh7jUSy7V70/+7see4zz7iR/F/LXyUNJ7Q52rLOV1+NARDwbhegrverLCvHpmx3tHNBWxSTyHAX0nGRL8T/c+o4A2ywfB+Tv7eu9D14vbfOoBNgOd06UJwDKsT8QEXn895fnBmO4NDcwcjdZM8+TRMTjzcyVZW389OOpG9kWDebhVplXgpZauZ7P99Xm/6QUm2MxXKqN3E3XhF9atWX739pi++M19ebGH0ArrFyPiOcq+X8wNhX/41Xx/94W2xf/AAAAAAAA0Dq3TkTEK/XW/6Wr638G66z/GY2I4y1o/9Gf/6W3K4WkBc0BVe6ciHi97vrf1TW+Y32V2v9L6wEGkrPn5+cORcRTEXEgBoay+lTNeatXCB/8fM9XjdqvXv+XbVn7+VrAyplu9ydro392ZmmmFc8det2d6xHPl9b/7qvsWbv+J8v/SZ38n8X35Sbb2PPSzdONjj06/oF2KX4Tsb9u/n+YcJON788xWRoPTOajgvVe+PiL7xu1L/6hc7L8P7Jx/A8l1ffrWdzc+Qcj4vByf7HR8abG/0NrH5ON/weTd/ry82c+mllaujIVMZicXL9/enN9hm6Vx0MeL1n8H3hx4/m/1fF/VRzuioiVJtt85sHo742Oyf/QOVn8z26c/8fW5v/NF6Zvjv3QqP3TTeX/I6WcfqCyx/wfVFt/P45mA7Qj3QUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAJ1waEf+LJJ1YLafpxETEaEQ8HSPp/MLi0stnFz64NJsdK33/f5p/02+hXE/y7/8fq6pP19QPR8TuiPiyb1epPnFmYX62008eAAAAAAAAAAAAAAAAAAAAdojR0jX/xaHa6/8zf/R1undA2/VXfop36D39W35kcailHQG23dbjH3jSNR//A23tB7D9Gsf/vfvFkm3tDrCNjP+hd20x/n1cAF1A/ode1eSc3nC7+wF0gvwPAAAAAABdZfe+W78mEbHy2q7SlhmsHLPYH7pb2ukOAB1jDS/0rv6FTvcA6BTv8YFktfRP3Yv9G6/+T9rTIQAAAAAAAAAAAABgnf17Xf8PvWrj6/+t7YdutsH1//WC3+0CoIs0/uoPuR+6nff40NOKhSayvev/AQAAAAAAAAAAAGAHGL56YWZ+fu7K4vKTV3hjw9/JFybviK4+LKzM7IhutLTwoD1nHoiI1p3wl6Hy62FH/MUeUchvwdHBbnTqPyQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDWfwEAAP//Nb8imQ==") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000900)) 663.566012ms ago: executing program 4 (id=4285): r0 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000001c80)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x173b2a7e, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x19}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x590}}, {{0x0, 0x0, &(0x7f0000001500)}}], 0x2, 0x28048005) r1 = socket$inet(0xa, 0x801, 0x84) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f00000101c0), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000000280)={0x77359400}, &(0x7f0000048000)=0x1, 0x0) connect$inet(r1, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) shmget(0x3, 0x2000, 0x219, &(0x7f0000ffb000/0x2000)=nil) shmget(0x3, 0x3000, 0x8, &(0x7f0000ff4000/0x3000)=nil) listen(r1, 0x8) accept4(r1, 0x0, 0x0, 0x0) socket$kcm(0xa, 0x3, 0x3a) socket$kcm(0xa, 0x3, 0x3a) r2 = socket$kcm(0x10, 0x2, 0x4) unshare(0x8000000) semtimedop(0x0, &(0x7f0000000040)=[{0x0, 0xd, 0x1000}], 0x1, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3e, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f00000000c0)='kfree\x00', r3}, 0x10) connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r4, 0x0, 0x0) unshare(0x2c040000) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0xc, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000700)="48000000140081fb7059ae08060c04000aff0f03000004000011000000006fabca1b4e7d06a6bd7c493872f750375ed08a562ad6e74703c48f93b82a02000000461eb886a5e54e8f", 0x48}], 0x1}, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000700002c0000000000000004850000002a00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x67, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='kfree\x00', r6}, 0x18) socket$inet_dccp(0x2, 0x6, 0x0) 499.782623ms ago: executing program 1 (id=4289): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000300)='4', 0x1}], 0x1) 477.690724ms ago: executing program 1 (id=4290): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x8000, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x141842, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) ioctl$FICLONE(r1, 0x40049409, r2) mount_setattr(r0, &(0x7f0000000440)='./file0\x00', 0x200, &(0x7f0000000480)={0xfb, 0x100080, 0xc0000, {r2}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) fstat(r3, &(0x7f0000000500)) 458.883254ms ago: executing program 1 (id=4291): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x7a, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @lirc_mode2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x18) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x20, 0x1, 0x1, 0x101, 0x0, 0x0, {0xa}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xcd}]}]}, 0x20}}, 0x0) 458.293784ms ago: executing program 3 (id=4292): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000040007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ff000000000000f900000000000000", @ANYRESHEX=r0, @ANYRESOCT=r0], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='sys_enter\x00', r1}, 0x10) modify_ldt$write(0x1, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x10201, 0x4b) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) fcntl$lock(r2, 0x24, &(0x7f0000000140)={0x2, 0x0, 0xfffffffffffffffd, 0x8000000000000001, r3}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r4, 0x0, 0x2}, 0x18) lsm_set_self_attr(0x64, 0x0, 0x20, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f00000015c0)='kmem_cache_free\x00'}, 0x10) listen(0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000140)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 427.343924ms ago: executing program 1 (id=4293): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES64=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x18) r2 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x8000001f) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x40, 0x1, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x800000000003}, 0x1100, 0x5dd8, 0x0, 0x5, 0x0, 0x8, 0xfffb, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r3 = io_uring_setup(0x4d3f, &(0x7f0000001500)={0x0, 0xca6a, 0x40, 0x1, 0x13b}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r3, 0xb, &(0x7f0000000480), 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x8000003d) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) close(r4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000890438000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)=ANY=[@ANYRES32=r4, @ANYRES32=r4, @ANYBLOB="14000000728c44cb973ff6e47931a0f6297d20ceee04000000", @ANYRES32=0x0, @ANYRES64=0x0], 0x20) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000"], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$sock_buf(r6, 0x1, 0x1f, 0xffffffffffffffff, &(0x7f00000003c0)) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000004c0)={0xfffffffc, 0x0}, 0x8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000500)={r5, 0xffffffffffffffff}, 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000540)={r4, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xf, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x27, 0x0, 0x0, 0x0, 0x7}, [@printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xbbed}}, @alu={0x7, 0x0, 0x0, 0x1, 0x8, 0xfffffffffffffffe, 0x1}, @cb_func={0x18, 0x2, 0x4, 0x0, 0xfffffffffffffff8}, @ldst={0x1, 0x1, 0x6, 0x5, 0x7, 0xfffffffffffffff4}]}, &(0x7f0000000080)='syzkaller\x00', 0x4, 0xab, &(0x7f00000002c0)=""/171, 0x41100, 0x1, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000400)={0x5, 0xb, 0x5, 0x4}, 0x10, r7, r1, 0x2, &(0x7f0000000580)=[r8, r2, r0, r9, r2, r2], &(0x7f0000000680)=[{0x3, 0x2, 0x8, 0x3}, {0x1, 0x1, 0xa, 0xa}], 0x10, 0xfffffffc, @void, @value}, 0x94) close$binfmt(r2) close_range(r2, 0xffffffffffffffff, 0x0) 368.055955ms ago: executing program 3 (id=4294): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000040)='sched_switch\x00'}, 0x18) setsockopt$inet6_IPV6_RTHDRDSTOPTS(0xffffffffffffffff, 0x29, 0x37, &(0x7f0000000000)={0x5c}, 0x8) rmdir(&(0x7f0000000180)='./file0\x00') r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000900850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000660000000000"], 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f0000000580)='kmem_cache_free\x00', r1}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f00000002c0)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) rt_sigtimedwait(0x0, 0x0, 0x0, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000007fc0)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000100)=0x10) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000040), 0x55af) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, 0xffffffffffffffff, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x2, &(0x7f0000000180)=[{0x61}, {0x6, 0x0, 0xfc, 0x9}]}) 367.419355ms ago: executing program 1 (id=4295): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x7a, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @lirc_mode2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = accept$phonet_pipe(0xffffffffffffffff, 0x0, &(0x7f0000000240)) setsockopt$PNPIPE_INITSTATE(r1, 0x113, 0x4, &(0x7f0000000300)=0x1, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r0}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x54, &(0x7f0000000640)=[@in6={0xa, 0x4e20, 0x0, @loopback={0x0, 0xac14140b}}, @in6={0xa, 0x4e20, 0x1af, @private2={0xfc, 0x2, '\x00', 0x1}, 0x45}, @in6={0xa, 0x4e20, 0x5, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}]}, &(0x7f00000002c0)=0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c00)={&(0x7f0000000b80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@fwd={0x1}]}, {0x0, [0x2e, 0x2e, 0x2e]}}, &(0x7f0000000c00)=""/4096, 0x29, 0x1000, 0x1, 0x0, 0x0, @void, @value}, 0x28) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='kfree\x00', r4, 0x0, 0xfffffffffffffffd}, 0x18) r5 = socket(0x1e, 0x4, 0x0) r6 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000000)=@req3={0x8001, 0xfc, 0x1, 0x3, 0x6, 0xcb, 0x4}, 0x1c) dup3(r6, r5, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x20, 0x1, 0x1, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xcd}]}]}, 0x20}}, 0x0) 366.688345ms ago: executing program 3 (id=4296): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={0x0, r0}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x4, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYRESHEX=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7fff, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000840)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r1}, 0x10) r2 = getpid() r3 = syz_pidfd_open(r2, 0x0) setns(r3, 0x24020000) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5, 0x0, 0x1000000100}, 0x18) r6 = syz_open_procfs(0x0, &(0x7f0000000180)='pagemap\x00') pread64(r6, &(0x7f0000001240)=""/102400, 0x200000, 0x0) unshare(0x2040400) r7 = socket(0x2, 0x5, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r10 = syz_open_procfs$userns(r2, &(0x7f0000000400)) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x50, r8, 0x800, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0x8}, @val={0xc, 0x99, {0x7, 0x70}}}}, [@NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_PID={0x8, 0x52, r2}, @NL80211_ATTR_PID={0x8, 0x52, r2}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r9}, @NL80211_ATTR_NETNS_FD={0x8, 0xdb, r10}]}, 0x50}, 0x1, 0x0, 0x0, 0x20008800}, 0x40000) sendmmsg$inet_sctp(r7, 0x0, 0x0, 0x0) r11 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r12 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r12, 0x0, r11, 0x0, 0x46) 315.726086ms ago: executing program 1 (id=4297): ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000440)={0xffffffffffffffff}) connect$pppoe(r0, &(0x7f0000000740)={0x18, 0x0, {0x2, @broadcast, 'veth1\x00'}}, 0x1e) r1 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x1, 0x0, 0x1b, 0x0, 0x0, 0x102, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x400}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000380)={0x5, 0x0}, 0x8) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_lsm={0x1d, 0x0, &(0x7f0000000940), &(0x7f0000000980)='syzkaller\x00', 0x2d0, 0x2a, &(0x7f0000000a00)=""/42, 0x40f00, 0x31, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0x2, 0x1}, 0x8, 0x10, &(0x7f00000004c0)={0x4, 0x5, 0x401, 0x5}, 0x10, r3, 0x0, 0x0, &(0x7f0000000ac0)=[0xffffffffffffffff, r2, r2, r2, r2, r2], 0x0, 0x10, 0x401, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020207025000000002dba513d7b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000008f00850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r5}, 0x18) request_key(&(0x7f0000000040)='asymmetric\x00', &(0x7f0000001ffb)={'syz', 0x3}, &(0x7f0000001fee)='R\x10rust\xe3cusg\x91\xdeeH\xe5+\xf0', 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000001200)={0x1, 0xc, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r3, r4, 0x0, 0x0, 0x0, 0x0, 0xe8c, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r2}, &(0x7f0000000180), &(0x7f00000001c0)=r1}, 0x20) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000780), r6) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r6, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f00000007c0)={0x14, r7, 0x1, 0x70bd2a, 0x25dfdbfe}, 0x14}}, 0x80) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='kfree\x00', 0xffffffffffffffff, 0x0, 0x6}, 0x18) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r9) sendmsg$NL80211_CMD_START_AP(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000019c0)={0x28, r10, 0xacf5e67dd0b583a1, 0x70bd29, 0x0, {{0x5}, {@val={0x7}, @val={0xc}}}}, 0x28}}, 0x0) sendmsg$NL80211_CMD_RELOAD_REGDB(r8, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x14, r10, 0x2, 0x70bd29, 0x25dfdbfd, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000040}, 0x4000004) socket$rxrpc(0x21, 0x2, 0x2) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f00000006c0)='./bus\x00', 0x200015, &(0x7f0000000240)={[{@orlov}, {@resgid}, {@norecovery}, {@commit={'commit', 0x3d, 0x5}}, {@nombcache}]}, 0x8, 0x61c, &(0x7f0000001900)="$eJzs3c1vVFUbAPDn3n7Svq9TiFFxIU2MgURpaQFDjImwJwQ/dq4qLQQplNAaLZJYEtyYGDcuTFy5EP8LJXHrwp1x4caVISHGsBBDZMydmVum05kyLTOdMvP7JZeec2/nnjPNPDxnzpx7J4CeNZ79k0bsjYjLSUSh6lh/VA6Ol3/v7l/XzmRbEsXi238mce2TZKX6XEnl52jlwf8WIvk5jdjTt77dxeWrF2bm5+euVOqTSxcvTy4uXz14/uLMublzc5emX50+dvTI0WNThx7r+aVV5ZM33v+w8Nmpd7/9+n4y9d1vp5I4Hg8qfcueV+1jhyKiTtebNh7jUSy7V70/+7see4zz7iR/F/LXyUNJ7Q52rLOV1+NARDwbhegrverLCvHpmx3tHNBWxSTyHAX0nGRL8T/c+o4A2ywfB+Tv7eu9D14vbfOoBNgOd06UJwDKsT8QEXn895fnBmO4NDcwcjdZM8+TRMTjzcyVZW389OOpG9kWDebhVplXgpZauZ7P99Xm/6QUm2MxXKqN3E3XhF9atWX739pi++M19ebGH0ArrFyPiOcq+X8wNhX/41Xx/94W2xf/AAAAAAAA0Dq3TkTEK/XW/6Wr638G66z/GY2I4y1o/9Gf/6W3K4WkBc0BVe6ciHi97vrf1TW+Y32V2v9L6wEGkrPn5+cORcRTEXEgBoay+lTNeatXCB/8fM9XjdqvXv+XbVn7+VrAyplu9ydro392ZmmmFc8det2d6xHPl9b/7qvsWbv+J8v/SZ38n8X35Sbb2PPSzdONjj06/oF2KX4Tsb9u/n+YcJON788xWRoPTOajgvVe+PiL7xu1L/6hc7L8P7Jx/A8l1ffrWdzc+Qcj4vByf7HR8abG/0NrH5ON/weTd/ry82c+mllaujIVMZicXL9/enN9hm6Vx0MeL1n8H3hx4/m/1fF/VRzuioiVJtt85sHo742Oyf/QOVn8z26c/8fW5v/NF6Zvjv3QqP3TTeX/I6WcfqCyx/wfVFt/P45mA7Qj3QUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAJ1waEf+LJJ1YLafpxETEaEQ8HSPp/MLi0stnFz64NJsdK33/f5p/02+hXE/y7/8fq6pP19QPR8TuiPiyb1epPnFmYX62008eAAAAAAAAAAAAAAAAAAAAdojR0jX/xaHa6/8zf/R1undA2/VXfop36D39W35kcailHQG23dbjH3jSNR//A23tB7D9Gsf/vfvFkm3tDrCNjP+hd20x/n1cAF1A/ode1eSc3nC7+wF0gvwPAAAAAABdZfe+W78mEbHy2q7SlhmsHLPYH7pb2ukOAB1jDS/0rv6FTvcA6BTv8YFktfRP3Yv9G6/+T9rTIQAAAAAAAAAAAABgnf17Xf8PvWrj6/+t7YdutsH1//WC3+0CoIs0/uoPuR+6nff40NOKhSayvev/AQAAAAAAAAAAAGAHGL56YWZ+fu7K4vKTV3hjw9/JFybviK4+LKzM7IhutLTwoD1nHoiI1p3wl6Hy62FH/MUeUchvwdHBbnTqPyQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDWfwEAAP//Nb8imQ==") bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x63, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x48) r11 = socket$netlink(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r11, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r12, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000900)) 314.807356ms ago: executing program 3 (id=4298): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f00000009c0)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f3bbb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68000000000000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465a932b77a74e802a0dc6bf25d8a242bc6099ad2300000480006ef6c1ff0900ff0000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767192361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af740b5b7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48bc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1f001b2cd3170400000085be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe760e717a04becff0f719197724f4fce1093b62d7e8c7123d890cec55bf404e4e1f74b7eed82571be54c72d978cf906df08f11f1c4042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f871b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9f0390a6f01e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5eaff07000000000000b99c9cc0ad1857216f000000009191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a798de44aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df98674152f94e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270b939b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf01cfaed9ef0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546bb2e51935ab9067ec3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f626602111b40e761fd21081920382f14d12ca3c471c7868e7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df902aeec50e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec743af930cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd6d89f80a4377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f000000000100000000d77480e0345effff6413258d1f6eb190aa28cbb4bafe3436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fb03b84f63e022fe755f4007a4a899eaf52c4f491f1e97c862e29e4570600000091c691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104d74dc07748f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c7167d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c2499ce3ffe2fef03f7cdd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426cfce471fef821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ada08f5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba3c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63e4581d5cc41cbde2ba66adc1168070c8c6e18a6a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c514b37c668554d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c3340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a39938613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b909006f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f1400010000ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1b0100448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae05025040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483d02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e918d685a7b099a4f8ed654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732ab916a781b9912160a3fd2a2e74dd690c57bdfdc1f069f949170ef8cb9c13c12138116bca7a8c59363799be7005c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2c74664d60a4b9423f3297bc8eb91b4ee1d73272abbef3e7a828a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece58e752b47e6f677eff7c5c568a89d6e36b165c39132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae1676384ff799783f55d7e5a1a0920300000000000000d98440c355927629f2bcf9dc405a18ca0264400abf38e90000000000000000008faf2cddffbfa69bf32eb718e88ec75603ed7c7a8825ce0f27a114bd7a4ab74d0c7b8d90ccc1c3ca6620def782e24d75aed70eb676437f62677a69e0994cd82d72e95493c830fe9515329f40b7025326dec33a527c5d999298eaa3690fd0d38a02fc6e0bc16dbe19f353027edc014411e1138087221492f5d5e5cc9d0a1acd3f581eda9a807aa0e609f935f626d96351e0ff116686cbeb8939feecd5dac8cf45101942cc7cec21b7f337df5431bcf7e504b7c427f70a10e1cb8993a661306a0576b638a0171e6800b5b35589d676eb30ed1a72e8f7b057eb281c4504195635b6b285ebaba019913a2520e43ed790231f047f7d3789c10ae7d724929f77aec1d33d9587580268ee14396f71e7ef588cb2560d6bd0795a9b97281229eb16de086553469fad7214ffc3e416f8b8e442dce1d37f9b1c88a5d8a8d9f2fe45bd8df213ecb4194c8554aea13cadcd502e51f6fec80418e772b5bd8d0228949058038b185909ee542848680f9ad43f4057d676d5e21ae3d7e0e4a28c04f112a94707f032b35915e42993ff148291b8babe026646ee41905992db217561b90811c4702a14f312fe5d2ae7257db6be1034cc1c346b76a853ce274bf0435e18f7e86c660c18c80f30505dd4cf2ae2a1893b83c62d61bfeadc1f913e4cab2b897e096dd3fe3525090410cb23bab36cdf200a36014032cf6e5121803c5a0c4a273a19f340163fc6265425d513a1294b8439276394945d94a589708e32a1cb30f1fa4b2f08e01dc5e8c6732e6dc59b5c8cb400000000000000592c9b68f09c8f5ddb20b4ae08b4d9df548e5ed6cd47b91a4bea8b6aa52edf64576aef1e43f2958437fdc20fbbd0d4e13d8cce1193b2f9b4f107e25af178d056e1b1e40bd75b013f7484fae0bc447b1ffaf34819fe3ad1a634c94345e26e1e68dec08723a37b05d1594a66a4718a51d4d67fc880c9d640f4eacc509873f1a103c87f69"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x1400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0xaffffff7ffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x811e, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x1, 0x9}, 0x4110, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x56, 0x1, 0x0, 0x0, 0x0, 0x7fef, 0x82, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7b, 0x1, @perf_config_ext={0x407fff, 0xaea}, 0x14105, 0x2e, 0xfffffbff, 0x3, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xa9e6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000400)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x5, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r1}, &(0x7f0000000340), &(0x7f0000000380)=r2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0x5ee, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38, 0x0, 0x0, 0x10, &(0x7f0000002e00), 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r3, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2800004, 0x28011, 0xffffffffffffffff, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x52, &(0x7f0000000080)={0x0, 0x8b48, 0x2000, 0x0, 0x3d8}, &(0x7f0000ff0000), 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r4}, &(0x7f0000000040), &(0x7f0000000280)}, 0x20) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) r6 = add_key$keyring(0x0, &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) add_key(&(0x7f00000003c0)='ceph\x00', 0x0, &(0x7f0000000400)="010000000037a788a11d1f000000000000006923c63a4541062101a59ea9cba39a989ca8c70b3692930208", 0x2b, r6) add_key(&(0x7f0000000180)='rxrpc_s\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000240)="1b65a426838f2d31ac2c51df3ae0759bd35b3a37fc291d494c4bf31706278c8c1eb19deffe8d5334", 0x28, 0xfffffffffffffff9) socket$inet6_icmp(0xa, 0x2, 0x3a) 247.094077ms ago: executing program 2 (id=4299): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c000280050001"], 0x64}}, 0x0) 187.839038ms ago: executing program 2 (id=4300): bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014fa0000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r3}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0xf1, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_HH_FLOWS_LIMIT={0x4}]}}]}, 0x38}}, 0x0) 146.112018ms ago: executing program 0 (id=4301): r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000060000000000000000850000000f000000c5000000a000020095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={0x0, r1}, 0x18) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000300)='4', 0x1}], 0x1) 110.524949ms ago: executing program 3 (id=4302): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x8000, 0x2) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./bus\x00', 0x141842, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) ioctl$FICLONE(r1, 0x40049409, r2) mount_setattr(r0, &(0x7f0000000440)='./file0\x00', 0x200, &(0x7f0000000480)={0xfb, 0x100080, 0xc0000, {r2}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x4, &(0x7f0000000180)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) fstat(r3, &(0x7f0000000500)) 97.562919ms ago: executing program 0 (id=4303): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) mount$9p_fd(0x0, &(0x7f0000000480)='./bus/file0\x00', &(0x7f00000004c0), 0x2, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@cache_readahead}], [{@func={'func', 0x3d, 'BPRM_CHECK'}}, {@euid_eq={'euid', 0x3d, 0xee01}}]}}) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000000100)={0x2, {0x2, 0x0, 0x6, 0x1fc}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="1801000000001f00000000000000ea1f850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xec, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='kmem_cache_free\x00', r2, 0x0, 0xfffffffffffffffc}, 0x18) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = eventfd2(0x0, 0x0) io_setup(0x6, &(0x7f0000000140)=0x0) io_submit(r5, 0x2, &(0x7f00000000c0)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0xfffd, r3, 0x0, 0x0, 0x0, 0x0, 0x3, r4}, 0x0]) r6 = syz_io_uring_setup(0x7e, &(0x7f0000000540)={0x0, 0xbf09, 0x10100, 0x0, 0x313, 0x0, r1}, &(0x7f00000005c0), &(0x7f0000000100)) io_uring_enter(r6, 0x46f3, 0x0, 0x63, 0x0, 0x0) r7 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x8, 0x8000, 0x400253}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000850000000500000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x25, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='kfree\x00', r10, 0x0, 0xa8}, 0x18) r11 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r11, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) bind$tipc(r11, 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r11, 0x10f, 0x88) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r12 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) syz_io_uring_submit(r8, r9, &(0x7f0000000080)=@IORING_OP_SPLICE={0x1e, 0x1, 0x0, @fd_index=0x2, 0x3, {0x0, r10}, 0x3b53, 0x5, 0x0, {0x0, r12, r7}}) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, r12) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000240)='./file1\x00', 0x3000000, &(0x7f0000000200)={[{@nobarrier}, {@dioread_nolock}]}, 0x1, 0x527, &(0x7f0000019580)="$eJzs3W1rZFcdAPD/vZPZZndTM1WRtWBbbGW36M5sGttGkXYF0RdSUOv7NSaTEDLJhMykbkLRLH4AQUSFfgDfCH4AQfoRRCjoe1FRRLf6UnvlztyxeZhJhjzN7uT3g5M55z6c/zmXzJ37cLg3gEvruYi4GxGliHgxIqaL6WmRYreb8uXef/j2Qp6SyLI3/5FEUkzr1ZWXJyLierHaZER862sR300Ox21t76zONxr1zaJca69t1FrbO7dX1uaX68v19dnZmVfmXp17ee5OVjhVPysR8dpX/vLTH/3iq6/95nPf++O9v936ft6sL32i2+6IWDhVgAG6dZc726In30ab5xFsRPL+lEujbgUAAMPIj/E/GhGf7hz/T0epczQHAAAAjJPs9an4TxKRAQAAAGMrjYipSNJqMRZgKtK0Wu2O4f14XEsbzVb7s0vNrfXFfF5EJcrp0kqjfqcYK1yJcpKXZ4oxtr3ySwfKsxHxVET8ZPpqp1xdaDYWR33xAwAAAC6J68/uP///93TayQMAAABjpjKwAAAAAIwLp/wAAAAw/pz/AwAAwFj7xhtv5Cnrvcd78a3trdXmW7cX663V6trWQnWhublRXW42lzvP7Fs7rr5Gs7nx+Vjful9r11vtWmt7595ac2u9fW9l3yuwAQAAgAv01LPv/iGJiN0vXu2kKJ4DCFwWX78y1GJ/PveGABeoNOoGACMzMeoGACNTPnYJewgYd8kx8w8P3uleK4zfnk97AACAs3fzk3vv/7/Tmda7GXj8tQHgcWasDwBcPu7uweVVjtKDE61448ybAozIR7ofTwyaP/DhHUPc/+9eY8iyEzUMAAA4M1OdlKTV4jh9KtK0Wo14svNagHKytNKo3ynOD34/XX4iL8901kyOHTMMAAAAAAAAAAAAAAAAAAAAAAAAAHRlWRJZX1G8Fbz/XAAAAODxEZH+NSnO9G9OvzC1/+rAgbd+vfPmz+7Pt9ubMxFXkn9O55OuRET758X0lzKvBAAAAIBHQPc8vficGXVrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABg37z98e6GXLjLu378cEZV+8SdisvM5GeWIuPavJCb2rJdEROkM4u8+iIgb/eIn8UGWZZWiFf3iXz3n+JXOpukfP42I62cQHy6zd/P9z91+3780nut89v/+TRTptAbv/9L/7/9KA/Y/Tx4oD/L0e7+qDYz/IOLpif77n178pBt/X4i88PyQffzOt3d2+s7YU2W/+Htj1dprG7XW9s7tlbX55fpyfX12duaVuVfnXp67U1taadSLv33D/PhTv/7gqP5fGxC/sr//h7b/C0P1Pov/vnf/4ce6hXK/+Lee7//7e2NA/LT47ftMkc/n3+zld7v5vZ755e+eOar/iwP6P3lM/28N1f/4wovf/OGf+s45tDUAgIvQ2t5ZnW806ptHZCaHWOaCM68/Gs04w0w8Gs0YVSb7Qff/8XT1nHL1Q5nsNKtPxBk048qh72kpTlphErGb1zXkPyQAADBmPjzoP+oOEgAAAAAAAAAAAAAAAAAAAHCeTvhYssmIOHKZu3tqPhhzdzRdBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA40v8CAAD//+SZylA=") sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)=@flushsa={0x14, 0x1c, 0x20, 0x70bd2a, 0x25dfdbfc, {0xff}}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x20000) mkdir(&(0x7f0000000080)='./bus\x00', 0x0) openat$nvram(0xffffffffffffff9c, &(0x7f0000000180), 0x410000, 0x0) r13 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r13, 0x10f, 0x87, &(0x7f0000000300)={0x43, 0x0, 0x3, 0x3}, 0x10) 563.13µs ago: executing program 3 (id=4304): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000e00)={0x11, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffe, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0, 0x0, 0x7}, 0x18) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) sendfile(r1, r1, 0x0, 0x40000f63c) 0s ago: executing program 2 (id=4305): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000040007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ff000000000000f900000000000000", @ANYRESHEX=r0, @ANYRESOCT=r0], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x46, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='sys_enter\x00', r1}, 0x10) modify_ldt$write(0x1, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x10201, 0x4b) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) fcntl$lock(r2, 0x24, &(0x7f0000000140)={0x2, 0x0, 0xfffffffffffffffd, 0x8000000000000001, r3}) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r4, 0x0, 0x2}, 0x18) lsm_set_self_attr(0x64, 0x0, 0x20, 0x0) socket$can_raw(0x1d, 0x3, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000140)='+}[@\x00') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f00000015c0)='kmem_cache_free\x00'}, 0x10) listen(0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) kernel console output (not intermixed with test programs): ][T14659] netlink: 'syz.2.3606': attribute type 3 has an invalid length. [ 307.567852][T14659] loop2: detected capacity change from 0 to 1024 [ 307.584937][T14659] EXT4-fs: Ignoring removed orlov option [ 307.651143][T14659] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 307.660818][T14659] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 307.687261][T14659] EXT4-fs (loop2): invalid journal inode [ 307.703200][T14659] EXT4-fs (loop2): can't get journal size [ 307.753692][T14659] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.876939][T14659] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 307.910970][T14679] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3613'. [ 307.977552][T14659] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.047928][T14659] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.081190][T14690] loop3: detected capacity change from 0 to 512 [ 308.124579][T14690] ext4 filesystem being mounted at /107/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 308.286629][T14710] loop4: detected capacity change from 0 to 1024 [ 308.339540][T14712] SELinux: failed to load policy [ 308.406248][T14724] netlink: 'syz.3.3626': attribute type 10 has an invalid length. [ 308.424192][T14726] loop4: detected capacity change from 0 to 2048 [ 308.572865][T14745] SELinux: failed to load policy [ 308.853509][T14753] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 308.862157][T14753] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 309.188988][T14757] loop3: detected capacity change from 0 to 512 [ 309.217863][T14757] ext4 filesystem being mounted at /112/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 309.274553][T14763] loop3: detected capacity change from 0 to 2048 [ 309.323561][T14767] loop3: detected capacity change from 0 to 512 [ 309.339281][T14767] ext4 filesystem being mounted at /115/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 309.355217][T14574] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.367216][T14574] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.379047][T14574] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.390694][T14574] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 309.426935][T14775] loop3: detected capacity change from 0 to 1024 [ 309.444600][T14771] __nla_validate_parse: 3 callbacks suppressed [ 309.444614][T14771] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3647'. [ 309.603523][T14797] netlink: 'syz.1.3651': attribute type 10 has an invalid length. [ 309.611499][T14797] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3651'. [ 309.700242][T14805] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3661'. [ 309.826246][T14817] loop3: detected capacity change from 0 to 512 [ 309.849577][T14817] EXT4-fs (loop3): 1 orphan inode deleted [ 309.856362][T14817] ext4 filesystem being mounted at /125/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 309.868217][ T3407] EXT4-fs error (device loop3): ext4_release_dquot:6971: comm kworker/u8:6: Failed to release dquot type 1 [ 310.000397][T14830] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3671'. [ 310.027187][T14833] FAULT_INJECTION: forcing a failure. [ 310.027187][T14833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 310.040424][T14833] CPU: 1 UID: 0 PID: 14833 Comm: syz.3.3673 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 310.040452][T14833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 310.040464][T14833] Call Trace: [ 310.040469][T14833] [ 310.040476][T14833] __dump_stack+0x1d/0x30 [ 310.040497][T14833] dump_stack_lvl+0xe8/0x140 [ 310.040521][T14833] dump_stack+0x15/0x1b [ 310.040580][T14833] should_fail_ex+0x265/0x280 [ 310.040621][T14833] should_fail+0xb/0x20 [ 310.040656][T14833] should_fail_usercopy+0x1a/0x20 [ 310.040678][T14833] _copy_from_user+0x1c/0xb0 [ 310.040765][T14833] ___sys_sendmsg+0xc1/0x1d0 [ 310.040808][T14833] __x64_sys_sendmsg+0xd4/0x160 [ 310.040837][T14833] x64_sys_call+0x2999/0x2fb0 [ 310.040879][T14833] do_syscall_64+0xd0/0x1a0 [ 310.040899][T14833] ? clear_bhb_loop+0x25/0x80 [ 310.040919][T14833] ? clear_bhb_loop+0x25/0x80 [ 310.041003][T14833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.041080][T14833] RIP: 0033:0x7fcfff5be969 [ 310.041095][T14833] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 310.041111][T14833] RSP: 002b:00007fcffdc27038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 310.041128][T14833] RAX: ffffffffffffffda RBX: 00007fcfff7e5fa0 RCX: 00007fcfff5be969 [ 310.041140][T14833] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000004 [ 310.041230][T14833] RBP: 00007fcffdc27090 R08: 0000000000000000 R09: 0000000000000000 [ 310.041244][T14833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 310.041258][T14833] R13: 0000000000000000 R14: 00007fcfff7e5fa0 R15: 00007fff1372af48 [ 310.041280][T14833] [ 310.371606][T14849] netlink: 'syz.0.3680': attribute type 3 has an invalid length. [ 310.390748][T14849] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.427345][T14849] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.464491][T14855] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3681'. [ 310.486968][T14849] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.545699][T14849] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 310.626385][T14849] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.638528][T14849] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.653795][T14849] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.673801][T14849] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.773027][T14867] SELinux: failed to load policy [ 311.197587][T14883] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3692'. [ 311.208950][T14884] netlink: 'syz.1.3689': attribute type 10 has an invalid length. [ 311.216832][T14884] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3689'. [ 311.354802][T14894] netlink: 'syz.0.3696': attribute type 3 has an invalid length. [ 311.371713][T14894] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.417516][T14894] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.468214][T14894] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.526950][T14894] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 311.857901][ T29] kauditd_printk_skb: 654 callbacks suppressed [ 311.857916][ T29] audit: type=1326 audit(1746645226.864:15601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 311.890199][ T29] audit: type=1326 audit(1746645226.864:15602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 311.905440][T14909] loop4: detected capacity change from 0 to 512 [ 311.913917][ T29] audit: type=1326 audit(1746645226.864:15603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 311.943823][ T29] audit: type=1326 audit(1746645226.864:15604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 311.967446][ T29] audit: type=1326 audit(1746645226.894:15605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 311.991101][ T29] audit: type=1326 audit(1746645226.894:15606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 312.014923][ T29] audit: type=1326 audit(1746645226.894:15607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 312.039006][ T29] audit: type=1326 audit(1746645226.894:15608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 312.062894][ T29] audit: type=1326 audit(1746645226.894:15609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=290 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 312.086472][ T29] audit: type=1326 audit(1746645226.894:15610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14908 comm="syz.4.3701" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 312.145786][T14909] EXT4-fs (loop4): 1 orphan inode deleted [ 312.164744][T14909] ext4 filesystem being mounted at /159/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 312.177030][ T3407] EXT4-fs error (device loop4): ext4_release_dquot:6971: comm kworker/u8:6: Failed to release dquot type 1 [ 312.210117][T14918] loop1: detected capacity change from 0 to 1024 [ 312.220249][T14918] EXT4-fs: Ignoring removed orlov option [ 312.227157][T14918] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 312.237044][T14918] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 312.247597][T14918] EXT4-fs (loop1): invalid journal inode [ 312.253552][T14918] EXT4-fs (loop1): can't get journal size [ 312.296684][T14922] loop1: detected capacity change from 0 to 2048 [ 312.359828][T14659] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.407350][T14659] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.468746][T14936] SELinux: failed to load policy [ 312.469516][T14659] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.487053][T14659] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 312.574927][T14950] loop1: detected capacity change from 0 to 512 [ 312.597290][T14950] EXT4-fs (loop1): 1 orphan inode deleted [ 312.603747][T14950] ext4 filesystem being mounted at /183/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 312.609704][T14954] loop2: detected capacity change from 0 to 1024 [ 312.624217][T14954] EXT4-fs: Ignoring removed orlov option [ 312.655151][T14954] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 312.690177][T14954] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 312.706726][T14954] EXT4-fs (loop2): invalid journal inode [ 312.712477][T14954] EXT4-fs (loop2): can't get journal size [ 312.827449][T14965] SELinux: failed to load policy [ 312.847420][T14967] loop2: detected capacity change from 0 to 1024 [ 312.863929][T14969] loop1: detected capacity change from 0 to 1024 [ 312.875266][T14969] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 312.886234][T14969] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 312.901747][T14969] JBD2: no valid journal superblock found [ 312.907542][T14969] EXT4-fs (loop1): Could not load journal inode [ 312.922293][T14967] EXT4-fs mount: 73 callbacks suppressed [ 312.922310][T14967] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 312.979901][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 313.143099][T14985] loop2: detected capacity change from 0 to 512 [ 313.172110][T14987] loop1: detected capacity change from 0 to 1024 [ 313.179834][T14985] EXT4-fs (loop2): 1 orphan inode deleted [ 313.194642][T14985] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 313.207885][ T51] EXT4-fs error (device loop2): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 1 [ 313.226533][T14985] ext4 filesystem being mounted at /46/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 313.238203][T14987] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 313.268079][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 313.337488][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 313.647040][T15021] loop3: detected capacity change from 0 to 512 [ 313.667326][T15021] EXT4-fs (loop3): 1 orphan inode deleted [ 313.673876][T15021] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 313.687146][ T1385] EXT4-fs error (device loop3): ext4_release_dquot:6971: comm kworker/u8:5: Failed to release dquot type 1 [ 313.705014][T15021] ext4 filesystem being mounted at /139/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 313.819298][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 314.054283][T15041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 314.064103][T15041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 314.318931][T15043] loop2: detected capacity change from 0 to 512 [ 314.387252][T15043] EXT4-fs (loop2): 1 orphan inode deleted [ 314.405900][ T3407] EXT4-fs error (device loop2): ext4_release_dquot:6971: comm kworker/u8:6: Failed to release dquot type 1 [ 314.441818][T15043] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 314.454566][T15054] loop1: detected capacity change from 0 to 1024 [ 314.494566][T15043] ext4 filesystem being mounted at /48/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 314.505845][T15054] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 314.533387][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 314.640471][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 314.892672][T15068] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3759'. [ 315.205722][T14894] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.300490][T14894] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.321213][T14894] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.357006][T14894] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 315.658701][T15091] netlink: 'syz.0.3767': attribute type 3 has an invalid length. [ 315.686761][T15092] netlink: 'syz.1.3765': attribute type 10 has an invalid length. [ 315.694628][T15092] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3765'. [ 315.750072][T15098] FAULT_INJECTION: forcing a failure. [ 315.750072][T15098] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 315.763224][T15098] CPU: 0 UID: 0 PID: 15098 Comm: syz.0.3770 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 315.763258][T15098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 315.763274][T15098] Call Trace: [ 315.763281][T15098] [ 315.763290][T15098] __dump_stack+0x1d/0x30 [ 315.763312][T15098] dump_stack_lvl+0xe8/0x140 [ 315.763339][T15098] dump_stack+0x15/0x1b [ 315.763353][T15098] should_fail_ex+0x265/0x280 [ 315.763414][T15098] should_fail+0xb/0x20 [ 315.763440][T15098] should_fail_usercopy+0x1a/0x20 [ 315.763455][T15098] _copy_from_user+0x1c/0xb0 [ 315.763512][T15098] ___sys_sendmsg+0xc1/0x1d0 [ 315.763539][T15098] __x64_sys_sendmsg+0xd4/0x160 [ 315.763558][T15098] x64_sys_call+0x2999/0x2fb0 [ 315.763576][T15098] do_syscall_64+0xd0/0x1a0 [ 315.763672][T15098] ? clear_bhb_loop+0x25/0x80 [ 315.763691][T15098] ? clear_bhb_loop+0x25/0x80 [ 315.763710][T15098] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 315.763728][T15098] RIP: 0033:0x7f89cbfae969 [ 315.763740][T15098] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 315.763755][T15098] RSP: 002b:00007f89ca617038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 315.763823][T15098] RAX: ffffffffffffffda RBX: 00007f89cc1d5fa0 RCX: 00007f89cbfae969 [ 315.763833][T15098] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 315.763844][T15098] RBP: 00007f89ca617090 R08: 0000000000000000 R09: 0000000000000000 [ 315.763855][T15098] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.763865][T15098] R13: 0000000000000000 R14: 00007f89cc1d5fa0 R15: 00007ffd528720d8 [ 315.763953][T15098] [ 316.268326][T15106] FAULT_INJECTION: forcing a failure. [ 316.268326][T15106] name failslab, interval 1, probability 0, space 0, times 0 [ 316.281031][T15106] CPU: 1 UID: 0 PID: 15106 Comm: syz.0.3773 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 316.281066][T15106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 316.281081][T15106] Call Trace: [ 316.281089][T15106] [ 316.281153][T15106] __dump_stack+0x1d/0x30 [ 316.281173][T15106] dump_stack_lvl+0xe8/0x140 [ 316.281335][T15106] dump_stack+0x15/0x1b [ 316.281405][T15106] should_fail_ex+0x265/0x280 [ 316.281526][T15106] should_failslab+0x8c/0xb0 [ 316.281641][T15106] kmem_cache_alloc_node_noprof+0x57/0x320 [ 316.281685][T15106] ? __alloc_skb+0x101/0x320 [ 316.281769][T15106] __alloc_skb+0x101/0x320 [ 316.281803][T15106] tcp_stream_alloc_skb+0x2d/0x1d0 [ 316.281826][T15106] tcp_sendmsg_locked+0x9e7/0x28b0 [ 316.281916][T15106] ? __rcu_read_unlock+0x4f/0x70 [ 316.281953][T15106] ? __pfx_tcp_sendmsg+0x10/0x10 [ 316.281978][T15106] tcp_sendmsg+0x2f/0x50 [ 316.282012][T15106] inet6_sendmsg+0x76/0xd0 [ 316.282043][T15106] __sock_sendmsg+0x8b/0x180 [ 316.282172][T15106] sock_write_iter+0x165/0x1b0 [ 316.282226][T15106] ? __pfx_sock_write_iter+0x10/0x10 [ 316.282253][T15106] vfs_write+0x49d/0x8d0 [ 316.282288][T15106] ksys_write+0xda/0x1a0 [ 316.282313][T15106] __x64_sys_write+0x40/0x50 [ 316.282340][T15106] x64_sys_call+0x2cdd/0x2fb0 [ 316.282417][T15106] do_syscall_64+0xd0/0x1a0 [ 316.282458][T15106] ? clear_bhb_loop+0x25/0x80 [ 316.282483][T15106] ? clear_bhb_loop+0x25/0x80 [ 316.282509][T15106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.282658][T15106] RIP: 0033:0x7f89cbfae969 [ 316.282674][T15106] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 316.282738][T15106] RSP: 002b:00007f89ca617038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 316.282761][T15106] RAX: ffffffffffffffda RBX: 00007f89cc1d5fa0 RCX: 00007f89cbfae969 [ 316.282777][T15106] RDX: 00000000076e5467 RSI: 0000200000000080 RDI: 0000000000000003 [ 316.282790][T15106] RBP: 00007f89ca617090 R08: 0000000000000000 R09: 0000000000000000 [ 316.282802][T15106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.282864][T15106] R13: 0000000000000000 R14: 00007f89cc1d5fa0 R15: 00007ffd528720d8 [ 316.282886][T15106] [ 316.804458][T15126] loop1: detected capacity change from 0 to 1024 [ 316.846106][T15126] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 316.849199][T15132] loop2: detected capacity change from 0 to 512 [ 316.884904][ T29] kauditd_printk_skb: 983 callbacks suppressed [ 316.884990][ T29] audit: type=1326 audit(1746645231.884:16590): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15125 comm="syz.1.3781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 316.936536][ T29] audit: type=1326 audit(1746645231.884:16591): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15131 comm="syz.2.3778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe7081ed5ca code=0x7ffc0000 [ 316.960145][ T29] audit: type=1326 audit(1746645231.884:16592): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15131 comm="syz.2.3778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe7081ed5ca code=0x7ffc0000 [ 316.983649][ T29] audit: type=1326 audit(1746645231.914:16593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15125 comm="syz.1.3781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=128 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 317.007357][ T29] audit: type=1326 audit(1746645231.914:16594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15125 comm="syz.1.3781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 317.031044][ T29] audit: type=1326 audit(1746645231.924:16595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15125 comm="syz.1.3781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 317.054695][ T29] audit: type=1326 audit(1746645231.924:16596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15131 comm="syz.2.3778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fe7081ed1d7 code=0x7ffc0000 [ 317.078344][ T29] audit: type=1326 audit(1746645231.924:16597): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15125 comm="syz.1.3781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 317.101892][ T29] audit: type=1326 audit(1746645231.924:16598): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15125 comm="syz.1.3781" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 317.125521][ T29] audit: type=1326 audit(1746645231.924:16599): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15131 comm="syz.2.3778" exe="/root/syz-executor" sig=0 arch=c000003e syscall=165 compat=0 ip=0x7fe7081f010a code=0x7ffc0000 [ 317.157757][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.188060][T15132] EXT4-fs (loop2): 1 orphan inode deleted [ 317.194107][T15132] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 317.206770][ T3407] EXT4-fs error (device loop2): ext4_release_dquot:6971: comm kworker/u8:6: Failed to release dquot type 1 [ 317.207215][T15132] ext4 filesystem being mounted at /54/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 317.260806][T15147] loop3: detected capacity change from 0 to 512 [ 317.278312][T15147] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 317.290915][T15147] ext4 filesystem being mounted at /147/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 317.315819][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.328926][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.357573][T15154] netlink: 'syz.1.3785': attribute type 10 has an invalid length. [ 317.365536][T15154] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3785'. [ 317.417106][T15160] netlink: 'syz.2.3790': attribute type 3 has an invalid length. [ 317.433209][T15160] loop2: detected capacity change from 0 to 1024 [ 317.449814][T15160] EXT4-fs: Ignoring removed orlov option [ 317.456040][T15160] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 317.459592][T15159] loop4: detected capacity change from 0 to 1024 [ 317.481564][T15168] loop3: detected capacity change from 0 to 1024 [ 317.489641][T15160] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 317.502727][T15160] EXT4-fs (loop2): invalid journal inode [ 317.508785][T15159] EXT4-fs: test_dummy_encryption option not supported [ 317.518069][T15160] EXT4-fs (loop2): can't get journal size [ 317.525833][T15168] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 317.546339][T15159] syz.4.3792 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 317.558469][T15160] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 317.573100][T15159] SELinux: policydb string length 64776 does not match expected length 8 [ 317.582848][T15160] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.584942][T15159] SELinux: failed to load policy [ 317.625572][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.639076][T15160] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.661844][T15178] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3799'. [ 317.709230][T15180] loop4: detected capacity change from 0 to 512 [ 317.728581][T15160] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.752459][T15180] EXT4-fs (loop4): 1 orphan inode deleted [ 317.766031][ T3407] EXT4-fs error (device loop4): ext4_release_dquot:6971: comm kworker/u8:6: Failed to release dquot type 1 [ 317.784899][T15180] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 317.797764][T15180] ext4 filesystem being mounted at /176/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 317.809930][T15160] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 317.871789][T15160] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.883102][T15160] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.894500][T15160] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.909822][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 317.921856][T15160] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 317.946798][T15189] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3803'. [ 317.980606][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 318.019173][T15195] netlink: 'syz.3.3806': attribute type 3 has an invalid length. [ 318.039153][T15195] loop3: detected capacity change from 0 to 1024 [ 318.047410][T15200] FAULT_INJECTION: forcing a failure. [ 318.047410][T15200] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 318.060642][T15200] CPU: 1 UID: 0 PID: 15200 Comm: syz.2.3807 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 318.060669][T15200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 318.060729][T15200] Call Trace: [ 318.060736][T15200] [ 318.060780][T15195] EXT4-fs: Ignoring removed orlov option [ 318.060745][T15200] __dump_stack+0x1d/0x30 [ 318.060812][T15200] dump_stack_lvl+0xe8/0x140 [ 318.060838][T15200] dump_stack+0x15/0x1b [ 318.060860][T15200] should_fail_ex+0x265/0x280 [ 318.060903][T15200] should_fail+0xb/0x20 [ 318.060980][T15200] should_fail_usercopy+0x1a/0x20 [ 318.061013][T15200] _copy_to_user+0x20/0xa0 [ 318.061039][T15200] simple_read_from_buffer+0xb5/0x130 [ 318.061078][T15200] proc_fail_nth_read+0x100/0x140 [ 318.061144][T15200] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 318.061169][T15200] vfs_read+0x19d/0x6f0 [ 318.061197][T15200] ? __rcu_read_unlock+0x4f/0x70 [ 318.061223][T15200] ? __fget_files+0x184/0x1c0 [ 318.061309][T15200] ksys_read+0xda/0x1a0 [ 318.061341][T15200] __x64_sys_read+0x40/0x50 [ 318.061389][T15200] x64_sys_call+0x2d77/0x2fb0 [ 318.061416][T15200] do_syscall_64+0xd0/0x1a0 [ 318.061444][T15200] ? clear_bhb_loop+0x25/0x80 [ 318.061533][T15200] ? clear_bhb_loop+0x25/0x80 [ 318.061559][T15200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 318.061585][T15200] RIP: 0033:0x7fe7081ed37c [ 318.061604][T15200] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 318.061626][T15200] RSP: 002b:00007fe706857030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 318.061784][T15200] RAX: ffffffffffffffda RBX: 00007fe708415fa0 RCX: 00007fe7081ed37c [ 318.061800][T15200] RDX: 000000000000000f RSI: 00007fe7068570a0 RDI: 0000000000000004 [ 318.061816][T15200] RBP: 00007fe706857090 R08: 0000000000000000 R09: 0000000000000000 [ 318.061831][T15200] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 318.061871][T15200] R13: 0000000000000000 R14: 00007fe708415fa0 R15: 00007ffd818e4728 [ 318.061894][T15200] [ 318.267268][T15195] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 318.281139][T15195] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 318.292351][T15195] EXT4-fs (loop3): invalid journal inode [ 318.301398][T15195] EXT4-fs (loop3): can't get journal size [ 318.347539][T15195] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 318.380796][T15221] netlink: 'syz.4.3812': attribute type 3 has an invalid length. [ 318.392769][T15195] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.411485][T15219] loop1: detected capacity change from 0 to 512 [ 318.441434][T15219] EXT4-fs (loop1): 1 orphan inode deleted [ 318.447793][T15219] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 318.460492][T15219] ext4 filesystem being mounted at /210/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 318.460505][ T51] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 1 [ 318.486392][T15195] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.514629][T15231] netlink: 'syz.2.3816': attribute type 3 has an invalid length. [ 318.527785][T15231] loop2: detected capacity change from 0 to 1024 [ 318.534482][T15231] EXT4-fs: Ignoring removed orlov option [ 318.542025][T15231] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 318.551839][T15231] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 318.565122][T15231] EXT4-fs (loop2): invalid journal inode [ 318.571003][T15231] EXT4-fs (loop2): can't get journal size [ 318.579726][T15195] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.593488][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 318.603292][T15231] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 318.653295][T15239] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 318.663238][T15239] SELinux: failed to load policy [ 318.669365][T15231] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.700648][T15195] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.727326][T15231] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.772157][T15195] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.783507][T15195] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.793309][T15231] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.806504][T15195] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.817715][T15195] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 318.819524][T15248] netlink: 'syz.0.3821': attribute type 10 has an invalid length. [ 318.833885][T15248] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3821'. [ 318.844596][T15231] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.856464][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 318.955880][T15257] loop3: detected capacity change from 0 to 512 [ 318.977716][T15257] EXT4-fs (loop3): 1 orphan inode deleted [ 318.984255][T15257] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 318.996995][ T51] EXT4-fs error (device loop3): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 1 [ 318.997716][T15257] ext4 filesystem being mounted at /157/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 319.126053][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 319.233492][T15264] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3827'. [ 319.653978][T15277] loop1: detected capacity change from 0 to 512 [ 319.660649][T15277] journal_path: Non-blockdev passed as './file0' [ 319.667056][T15277] EXT4-fs: error: could not find journal device path [ 319.679916][T15279] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3834'. [ 319.693678][T15275] SELinux: failed to load policy [ 319.931904][T15292] loop4: detected capacity change from 0 to 512 [ 319.962362][T15292] journal_path: Non-blockdev passed as './file0' [ 319.968774][T15292] EXT4-fs: error: could not find journal device path [ 320.346872][T15300] netlink: 'syz.0.3840': attribute type 10 has an invalid length. [ 320.354737][T15300] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3840'. [ 320.611833][T15309] loop3: detected capacity change from 0 to 1024 [ 320.644436][T15311] SELinux: failed to load policy [ 320.650478][T15309] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 320.694952][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 320.839313][T15321] loop1: detected capacity change from 0 to 1024 [ 320.857536][T15321] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 320.887313][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 320.918822][T15327] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3852'. [ 320.940513][T15331] loop1: detected capacity change from 0 to 512 [ 320.949440][T15331] journal_path: Non-blockdev passed as './file0' [ 320.955846][T15331] EXT4-fs: error: could not find journal device path [ 321.136428][T15340] FAULT_INJECTION: forcing a failure. [ 321.136428][T15340] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 321.149562][T15340] CPU: 0 UID: 0 PID: 15340 Comm: syz.3.3858 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 321.149596][T15340] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 321.149612][T15340] Call Trace: [ 321.149629][T15340] [ 321.149638][T15340] __dump_stack+0x1d/0x30 [ 321.149674][T15340] dump_stack_lvl+0xe8/0x140 [ 321.149696][T15340] dump_stack+0x15/0x1b [ 321.149716][T15340] should_fail_ex+0x265/0x280 [ 321.149753][T15340] should_fail+0xb/0x20 [ 321.149802][T15340] should_fail_usercopy+0x1a/0x20 [ 321.149823][T15340] _copy_from_user+0x1c/0xb0 [ 321.149848][T15340] ___sys_sendmsg+0xc1/0x1d0 [ 321.149888][T15340] __x64_sys_sendmsg+0xd4/0x160 [ 321.149989][T15340] x64_sys_call+0x2999/0x2fb0 [ 321.150014][T15340] do_syscall_64+0xd0/0x1a0 [ 321.150040][T15340] ? clear_bhb_loop+0x25/0x80 [ 321.150110][T15340] ? clear_bhb_loop+0x25/0x80 [ 321.150130][T15340] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 321.150152][T15340] RIP: 0033:0x7fcfff5be969 [ 321.150170][T15340] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 321.150261][T15340] RSP: 002b:00007fcffdc27038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.150283][T15340] RAX: ffffffffffffffda RBX: 00007fcfff7e5fa0 RCX: 00007fcfff5be969 [ 321.150297][T15340] RDX: 0000000000000040 RSI: 00002000000000c0 RDI: 0000000000000003 [ 321.150357][T15340] RBP: 00007fcffdc27090 R08: 0000000000000000 R09: 0000000000000000 [ 321.150371][T15340] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 321.150382][T15340] R13: 0000000000000000 R14: 00007fcfff7e5fa0 R15: 00007fff1372af48 [ 321.150416][T15340] [ 321.348967][ T3388] hid-generic 0000:0004:0000.0001: hidraw0: HID v0.00 Device [syz0] on syz1 [ 321.430068][T15349] loop3: detected capacity change from 0 to 512 [ 321.473682][T15349] journal_path: Non-blockdev passed as './file0' [ 321.480134][T15349] EXT4-fs: error: could not find journal device path [ 321.590310][T15346] fido_id[15346]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 321.906264][ T29] kauditd_printk_skb: 748 callbacks suppressed [ 321.906278][ T29] audit: type=1400 audit(1746645236.914:17344): avc: denied { read write } for pid=15364 comm="syz.0.3868" name="rdma_cm" dev="devtmpfs" ino=251 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 321.937006][ T29] audit: type=1400 audit(1746645236.914:17345): avc: denied { open } for pid=15364 comm="syz.0.3868" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=251 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 321.964655][ T29] audit: type=1400 audit(1746645236.944:17346): avc: denied { create } for pid=15364 comm="syz.0.3868" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 321.985631][ T29] audit: type=1400 audit(1746645236.944:17347): avc: denied { read } for pid=15364 comm="syz.0.3868" name="file0" dev="tmpfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 322.008208][ T29] audit: type=1400 audit(1746645236.944:17348): avc: denied { open } for pid=15364 comm="syz.0.3868" path="/202/file0" dev="tmpfs" ino=1090 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 322.031245][ T29] audit: type=1400 audit(1746645236.944:17349): avc: denied { ioctl } for pid=15364 comm="syz.0.3868" path="/202/file0" dev="tmpfs" ino=1090 ioctlcmd=0x70cd scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 322.055785][ T29] audit: type=1400 audit(1746645237.034:17350): avc: denied { create } for pid=15356 comm="syz.4.3864" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 322.075549][ T29] audit: type=1400 audit(1746645237.034:17351): avc: denied { setopt } for pid=15356 comm="syz.4.3864" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 322.155637][ T29] audit: type=1400 audit(1746645237.164:17352): avc: denied { name_connect } for pid=15372 comm="syz.1.3870" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=sctp_socket permissive=1 [ 322.251613][T15231] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.284547][T15231] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.290448][T15375] SELinux: failed to load policy [ 322.333994][T15231] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.389431][T15231] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 322.477950][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 322.608398][ T29] audit: type=1400 audit(1746645237.524:17353): avc: denied { connect } for pid=15376 comm="syz.1.3872" lport=7 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 322.720579][T15382] netlink: 'syz.3.3874': attribute type 3 has an invalid length. [ 322.949872][T15387] loop3: detected capacity change from 0 to 1024 [ 322.978313][T15387] EXT4-fs: Ignoring removed orlov option [ 322.990504][T15392] loop2: detected capacity change from 0 to 1024 [ 322.997204][T15392] EXT4-fs: Ignoring removed orlov option [ 323.009747][T15392] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 323.026115][T15387] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 323.039830][T15392] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 323.050342][T15392] EXT4-fs (loop2): invalid journal inode [ 323.065623][T15387] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 323.077970][T15392] EXT4-fs (loop2): can't get journal size [ 323.095595][T15387] EXT4-fs (loop3): invalid journal inode [ 323.101315][T15387] EXT4-fs (loop3): can't get journal size [ 323.406133][T15392] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 323.527302][T15387] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 323.574748][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 323.726621][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 323.810229][T15414] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3881'. [ 323.832707][T15416] FAULT_INJECTION: forcing a failure. [ 323.832707][T15416] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 323.845926][T15416] CPU: 0 UID: 0 PID: 15416 Comm: syz.2.3886 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 323.846034][T15416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 323.846049][T15416] Call Trace: [ 323.846057][T15416] [ 323.846065][T15416] __dump_stack+0x1d/0x30 [ 323.846088][T15416] dump_stack_lvl+0xe8/0x140 [ 323.846107][T15416] dump_stack+0x15/0x1b [ 323.846127][T15416] should_fail_ex+0x265/0x280 [ 323.846242][T15416] should_fail+0xb/0x20 [ 323.846289][T15416] should_fail_usercopy+0x1a/0x20 [ 323.846306][T15416] _copy_from_user+0x1c/0xb0 [ 323.846370][T15416] ___sys_sendmsg+0xc1/0x1d0 [ 323.846426][T15416] __x64_sys_sendmsg+0xd4/0x160 [ 323.846449][T15416] x64_sys_call+0x2999/0x2fb0 [ 323.846471][T15416] do_syscall_64+0xd0/0x1a0 [ 323.846546][T15416] ? clear_bhb_loop+0x25/0x80 [ 323.846573][T15416] ? clear_bhb_loop+0x25/0x80 [ 323.846600][T15416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 323.846626][T15416] RIP: 0033:0x7fe7081ee969 [ 323.846641][T15416] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 323.846698][T15416] RSP: 002b:00007fe706857038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 323.846749][T15416] RAX: ffffffffffffffda RBX: 00007fe708415fa0 RCX: 00007fe7081ee969 [ 323.846764][T15416] RDX: 0000000000044080 RSI: 0000200000000040 RDI: 0000000000000003 [ 323.846779][T15416] RBP: 00007fe706857090 R08: 0000000000000000 R09: 0000000000000000 [ 323.846795][T15416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 323.846810][T15416] R13: 0000000000000000 R14: 00007fe708415fa0 R15: 00007ffd818e4728 [ 323.846833][T15416] [ 324.107528][T15422] SELinux: failed to load policy [ 324.151586][T15410] netlink: 'syz.4.3884': attribute type 3 has an invalid length. [ 324.176231][T15418] netlink: 'syz.1.3887': attribute type 3 has an invalid length. [ 324.199788][T15432] loop3: detected capacity change from 0 to 1024 [ 324.237851][T15435] loop1: detected capacity change from 0 to 1024 [ 324.245142][T15435] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 324.256080][T15435] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 324.275787][T15435] JBD2: no valid journal superblock found [ 324.281560][T15435] EXT4-fs (loop1): Could not load journal inode [ 324.302181][T15432] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 324.324743][T15410] loop4: detected capacity change from 0 to 1024 [ 324.350930][T15410] EXT4-fs: Ignoring removed orlov option [ 324.392731][T15410] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 324.402614][T15410] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 324.486629][T15410] EXT4-fs (loop4): invalid journal inode [ 324.492529][T15410] EXT4-fs (loop4): can't get journal size [ 324.500598][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 324.513683][T15410] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 324.653136][T15410] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.728160][T15410] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.801039][T15410] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 324.833644][T15468] netlink: 'syz.1.3904': attribute type 3 has an invalid length. [ 324.874681][T15410] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.076676][T15410] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.141433][T15477] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3907'. [ 325.269113][T15410] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.381378][T15410] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.501460][T15410] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 325.549415][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 325.730530][T15500] netlink: 'syz.2.3911': attribute type 10 has an invalid length. [ 325.738505][T15500] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3911'. [ 325.753085][T15500] dummy0: entered promiscuous mode [ 325.759336][T15500] bridge0: port 3(dummy0) entered blocking state [ 325.765793][T15500] bridge0: port 3(dummy0) entered disabled state [ 325.772571][T15500] dummy0: entered allmulticast mode [ 325.787286][T15498] loop3: detected capacity change from 0 to 1024 [ 325.806853][T15498] EXT4-fs: Ignoring removed orlov option [ 325.817202][T15498] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 325.843280][T15500] bridge0: port 3(dummy0) entered blocking state [ 325.849734][T15500] bridge0: port 3(dummy0) entered forwarding state [ 325.875596][T15498] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 325.909997][T15498] EXT4-fs (loop3): invalid journal inode [ 325.921566][T15498] EXT4-fs (loop3): can't get journal size [ 325.930179][T15506] netlink: 'syz.1.3917': attribute type 3 has an invalid length. [ 325.938542][T15498] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 325.989480][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 326.194828][T15516] netlink: 'syz.3.3921': attribute type 3 has an invalid length. [ 326.218170][T15516] loop3: detected capacity change from 0 to 1024 [ 326.233741][T15516] EXT4-fs: Ignoring removed orlov option [ 326.270647][T15516] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 326.280433][T15516] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 326.296171][T15516] EXT4-fs (loop3): invalid journal inode [ 326.301132][T15519] netlink: 'syz.0.3922': attribute type 3 has an invalid length. [ 326.302100][T15516] EXT4-fs (loop3): can't get journal size [ 326.326592][T15516] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 326.327127][T15519] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.354283][T15516] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.387223][T15519] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.451431][T15516] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.488197][T15519] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.527709][T15516] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.553483][T15527] loop2: detected capacity change from 0 to 1024 [ 326.567450][T15519] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.592586][T15527] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 326.605772][T15516] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 326.640025][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 326.679791][T15519] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.702325][T15519] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.714694][T15519] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.731180][T15519] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.785054][T15516] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.810198][T15516] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 326.833354][T15541] loop2: detected capacity change from 0 to 1024 [ 326.841608][T15541] EXT4-fs: Ignoring removed orlov option [ 326.871901][T15543] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3926'. [ 326.935445][ T29] kauditd_printk_skb: 438 callbacks suppressed [ 326.935465][ T29] audit: type=1326 audit(1746645241.854:17792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f2ac7af5927 code=0x7ffc0000 [ 326.965258][ T29] audit: type=1326 audit(1746645241.854:17793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2ac7a9ab39 code=0x7ffc0000 [ 326.988788][ T29] audit: type=1326 audit(1746645241.854:17794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 327.012377][ T29] audit: type=1326 audit(1746645241.864:17795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f2ac7af5927 code=0x7ffc0000 [ 327.035922][ T29] audit: type=1326 audit(1746645241.864:17796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2ac7a9ab39 code=0x7ffc0000 [ 327.059447][ T29] audit: type=1326 audit(1746645241.864:17797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 327.083066][ T29] audit: type=1326 audit(1746645241.884:17798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f2ac7af5927 code=0x7ffc0000 [ 327.106688][ T29] audit: type=1326 audit(1746645241.884:17799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f2ac7a9ab39 code=0x7ffc0000 [ 327.130302][ T29] audit: type=1326 audit(1746645241.884:17800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f2ac7afe969 code=0x7ffc0000 [ 327.154400][ T29] audit: type=1326 audit(1746645241.894:17801): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15508 comm="syz.1.3918" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f2ac7af5927 code=0x7ffc0000 [ 327.207431][T15516] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.217576][T15541] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 327.227865][T15546] netlink: 'syz.0.3929': attribute type 3 has an invalid length. [ 327.240576][T15516] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 327.249131][T15541] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 327.261496][T15541] EXT4-fs (loop2): invalid journal inode [ 327.279082][T15541] EXT4-fs (loop2): can't get journal size [ 327.279469][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 327.306887][T15541] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 327.332938][T15554] loop1: detected capacity change from 0 to 256 [ 327.454034][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 327.777109][T15573] loop2: detected capacity change from 0 to 512 [ 328.307471][T15573] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 328.320125][T15573] ext4 filesystem being mounted at /75/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 328.357304][T15573] EXT4-fs error (device loop2): ext4_acquire_dquot:6935: comm syz.2.3937: Failed to acquire dquot type 0 [ 328.737526][T15569] netlink: 'syz.4.3938': attribute type 3 has an invalid length. [ 328.760288][T15569] loop4: detected capacity change from 0 to 1024 [ 328.845865][T15569] EXT4-fs: Ignoring removed orlov option [ 329.294702][T15569] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 329.416471][T15569] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 329.453245][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 329.558536][T15569] EXT4-fs (loop4): invalid journal inode [ 329.568693][T15569] EXT4-fs (loop4): can't get journal size [ 329.612686][T15569] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 329.679608][T15589] netlink: 'syz.1.3943': attribute type 3 has an invalid length. [ 329.704846][T15569] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.729453][T15592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3944'. [ 329.745746][T15592] dummy0: left allmulticast mode [ 329.750884][T15592] bridge0: port 3(dummy0) entered disabled state [ 329.759988][T15592] bridge_slave_1: left allmulticast mode [ 329.765742][T15592] bridge_slave_1: left promiscuous mode [ 329.771467][T15592] bridge0: port 2(bridge_slave_1) entered disabled state [ 329.782752][T15592] bridge_slave_0: left allmulticast mode [ 329.783655][T15596] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3945'. [ 329.788507][T15592] bridge_slave_0: left promiscuous mode [ 329.788611][T15592] bridge0: port 1(bridge_slave_0) entered disabled state [ 329.840025][T15569] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.927553][T15569] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 329.937611][T15603] netlink: 'syz.0.3946': attribute type 10 has an invalid length. [ 329.945644][T15603] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3946'. [ 330.007215][T15569] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.339378][T15608] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3948'. [ 330.772979][T15621] loop1: detected capacity change from 0 to 1024 [ 330.787207][T15621] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 330.820156][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 330.982565][T15569] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.053774][T15569] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.069678][T15569] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.078817][T15647] loop3: detected capacity change from 0 to 1024 [ 331.081439][T15569] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.094595][T15647] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 331.105558][T15647] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 331.116751][T15647] JBD2: no valid journal superblock found [ 331.122487][T15647] EXT4-fs (loop3): Could not load journal inode [ 331.129996][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 331.195257][T15650] loop4: detected capacity change from 0 to 1024 [ 331.217343][T15650] EXT4-fs: Ignoring removed orlov option [ 331.246042][T15650] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 331.276513][T15650] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 331.287444][T15650] EXT4-fs (loop4): invalid journal inode [ 331.293348][T15650] EXT4-fs (loop4): can't get journal size [ 331.321420][T15650] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 331.409685][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 331.477848][T15658] loop2: detected capacity change from 0 to 512 [ 331.519014][T15658] EXT4-fs (loop2): 1 orphan inode deleted [ 331.525218][T15658] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 331.541794][ T267] EXT4-fs error (device loop2): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 331.556897][T15658] ext4 filesystem being mounted at /78/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 331.592647][T15666] loop4: detected capacity change from 0 to 512 [ 331.648763][T15666] EXT4-fs (loop4): 1 orphan inode deleted [ 331.654972][T15666] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 331.665557][ T267] EXT4-fs error (device loop4): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 331.668075][T15666] ext4 filesystem being mounted at /198/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 331.723976][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 331.754359][T15676] netlink: 'syz.3.3974': attribute type 3 has an invalid length. [ 331.766902][T15676] loop3: detected capacity change from 0 to 1024 [ 331.773717][T15676] EXT4-fs: Ignoring removed orlov option [ 331.786036][T15676] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 331.798576][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 331.798679][T15676] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 331.818150][T15676] EXT4-fs (loop3): invalid journal inode [ 331.823880][T15676] EXT4-fs (loop3): can't get journal size [ 331.839616][T15676] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.867293][T15682] netlink: 'syz.1.3973': attribute type 10 has an invalid length. [ 331.875177][T15682] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3973'. [ 331.899043][T15686] loop2: detected capacity change from 0 to 1024 [ 331.907789][T15682] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 331.927309][T15686] EXT4-fs (loop2): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 331.929889][T15690] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3977'. [ 331.938293][T15686] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 331.967588][T15676] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.987181][T15692] loop4: detected capacity change from 0 to 1024 [ 331.993686][T15686] JBD2: no valid journal superblock found [ 331.994244][T15692] EXT4-fs: Ignoring removed orlov option [ 331.999512][T15686] EXT4-fs (loop2): Could not load journal inode [ 332.011024][T15692] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 332.022688][T15692] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 332.033793][T15692] EXT4-fs (loop4): invalid journal inode [ 332.040681][T15692] EXT4-fs (loop4): can't get journal size [ 332.056367][T15676] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.077572][ T29] kauditd_printk_skb: 497 callbacks suppressed [ 332.077588][ T29] audit: type=1326 audit(1746645247.084:18295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.116579][ T29] audit: type=1326 audit(1746645247.084:18296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.140328][ T29] audit: type=1326 audit(1746645247.084:18297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=226 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.164085][ T29] audit: type=1326 audit(1746645247.084:18298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.187693][ T29] audit: type=1326 audit(1746645247.084:18299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.211294][ T29] audit: type=1326 audit(1746645247.084:18300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.235005][ T29] audit: type=1326 audit(1746645247.084:18301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.258671][ T29] audit: type=1326 audit(1746645247.084:18302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.282265][ T29] audit: type=1326 audit(1746645247.084:18303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.305947][ T29] audit: type=1326 audit(1746645247.084:18304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15694 comm="syz.0.3979" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 332.331449][T15676] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 332.374562][T15709] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3984'. [ 332.383749][T15709] dummy0: left allmulticast mode [ 332.389055][T15709] bridge0: port 3(dummy0) entered disabled state [ 332.396647][T15709] bridge_slave_1: left allmulticast mode [ 332.402323][T15709] bridge_slave_1: left promiscuous mode [ 332.408121][T15709] bridge0: port 2(bridge_slave_1) entered disabled state [ 332.416251][T15709] bridge_slave_0: left allmulticast mode [ 332.421907][T15709] bridge_slave_0: left promiscuous mode [ 332.427851][T15709] bridge0: port 1(bridge_slave_0) entered disabled state [ 332.450526][T15711] loop2: detected capacity change from 0 to 512 [ 332.467468][T15711] EXT4-fs (loop2): 1 orphan inode deleted [ 332.473845][T15711] ext4 filesystem being mounted at /84/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 332.487019][ T51] EXT4-fs error (device loop2): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 1 [ 332.505053][T15676] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.517011][T15676] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.528845][T15676] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.540685][T15676] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 332.609922][T15719] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3987'. [ 333.161636][T15742] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3997'. [ 333.182074][T15742] dummy0: left allmulticast mode [ 333.187253][T15742] bridge0: port 3(dummy0) entered disabled state [ 333.214642][T15742] bridge_slave_1: left allmulticast mode [ 333.220464][T15742] bridge_slave_1: left promiscuous mode [ 333.226141][T15742] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.245061][T15742] bridge_slave_0: left allmulticast mode [ 333.250947][T15742] bridge_slave_0: left promiscuous mode [ 333.256625][T15742] bridge0: port 1(bridge_slave_0) entered disabled state [ 333.297166][T15747] loop3: detected capacity change from 0 to 512 [ 333.304261][T15747] journal_path: Non-blockdev passed as './file0' [ 333.310750][T15747] EXT4-fs: error: could not find journal device path [ 333.329683][T15744] netlink: 'syz.2.3998': attribute type 3 has an invalid length. [ 333.365883][T15748] loop2: detected capacity change from 0 to 1024 [ 333.392971][T15748] EXT4-fs: Ignoring removed orlov option [ 333.425595][T15748] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 333.498227][T15750] netlink: 'syz.1.4000': attribute type 3 has an invalid length. [ 333.530663][T15752] netlink: 'syz.1.4001': attribute type 3 has an invalid length. [ 333.786473][T15757] loop1: detected capacity change from 0 to 1024 [ 333.806836][T15757] EXT4-fs (loop1): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 333.813009][T15748] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 333.817784][T15757] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 333.848180][T15757] JBD2: no valid journal superblock found [ 333.853967][T15757] EXT4-fs (loop1): Could not load journal inode [ 333.865233][T15748] EXT4-fs (loop2): invalid journal inode [ 333.896115][T15748] EXT4-fs (loop2): can't get journal size [ 333.912307][T15744] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 333.977344][T15744] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.047302][T15744] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.127411][T15744] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 334.199956][T15744] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.218292][T15744] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.240277][T15744] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.252899][T15744] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.288472][T15773] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4009'. [ 334.514277][T15783] netlink: 'syz.2.4013': attribute type 3 has an invalid length. [ 334.981102][T15795] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4016'. [ 335.131598][T15797] netlink: 'syz.1.4017': attribute type 10 has an invalid length. [ 335.139514][T15797] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4017'. [ 335.151875][T15797] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 335.762646][T15816] netlink: 'syz.2.4025': attribute type 29 has an invalid length. [ 335.771638][T15816] netlink: 'syz.2.4025': attribute type 29 has an invalid length. [ 335.787823][T15816] netlink: 492 bytes leftover after parsing attributes in process `syz.2.4025'. [ 336.281425][T15830] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4031'. [ 336.743789][T15841] loop1: detected capacity change from 0 to 512 [ 336.803269][T15841] EXT4-fs (loop1): 1 orphan inode deleted [ 336.812395][T15841] ext4 filesystem being mounted at /266/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 336.823205][ T3407] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:6: Failed to release dquot type 1 [ 336.889833][T15859] netlink: 'syz.0.4042': attribute type 3 has an invalid length. [ 337.007159][T15870] FAULT_INJECTION: forcing a failure. [ 337.007159][T15870] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 337.020336][T15870] CPU: 0 UID: 0 PID: 15870 Comm: syz.2.4047 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 337.020371][T15870] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 337.020386][T15870] Call Trace: [ 337.020393][T15870] [ 337.020401][T15870] __dump_stack+0x1d/0x30 [ 337.020424][T15870] dump_stack_lvl+0xe8/0x140 [ 337.020529][T15870] dump_stack+0x15/0x1b [ 337.020550][T15870] should_fail_ex+0x265/0x280 [ 337.020589][T15870] should_fail+0xb/0x20 [ 337.020633][T15870] should_fail_usercopy+0x1a/0x20 [ 337.020651][T15870] _copy_from_user+0x1c/0xb0 [ 337.020718][T15870] ___sys_sendmsg+0xc1/0x1d0 [ 337.020759][T15870] __x64_sys_sendmsg+0xd4/0x160 [ 337.020820][T15870] x64_sys_call+0x2999/0x2fb0 [ 337.020847][T15870] do_syscall_64+0xd0/0x1a0 [ 337.020894][T15870] ? clear_bhb_loop+0x25/0x80 [ 337.020920][T15870] ? clear_bhb_loop+0x25/0x80 [ 337.021023][T15870] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 337.021050][T15870] RIP: 0033:0x7fe7081ee969 [ 337.021069][T15870] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 337.021141][T15870] RSP: 002b:00007fe706857038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 337.021160][T15870] RAX: ffffffffffffffda RBX: 00007fe708415fa0 RCX: 00007fe7081ee969 [ 337.021172][T15870] RDX: 0000000040040000 RSI: 0000200000000000 RDI: 0000000000000003 [ 337.021187][T15870] RBP: 00007fe706857090 R08: 0000000000000000 R09: 0000000000000000 [ 337.021208][T15870] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 337.021232][T15870] R13: 0000000000000000 R14: 00007fe708415fa0 R15: 00007ffd818e4728 [ 337.021251][T15870] [ 337.210896][T15871] netlink: 'syz.4.4040': attribute type 10 has an invalid length. [ 337.218966][T15871] __nla_validate_parse: 1 callbacks suppressed [ 337.218976][T15871] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4040'. [ 337.239323][T15871] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 337.269502][T15876] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4048'. [ 337.287049][T15876] dummy0: left allmulticast mode [ 337.292139][T15876] bridge0: port 3(dummy0) entered disabled state [ 337.300895][T15879] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4050'. [ 337.311261][T15876] bridge_slave_1: left allmulticast mode [ 337.317132][T15876] bridge_slave_1: left promiscuous mode [ 337.322926][T15876] bridge0: port 2(bridge_slave_1) entered disabled state [ 337.332346][T15876] bridge_slave_0: left allmulticast mode [ 337.338060][T15876] bridge_slave_0: left promiscuous mode [ 337.343800][T15876] bridge0: port 1(bridge_slave_0) entered disabled state [ 337.353244][T15879] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4050'. [ 337.424132][ T29] kauditd_printk_skb: 703 callbacks suppressed [ 337.424146][ T29] audit: type=1326 audit(1746645252.424:19006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.463878][ T29] audit: type=1326 audit(1746645252.454:19007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.487485][ T29] audit: type=1326 audit(1746645252.454:19008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.511249][ T29] audit: type=1326 audit(1746645252.454:19009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.534802][ T29] audit: type=1326 audit(1746645252.454:19010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.558534][ T29] audit: type=1326 audit(1746645252.454:19011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=99 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.582169][ T29] audit: type=1326 audit(1746645252.454:19012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15882 comm="syz.0.4052" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 337.608587][T15887] netlink: 'syz.0.4054': attribute type 3 has an invalid length. [ 337.636231][ T29] audit: type=1400 audit(1746645252.644:19013): avc: denied { getopt } for pid=15888 comm="syz.0.4055" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 337.680545][ T29] audit: type=1400 audit(1746645252.664:19014): avc: denied { setopt } for pid=15888 comm="syz.0.4055" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 337.861326][ T29] audit: type=1400 audit(1746645252.864:19015): avc: denied { setopt } for pid=15897 comm="syz.3.4059" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 337.934142][T15899] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4056'. [ 338.728500][T15919] netlink: 'syz.0.4067': attribute type 10 has an invalid length. [ 338.736490][T15919] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4067'. [ 338.747285][T15919] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 338.782744][T15921] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4068'. [ 338.938339][T15928] loop4: detected capacity change from 0 to 1024 [ 338.993507][T15932] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4072'. [ 339.043002][T15936] loop3: detected capacity change from 0 to 1024 [ 339.051087][T15936] EXT4-fs: Ignoring removed orlov option [ 339.059303][T15936] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 339.072201][T15936] EXT4-fs (loop3): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 339.082998][T15936] EXT4-fs (loop3): invalid journal inode [ 339.088731][T15936] EXT4-fs (loop3): can't get journal size [ 339.188221][T15944] FAULT_INJECTION: forcing a failure. [ 339.188221][T15944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 339.201353][T15944] CPU: 1 UID: 0 PID: 15944 Comm: syz.1.4078 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 339.201383][T15944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 339.201398][T15944] Call Trace: [ 339.201406][T15944] [ 339.201415][T15944] __dump_stack+0x1d/0x30 [ 339.201484][T15944] dump_stack_lvl+0xe8/0x140 [ 339.201508][T15944] dump_stack+0x15/0x1b [ 339.201525][T15944] should_fail_ex+0x265/0x280 [ 339.201558][T15944] should_fail+0xb/0x20 [ 339.201592][T15944] should_fail_usercopy+0x1a/0x20 [ 339.201622][T15944] _copy_from_user+0x1c/0xb0 [ 339.201642][T15944] ___sys_sendmsg+0xc1/0x1d0 [ 339.201686][T15944] __x64_sys_sendmsg+0xd4/0x160 [ 339.201720][T15944] x64_sys_call+0x2999/0x2fb0 [ 339.201746][T15944] do_syscall_64+0xd0/0x1a0 [ 339.201772][T15944] ? clear_bhb_loop+0x25/0x80 [ 339.201791][T15944] ? clear_bhb_loop+0x25/0x80 [ 339.201811][T15944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 339.201955][T15944] RIP: 0033:0x7f2ac7afe969 [ 339.201971][T15944] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 339.201986][T15944] RSP: 002b:00007f2ac6167038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 339.202003][T15944] RAX: ffffffffffffffda RBX: 00007f2ac7d25fa0 RCX: 00007f2ac7afe969 [ 339.202014][T15944] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000004 [ 339.202024][T15944] RBP: 00007f2ac6167090 R08: 0000000000000000 R09: 0000000000000000 [ 339.202034][T15944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 339.202067][T15944] R13: 0000000000000000 R14: 00007f2ac7d25fa0 R15: 00007ffd021645c8 [ 339.202088][T15944] [ 339.403144][T15949] loop1: detected capacity change from 0 to 512 [ 339.414996][T15951] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4080'. [ 339.482674][T15954] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4076'. [ 339.529303][T15949] EXT4-fs (loop1): 1 orphan inode deleted [ 339.540005][T15949] ext4 filesystem being mounted at /272/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 339.551049][ T51] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 1 [ 339.933251][T15972] loop4: detected capacity change from 0 to 1024 [ 339.953645][T15972] EXT4-fs: Ignoring removed orlov option [ 339.968638][T15972] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 339.979467][T15972] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 340.008485][T15972] EXT4-fs (loop4): invalid journal inode [ 340.014527][T15972] EXT4-fs (loop4): can't get journal size [ 340.076641][T15983] loop1: detected capacity change from 0 to 512 [ 340.122197][T15983] EXT4-fs (loop1): 1 orphan inode deleted [ 340.128716][T15983] ext4 filesystem being mounted at /275/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 340.141332][ T51] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:3: Failed to release dquot type 1 [ 340.178846][T15990] loop3: detected capacity change from 0 to 1024 [ 340.207615][T15990] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 340.218570][T15990] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 340.237880][T15990] JBD2: no valid journal superblock found [ 340.243665][T15990] EXT4-fs (loop3): Could not load journal inode [ 341.834822][T16042] dummy0: left allmulticast mode [ 341.839972][T16042] bridge0: port 3(dummy0) entered disabled state [ 341.848548][T16042] bridge_slave_1: left allmulticast mode [ 341.854353][T16042] bridge_slave_1: left promiscuous mode [ 341.860096][T16042] bridge0: port 2(bridge_slave_1) entered disabled state [ 341.914588][T16042] bridge_slave_0: left allmulticast mode [ 341.920399][T16042] bridge_slave_0: left promiscuous mode [ 341.926083][T16042] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.130667][T16063] FAULT_INJECTION: forcing a failure. [ 342.130667][T16063] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 342.143816][T16063] CPU: 1 UID: 0 PID: 16063 Comm: syz.3.4124 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 342.143904][T16063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 342.143919][T16063] Call Trace: [ 342.143925][T16063] [ 342.143933][T16063] __dump_stack+0x1d/0x30 [ 342.143958][T16063] dump_stack_lvl+0xe8/0x140 [ 342.143993][T16063] dump_stack+0x15/0x1b [ 342.144014][T16063] should_fail_ex+0x265/0x280 [ 342.144054][T16063] should_fail+0xb/0x20 [ 342.144102][T16063] should_fail_usercopy+0x1a/0x20 [ 342.144131][T16063] _copy_from_user+0x1c/0xb0 [ 342.144227][T16063] ___sys_sendmsg+0xc1/0x1d0 [ 342.144262][T16063] __x64_sys_sendmsg+0xd4/0x160 [ 342.144363][T16063] x64_sys_call+0x2999/0x2fb0 [ 342.144389][T16063] do_syscall_64+0xd0/0x1a0 [ 342.144435][T16063] ? clear_bhb_loop+0x25/0x80 [ 342.144460][T16063] ? clear_bhb_loop+0x25/0x80 [ 342.144487][T16063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.144514][T16063] RIP: 0033:0x7fcfff5be969 [ 342.144532][T16063] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 342.144562][T16063] RSP: 002b:00007fcffdc27038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 342.144581][T16063] RAX: ffffffffffffffda RBX: 00007fcfff7e5fa0 RCX: 00007fcfff5be969 [ 342.144593][T16063] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 [ 342.144605][T16063] RBP: 00007fcffdc27090 R08: 0000000000000000 R09: 0000000000000000 [ 342.144620][T16063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.144635][T16063] R13: 0000000000000000 R14: 00007fcfff7e5fa0 R15: 00007fff1372af48 [ 342.144658][T16063] [ 342.431939][ T29] kauditd_printk_skb: 897 callbacks suppressed [ 342.431953][ T29] audit: type=1326 audit(1746645257.434:19911): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f89cbfa5927 code=0x7ffc0000 [ 342.467703][ T29] audit: type=1326 audit(1746645257.464:19912): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f89cbf4ab39 code=0x7ffc0000 [ 342.491323][ T29] audit: type=1326 audit(1746645257.464:19913): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f89cbfa5927 code=0x7ffc0000 [ 342.514856][ T29] audit: type=1326 audit(1746645257.464:19914): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f89cbf4ab39 code=0x7ffc0000 [ 342.538422][ T29] audit: type=1326 audit(1746645257.464:19915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 342.595459][ T29] audit: type=1326 audit(1746645257.574:19916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f89cbfa5927 code=0x7ffc0000 [ 342.619028][ T29] audit: type=1326 audit(1746645257.574:19917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f89cbf4ab39 code=0x7ffc0000 [ 342.642517][ T29] audit: type=1326 audit(1746645257.574:19918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f89cbfae969 code=0x7ffc0000 [ 342.666121][ T29] audit: type=1326 audit(1746645257.584:19919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f89cbfa5927 code=0x7ffc0000 [ 342.689620][ T29] audit: type=1326 audit(1746645257.584:19920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16052 comm="syz.0.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f89cbf4ab39 code=0x7ffc0000 [ 342.760334][T16069] __nla_validate_parse: 13 callbacks suppressed [ 342.760411][T16069] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4126'. [ 342.905697][T16079] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4131'. [ 342.963355][T16085] loop1: detected capacity change from 0 to 512 [ 342.978634][T16090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4137'. [ 342.987716][T16090] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4137'. [ 343.018153][T16086] netlink: 'syz.4.4136': attribute type 3 has an invalid length. [ 343.134820][T16085] EXT4-fs (loop1): 1 orphan inode deleted [ 343.141313][T16085] EXT4-fs mount: 20 callbacks suppressed [ 343.141346][T16085] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 343.159828][ T267] EXT4-fs error (device loop1): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 343.173103][T16085] ext4 filesystem being mounted at /284/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 343.194125][T16086] loop4: detected capacity change from 0 to 1024 [ 343.223991][T16086] EXT4-fs: Ignoring removed orlov option [ 343.247384][T16103] netlink: 'syz.0.4138': attribute type 10 has an invalid length. [ 343.255292][T16103] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4138'. [ 343.273268][T16104] loop2: detected capacity change from 0 to 512 [ 343.281208][T16086] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 343.294756][T16104] EXT4-fs: Ignoring removed nobh option [ 343.308935][T16086] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 343.322191][T16104] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 343.334143][T16103] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 343.350983][T16086] EXT4-fs (loop4): invalid journal inode [ 343.356771][T16086] EXT4-fs (loop4): can't get journal size [ 343.367611][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 343.373794][T16086] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 343.393254][T16104] EXT4-fs (loop2): 1 truncate cleaned up [ 343.400669][T16086] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.406045][T16109] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4140'. [ 343.421165][T16104] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 343.441635][T16104] EXT4-fs error (device loop2): ext4_read_inline_dir:1501: inode #12: block 7: comm syz.2.4139: path /123/file5/file0: bad entry in directory: inode out of bounds - offset=24, inode=16777215, rec_len=16, size=80 fake=0 [ 343.463126][T16104] EXT4-fs (loop2): Remounting filesystem read-only [ 343.481323][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 343.493462][T16086] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.536854][T16086] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.595047][T16086] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 343.676598][T16086] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.288998][T16086] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.313480][T16086] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.333305][T16086] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 344.333478][T16128] loop1: detected capacity change from 0 to 512 [ 344.350744][T16128] EXT4-fs: Ignoring removed nobh option [ 344.358069][T16128] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 344.381209][T16128] EXT4-fs (loop1): 1 truncate cleaned up [ 344.387364][T16128] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 344.400490][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 344.401101][T16128] FAULT_INJECTION: forcing a failure. [ 344.401101][T16128] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 344.422871][T16128] CPU: 1 UID: 0 PID: 16128 Comm: syz.1.4148 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 344.422899][T16128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 344.422914][T16128] Call Trace: [ 344.422922][T16128] [ 344.423002][T16128] __dump_stack+0x1d/0x30 [ 344.423092][T16128] dump_stack_lvl+0xe8/0x140 [ 344.423117][T16128] dump_stack+0x15/0x1b [ 344.423138][T16128] should_fail_ex+0x265/0x280 [ 344.423250][T16128] should_fail+0xb/0x20 [ 344.423284][T16128] should_fail_usercopy+0x1a/0x20 [ 344.423306][T16128] copy_to_user_nofault+0x7f/0x120 [ 344.423409][T16128] bpf_probe_write_user+0x83/0xc0 [ 344.423448][T16128] bpf_prog_19072b5a3fcf5d64+0x41/0x45 [ 344.423470][T16128] bpf_trace_run2+0x104/0x1c0 [ 344.423500][T16128] __bpf_trace_sys_enter+0x10/0x30 [ 344.423527][T16128] trace_sys_enter+0x86/0x110 [ 344.423585][T16128] syscall_trace_enter+0x13e/0x1e0 [ 344.423613][T16128] do_syscall_64+0xaa/0x1a0 [ 344.423640][T16128] ? clear_bhb_loop+0x25/0x80 [ 344.423667][T16128] ? clear_bhb_loop+0x25/0x80 [ 344.423770][T16128] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 344.423796][T16128] RIP: 0033:0x7f2ac7afe969 [ 344.423889][T16128] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 344.423912][T16128] RSP: 002b:00007f2ac6167038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9 [ 344.423935][T16128] RAX: ffffffffffffffda RBX: 00007f2ac7d25fa0 RCX: 00007f2ac7afe969 [ 344.423951][T16128] RDX: 0000000000001000 RSI: 0000200000000f80 RDI: 000000000000000c [ 344.423966][T16128] RBP: 00007f2ac6167090 R08: 0000000000000000 R09: 0000000000000000 [ 344.423981][T16128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 344.424069][T16128] R13: 0000000000000000 R14: 00007f2ac7d25fa0 R15: 00007ffd021645c8 [ 344.424092][T16128] [ 344.424262][T16128] EXT4-fs error (device loop1): ext4_read_inline_dir:1501: inode #12: block 7: comm syz.1.4148: path /288/file5/file0: bad entry in directory: inode out of bounds - offset=24, inode=16777215, rec_len=16, size=80 fake=0 [ 344.471078][T16131] loop2: detected capacity change from 0 to 1024 [ 344.478596][T16133] netlink: 'syz.0.4151': attribute type 3 has an invalid length. [ 344.547161][T16131] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 344.559972][T16128] EXT4-fs (loop1): Remounting filesystem read-only [ 344.573062][T16135] loop4: detected capacity change from 0 to 1024 [ 344.674013][T16133] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.688077][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 344.688214][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 344.718383][T16140] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4153'. [ 344.741208][T16135] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 344.757517][T16133] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.793133][T16144] loop2: detected capacity change from 0 to 512 [ 344.794377][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 344.823223][T16144] EXT4-fs (loop2): 1 orphan inode deleted [ 344.832437][T16150] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4155'. [ 344.836163][ T267] EXT4-fs error (device loop2): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 344.842433][T16144] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 344.867996][T16133] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.868616][T16144] ext4 filesystem being mounted at /127/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 344.919070][T16133] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.977576][T16160] netlink: 'syz.1.4160': attribute type 3 has an invalid length. [ 344.990500][T16160] loop1: detected capacity change from 0 to 1024 [ 344.997470][T16160] EXT4-fs: Ignoring removed orlov option [ 345.003819][T16160] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 345.013652][T16160] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 345.023873][T16160] EXT4-fs (loop1): invalid journal inode [ 345.030615][T16160] EXT4-fs (loop1): can't get journal size [ 345.041346][T16160] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 345.044091][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 345.060459][T16133] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.067781][T16165] netlink: 'syz.4.4159': attribute type 10 has an invalid length. [ 345.078909][T16165] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4159'. [ 345.080990][T16166] netlink: 'syz.3.4157': attribute type 10 has an invalid length. [ 345.095794][T16166] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4157'. [ 345.107624][T16160] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.126693][T16133] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.137108][T16165] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 345.153510][T16166] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 345.170709][T16160] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.183921][T16133] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.195234][T16133] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.217291][T16160] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.327181][T16160] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.423289][T16175] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 345.431865][T16175] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 345.465202][T16160] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.483273][T16160] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.499506][T16160] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.515404][T16160] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.565601][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 345.779787][T16177] netlink: 'syz.1.4163': attribute type 3 has an invalid length. [ 345.859498][T16187] loop3: detected capacity change from 0 to 1024 [ 345.866793][T16187] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 345.877706][T16187] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 345.887847][T16187] JBD2: no valid journal superblock found [ 345.893620][T16187] EXT4-fs (loop3): Could not load journal inode [ 345.924824][T16189] sch_tbf: burst 3092 is lower than device lo mtu (65550) ! [ 346.024825][T16195] loop2: detected capacity change from 0 to 1024 [ 346.035744][T16195] EXT4-fs: Ignoring removed orlov option [ 346.042718][T16195] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 346.058163][T16195] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 346.069374][T16195] EXT4-fs (loop2): invalid journal inode [ 346.075356][T16195] EXT4-fs (loop2): can't get journal size [ 346.092264][T16195] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 346.172742][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 346.208422][T16201] loop4: detected capacity change from 0 to 512 [ 346.230855][T16205] netlink: 'syz.2.4175': attribute type 3 has an invalid length. [ 346.246471][T16201] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 346.259172][T16201] ext4 filesystem being mounted at /232/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 346.278181][T16201] EXT4-fs error (device loop4): ext4_acquire_dquot:6935: comm syz.4.4174: Failed to acquire dquot type 0 [ 346.351063][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 346.505744][T16220] FAULT_INJECTION: forcing a failure. [ 346.505744][T16220] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 346.518976][T16220] CPU: 0 UID: 0 PID: 16220 Comm: syz.2.4180 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 346.519010][T16220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 346.519032][T16220] Call Trace: [ 346.519048][T16220] [ 346.519057][T16220] __dump_stack+0x1d/0x30 [ 346.519083][T16220] dump_stack_lvl+0xe8/0x140 [ 346.519103][T16220] dump_stack+0x15/0x1b [ 346.519119][T16220] should_fail_ex+0x265/0x280 [ 346.519163][T16220] should_fail+0xb/0x20 [ 346.519251][T16220] should_fail_usercopy+0x1a/0x20 [ 346.519274][T16220] _copy_from_user+0x1c/0xb0 [ 346.519297][T16220] ___sys_sendmsg+0xc1/0x1d0 [ 346.519329][T16220] __x64_sys_sendmsg+0xd4/0x160 [ 346.519408][T16220] x64_sys_call+0x2999/0x2fb0 [ 346.519434][T16220] do_syscall_64+0xd0/0x1a0 [ 346.519507][T16220] ? clear_bhb_loop+0x25/0x80 [ 346.519527][T16220] ? clear_bhb_loop+0x25/0x80 [ 346.519546][T16220] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 346.519566][T16220] RIP: 0033:0x7fe7081ee969 [ 346.519580][T16220] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 346.519627][T16220] RSP: 002b:00007fe706857038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 346.519644][T16220] RAX: ffffffffffffffda RBX: 00007fe708415fa0 RCX: 00007fe7081ee969 [ 346.519655][T16220] RDX: 0000000000000000 RSI: 00002000000012c0 RDI: 0000000000000006 [ 346.519671][T16220] RBP: 00007fe706857090 R08: 0000000000000000 R09: 0000000000000000 [ 346.519685][T16220] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.519700][T16220] R13: 0000000000000000 R14: 00007fe708415fa0 R15: 00007ffd818e4728 [ 346.519784][T16220] [ 346.720663][T16221] netlink: 'syz.4.4176': attribute type 10 has an invalid length. [ 346.729438][T16221] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 346.852819][T16227] loop2: detected capacity change from 0 to 1024 [ 346.865829][T16227] EXT4-fs: Ignoring removed orlov option [ 346.929012][T16227] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 346.945761][T16227] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 346.969061][T16227] EXT4-fs (loop2): invalid journal inode [ 346.974888][T16227] EXT4-fs (loop2): can't get journal size [ 346.982513][T16227] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 347.007908][T13913] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 347.309507][T16257] loop4: detected capacity change from 0 to 1024 [ 347.318902][T16257] EXT4-fs (loop4): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 347.329956][T16257] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 347.345817][T16257] JBD2: no valid journal superblock found [ 347.351604][T16257] EXT4-fs (loop4): Could not load journal inode [ 347.438864][ T29] kauditd_printk_skb: 1206 callbacks suppressed [ 347.438883][ T29] audit: type=1326 audit(1746645262.444:21123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.3.4194" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fcfff5b5927 code=0x7ffc0000 [ 347.469913][ T29] audit: type=1326 audit(1746645262.444:21124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.3.4194" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fcfff55ab39 code=0x7ffc0000 [ 347.493470][ T29] audit: type=1326 audit(1746645262.444:21125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.3.4194" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7fcfff5be969 code=0x7ffc0000 [ 347.517225][ T29] audit: type=1326 audit(1746645262.454:21126): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16260 comm="syz.4.4195" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5a2afc5927 code=0x7ffc0000 [ 347.540776][ T29] audit: type=1326 audit(1746645262.454:21127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16260 comm="syz.4.4195" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f5a2af6ab39 code=0x7ffc0000 [ 347.564358][ T29] audit: type=1326 audit(1746645262.454:21128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16260 comm="syz.4.4195" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7f5a2afce969 code=0x7ffc0000 [ 347.587955][ T29] audit: type=1326 audit(1746645262.454:21129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.3.4194" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7fcfff5b5927 code=0x7ffc0000 [ 347.611479][ T29] audit: type=1326 audit(1746645262.454:21130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.3.4194" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fcfff55ab39 code=0x7ffc0000 [ 347.635131][ T29] audit: type=1326 audit(1746645262.454:21131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16258 comm="syz.3.4194" exe="/root/syz-executor" sig=0 arch=c000003e syscall=278 compat=0 ip=0x7fcfff5be969 code=0x7ffc0000 [ 347.658774][ T29] audit: type=1326 audit(1746645262.454:21132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16260 comm="syz.4.4195" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f5a2afc5927 code=0x7ffc0000 [ 348.235368][T16265] __nla_validate_parse: 4 callbacks suppressed [ 348.241652][T16265] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4197'. [ 348.450219][T16273] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4210'. [ 348.542952][T16275] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4199'. [ 348.957443][T16274] loop4: detected capacity change from 0 to 512 [ 349.032017][T16274] EXT4-fs (loop4): 1 orphan inode deleted [ 349.046017][T16274] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 349.059112][ T1385] EXT4-fs error (device loop4): ext4_release_dquot:6971: comm kworker/u8:5: Failed to release dquot type 1 [ 349.072457][T16274] ext4 filesystem being mounted at /237/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 349.129437][T16293] netlink: 'syz.1.4205': attribute type 10 has an invalid length. [ 349.137410][T16293] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4205'. [ 349.226769][T16293] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 349.269780][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.311947][T16303] loop4: detected capacity change from 0 to 1024 [ 349.319011][T16305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4207'. [ 349.337059][T16303] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 349.375695][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 349.503529][T16315] loop4: detected capacity change from 0 to 1024 [ 349.513622][T16315] EXT4-fs: Ignoring removed orlov option [ 349.608222][T16315] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 349.629811][T16315] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 349.642775][T16315] EXT4-fs (loop4): invalid journal inode [ 349.656783][T16315] EXT4-fs (loop4): can't get journal size [ 349.664136][T16315] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 349.865904][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 350.436800][T16338] loop3: detected capacity change from 0 to 512 [ 350.500527][T16338] EXT4-fs (loop3): 1 orphan inode deleted [ 350.506962][T16338] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 350.519677][ T267] EXT4-fs error (device loop3): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 350.520036][T16338] ext4 filesystem being mounted at /245/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 350.642695][T16348] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4222'. [ 350.997396][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 351.137760][T16360] netlink: 'syz.4.4226': attribute type 10 has an invalid length. [ 351.145832][T16360] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4226'. [ 351.164294][T16360] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 351.222287][T16358] loop3: detected capacity change from 0 to 512 [ 351.273562][T16358] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback. [ 351.286359][T16358] ext4 filesystem being mounted at /246/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 351.304171][T16358] EXT4-fs error (device loop3): ext4_acquire_dquot:6935: comm syz.3.4224: Failed to acquire dquot type 0 [ 351.424481][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000d40000. [ 351.483328][T16373] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4230'. [ 352.059587][T16381] loop4: detected capacity change from 0 to 1024 [ 352.091181][T16381] EXT4-fs (loop4): ext4_check_descriptors: Inode bitmap for group 0 overlaps block group descriptors [ 352.102276][T16381] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (51554!=20869) [ 352.285872][T16389] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4234'. [ 352.458083][T16381] JBD2: no valid journal superblock found [ 352.463843][T16381] EXT4-fs (loop4): Could not load journal inode [ 352.562010][T16393] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4235'. [ 353.047824][ T29] kauditd_printk_skb: 1120 callbacks suppressed [ 353.047841][ T29] audit: type=1400 audit(1746645268.054:22249): avc: denied { create } for pid=16395 comm="syz.4.4236" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 353.144968][ T29] audit: type=1400 audit(1746645268.084:22250): avc: denied { sys_admin } for pid=16395 comm="syz.4.4236" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 353.310549][ T29] audit: type=1400 audit(1746645268.314:22251): avc: denied { open } for pid=16399 comm="syz.1.4238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 353.330221][ T29] audit: type=1400 audit(1746645268.314:22252): avc: denied { kernel } for pid=16399 comm="syz.1.4238" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 353.525896][T16405] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4240'. [ 353.534920][ T29] audit: type=1400 audit(1746645268.514:22253): avc: denied { read write } for pid=11190 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 353.559415][ T29] audit: type=1400 audit(1746645268.514:22254): avc: denied { open } for pid=11190 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 353.583770][ T29] audit: type=1400 audit(1746645268.514:22255): avc: denied { ioctl } for pid=11190 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=101 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 353.609562][ T29] audit: type=1400 audit(1746645268.524:22256): avc: denied { prog_load } for pid=16404 comm="syz.1.4240" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 353.628827][ T29] audit: type=1400 audit(1746645268.524:22257): avc: denied { bpf } for pid=16404 comm="syz.1.4240" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 353.649675][ T29] audit: type=1400 audit(1746645268.524:22258): avc: denied { perfmon } for pid=16404 comm="syz.1.4240" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 354.766363][T16425] loop1: detected capacity change from 0 to 1024 [ 354.776965][T16425] EXT4-fs: Ignoring removed orlov option [ 354.784323][T16425] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 354.805486][T16425] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 354.816907][T16425] EXT4-fs (loop1): invalid journal inode [ 354.822592][T16425] EXT4-fs (loop1): can't get journal size [ 354.833177][T16425] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 354.866637][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 355.009749][T16434] netlink: 'syz.1.4249': attribute type 3 has an invalid length. [ 355.042649][T16434] loop1: detected capacity change from 0 to 1024 [ 355.049563][T16434] EXT4-fs: Ignoring removed orlov option [ 355.065484][T16434] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 355.075214][T16434] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 355.085729][T16434] EXT4-fs (loop1): invalid journal inode [ 355.091404][T16434] EXT4-fs (loop1): can't get journal size [ 355.099115][T16434] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 355.121221][T16434] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.207765][T16434] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.257555][T16434] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.306942][T16434] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 355.355282][T16434] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.367223][T16434] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.379118][T16434] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.390946][T16434] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.431617][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 355.454517][T16448] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4252'. [ 355.574562][T16446] loop4: detected capacity change from 0 to 512 [ 355.600935][T16456] netlink: 'syz.1.4253': attribute type 10 has an invalid length. [ 355.608881][T16456] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4253'. [ 355.618683][T16456] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 355.683738][T16446] EXT4-fs (loop4): 1 orphan inode deleted [ 355.696916][ T267] EXT4-fs error (device loop4): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 355.731429][T16446] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 355.767242][T16446] ext4 filesystem being mounted at /247/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 356.048375][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 356.216872][T16470] netlink: 'syz.2.4260': attribute type 3 has an invalid length. [ 356.678906][T16486] loop4: detected capacity change from 0 to 1024 [ 356.699366][T16486] EXT4-fs: Ignoring removed orlov option [ 356.724505][T16486] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 356.742918][T16486] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 356.753423][T16486] EXT4-fs (loop4): invalid journal inode [ 356.759528][T16486] EXT4-fs (loop4): can't get journal size [ 356.768574][T16486] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 356.793533][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 356.907744][T16499] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 356.967508][T16502] FAULT_INJECTION: forcing a failure. [ 356.967508][T16502] name failslab, interval 1, probability 0, space 0, times 0 [ 356.980373][T16502] CPU: 0 UID: 0 PID: 16502 Comm: syz.4.4272 Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 356.980399][T16502] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 356.980412][T16502] Call Trace: [ 356.980470][T16502] [ 356.980557][T16502] __dump_stack+0x1d/0x30 [ 356.980623][T16502] dump_stack_lvl+0xe8/0x140 [ 356.980646][T16502] dump_stack+0x15/0x1b [ 356.980666][T16502] should_fail_ex+0x265/0x280 [ 356.980714][T16502] should_failslab+0x8c/0xb0 [ 356.980828][T16502] kmem_cache_alloc_node_noprof+0x57/0x320 [ 356.980872][T16502] ? __alloc_skb+0x101/0x320 [ 356.980912][T16502] __alloc_skb+0x101/0x320 [ 356.981002][T16502] __ip6_append_data+0x192b/0x23b0 [ 356.981039][T16502] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 356.981094][T16502] ? try_charge_memcg+0x174/0x870 [ 356.981126][T16502] ip6_append_data+0x13b/0x250 [ 356.981230][T16502] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 356.981297][T16502] udpv6_sendmsg+0x874/0x1570 [ 356.981419][T16502] ? avc_has_perm_noaudit+0x1b1/0x200 [ 356.981495][T16502] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 356.981520][T16502] ? __rcu_read_unlock+0x4f/0x70 [ 356.981560][T16502] ? __pfx_udpv6_sendmsg+0x10/0x10 [ 356.981596][T16502] inet6_sendmsg+0xac/0xd0 [ 356.981784][T16502] __sock_sendmsg+0x8b/0x180 [ 356.981815][T16502] sock_write_iter+0x165/0x1b0 [ 356.981867][T16502] do_iter_readv_writev+0x41e/0x4c0 [ 356.981984][T16502] vfs_writev+0x2c9/0x870 [ 356.982037][T16502] do_writev+0xe7/0x210 [ 356.982158][T16502] __x64_sys_writev+0x45/0x50 [ 356.982228][T16502] x64_sys_call+0x2006/0x2fb0 [ 356.982254][T16502] do_syscall_64+0xd0/0x1a0 [ 356.982280][T16502] ? clear_bhb_loop+0x25/0x80 [ 356.982307][T16502] ? clear_bhb_loop+0x25/0x80 [ 356.982334][T16502] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 356.982381][T16502] RIP: 0033:0x7f5a2afce969 [ 356.982395][T16502] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 356.982411][T16502] RSP: 002b:00007f5a29637038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 356.982434][T16502] RAX: ffffffffffffffda RBX: 00007f5a2b1f5fa0 RCX: 00007f5a2afce969 [ 356.982450][T16502] RDX: 0000000000000001 RSI: 0000200000000d00 RDI: 0000000000000003 [ 356.982465][T16502] RBP: 00007f5a29637090 R08: 0000000000000000 R09: 0000000000000000 [ 356.982480][T16502] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 356.982496][T16502] R13: 0000000000000000 R14: 00007f5a2b1f5fa0 R15: 00007ffd73b930e8 [ 356.982521][T16502] [ 356.984848][T16503] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4273'. [ 357.268528][T16511] netlink: 'syz.4.4274': attribute type 3 has an invalid length. [ 357.417319][T16516] netlink: 'syz.2.4275': attribute type 10 has an invalid length. [ 357.425194][T16516] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4275'. [ 357.460333][T16516] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 357.476146][T16518] loop1: detected capacity change from 0 to 2048 [ 357.521336][T16523] loop4: detected capacity change from 0 to 1024 [ 357.528562][T16523] EXT4-fs: Ignoring removed orlov option [ 357.537848][T16523] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 357.548029][T16523] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 357.559644][T16523] EXT4-fs (loop4): invalid journal inode [ 357.573173][T16526] loop1: detected capacity change from 0 to 1024 [ 357.579867][T16526] EXT4-fs: Ignoring removed orlov option [ 357.587078][T16526] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 357.596642][T16526] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 357.597334][T16523] EXT4-fs (loop4): can't get journal size [ 357.606905][T16526] EXT4-fs (loop1): invalid journal inode [ 357.618364][T16526] EXT4-fs (loop1): can't get journal size [ 357.635703][T16526] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 357.655571][T16523] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 357.679080][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 357.707205][T11877] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 357.736742][T16536] loop3: detected capacity change from 0 to 512 [ 357.773572][T16536] EXT4-fs (loop3): 1 orphan inode deleted [ 357.780051][T16536] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 357.792694][ T267] EXT4-fs error (device loop3): ext4_release_dquot:6971: comm kworker/u8:4: Failed to release dquot type 1 [ 357.797484][T16536] ext4 filesystem being mounted at /254/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 357.849503][T16547] netlink: 'syz.1.4288': attribute type 3 has an invalid length. [ 357.911441][T12398] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 358.036922][T16568] netlink: 'syz.1.4297': attribute type 3 has an invalid length. [ 358.052742][T16568] loop1: detected capacity change from 0 to 1024 [ 358.060224][ T29] kauditd_printk_skb: 712 callbacks suppressed [ 358.060256][ T29] audit: type=1400 audit(1746645273.064:22969): avc: denied { create } for pid=16570 comm="+}[@" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 358.060875][T16568] EXT4-fs: Ignoring removed orlov option [ 358.095657][T16568] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (1764!=20869) [ 358.105296][T16568] EXT4-fs (loop1): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 358.117294][T16568] EXT4-fs (loop1): invalid journal inode [ 358.123045][T16568] EXT4-fs (loop1): can't get journal size [ 358.140328][T16568] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 358.160787][T16573] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4299'. [ 358.180035][ T29] audit: type=1400 audit(1746645273.154:22970): avc: denied { mount } for pid=16566 comm="syz.1.4297" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 358.201904][ T29] audit: type=1400 audit(1746645273.164:22971): avc: denied { create } for pid=16570 comm="+}[@" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 358.229284][T16568] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.259323][ T29] audit: type=1400 audit(1746645273.254:22972): avc: denied { read write } for pid=12398 comm="syz-executor" name="loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 358.280704][T16578] netlink: 'syz.2.4300': attribute type 3 has an invalid length. [ 358.283835][ T29] audit: type=1400 audit(1746645273.254:22973): avc: denied { open } for pid=12398 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=103 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 358.315852][ T29] audit: type=1400 audit(1746645273.264:22974): avc: denied { ioctl } for pid=12398 comm="syz-executor" path="/dev/loop3" dev="devtmpfs" ino=103 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 358.344928][ T29] audit: type=1400 audit(1746645273.264:22975): avc: denied { prog_load } for pid=16577 comm="syz.2.4300" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 358.364234][ T29] audit: type=1400 audit(1746645273.264:22976): avc: denied { bpf } for pid=16577 comm="syz.2.4300" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 358.384979][ T29] audit: type=1400 audit(1746645273.264:22977): avc: denied { perfmon } for pid=16577 comm="syz.2.4300" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 358.385094][ T2993] ================================================================== [ 358.406009][ T29] audit: type=1400 audit(1746645273.274:22978): avc: denied { prog_run } for pid=16577 comm="syz.2.4300" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 358.414062][ T2993] BUG: KCSAN: data-race in _prb_read_valid / data_alloc [ 358.440052][ T2993] [ 358.442375][ T2993] write to 0xffffffff8686fa98 of 8 bytes by task 29 on cpu 1: [ 358.449860][ T2993] data_alloc+0x271/0x2b0 [ 358.454215][ T2993] prb_reserve+0x808/0xaf0 [ 358.458645][ T2993] vprintk_store+0x56d/0x860 [ 358.463252][ T2993] vprintk_emit+0x178/0x650 [ 358.467755][ T2993] vprintk_default+0x26/0x30 [ 358.472341][ T2993] vprintk+0x1d/0x30 [ 358.476238][ T2993] _printk+0x79/0xa0 [ 358.480144][ T2993] kauditd_hold_skb+0x1b1/0x1c0 [ 358.485012][ T2993] kauditd_send_queue+0x270/0x2c0 [ 358.490051][ T2993] kauditd_thread+0x421/0x630 [ 358.494740][ T2993] kthread+0x486/0x510 [ 358.498811][ T2993] ret_from_fork+0x4b/0x60 [ 358.503226][ T2993] ret_from_fork_asm+0x1a/0x30 [ 358.507992][ T2993] [ 358.510321][ T2993] read to 0xffffffff8686fa98 of 16 bytes by task 2993 on cpu 0: [ 358.517946][ T2993] _prb_read_valid+0x1bc/0x920 [ 358.522731][ T2993] prb_read_valid+0x3c/0x60 [ 358.527247][ T2993] syslog_print+0x23a/0x540 [ 358.531778][ T2993] do_syslog+0x52b/0x7e0 [ 358.536029][ T2993] __x64_sys_syslog+0x41/0x50 [ 358.540731][ T2993] x64_sys_call+0x2ea0/0x2fb0 [ 358.545407][ T2993] do_syscall_64+0xd0/0x1a0 [ 358.549913][ T2993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 358.555820][ T2993] [ 358.558153][ T2993] Reported by Kernel Concurrency Sanitizer on: [ 358.564311][ T2993] CPU: 0 UID: 0 PID: 2993 Comm: klogd Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 358.576302][ T2993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 358.586361][ T2993] ================================================================== [ 358.596665][T16568] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.647706][T16568] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 358.707501][T16568] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 360.221128][T16568] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.232142][T16568] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.243528][T16568] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.254187][T16568] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 360.271720][T11190] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000.