last executing test programs: 3m50.704787549s ago: executing program 2 (id=234): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, 0x0, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r1, &(0x7f00000005c0), 0x10) 3m50.685320839s ago: executing program 2 (id=235): preadv(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x33, 0x1) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x22840, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) signalfd4(0xffffffffffffffff, &(0x7f0000000040)={[0x9]}, 0x8, 0x80800) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000004000000b7030000f8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='mm_page_alloc\x00', r0}, 0x10) r1 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x26, 0x1, 0x0, 0x0, 0x0, 0x5, 0xb1130, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x101280, 0x26f, 0xc, 0x3, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$perf(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xa, 0x4000011, r1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x5487, &(0x7f0000000040)={0x0, 0xc89d, 0xc000, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21}, &(0x7f0000bbdffc)=0x0) timer_settime(r4, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000ff0f000007"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000004080)={{r5}, &(0x7f0000004000), &(0x7f0000004040)}, 0x20) getpid() r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x12, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={&(0x7f0000000200), 0xe}, 0x0, 0x20032, 0x43a1bd76, 0x5, 0x9, 0x6, 0x6, 0x0, 0x0, 0x0, 0x2000000000002009}, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00') renameat2(0xffffffffffffff9c, &(0x7f0000002480)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffffff, 0x0, 0x4) 3m50.559407165s ago: executing program 2 (id=238): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0xfffffffffffffffd}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@deltfilter={0x24, 0x2d, 0x200, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x10}, {0x4, 0xe}, {0x4, 0xf}}}, 0x24}}, 0x14000000) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x4, 0x2}, 0x4) r3 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r3, &(0x7f00000002c0), 0x40000000000009f, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x33}, 0xfffffffd, 0x33}, 0x0, @in6=@dev={0xfe, 0x80, '\x00', 0x2}, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x21, 0x0) 3m50.44489648s ago: executing program 2 (id=242): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f000000850000002300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000d00)='kfree\x00', r0}, 0x18) (async) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x2000002, &(0x7f0000000080), 0x1, 0x53a, &(0x7f0000000a80)="$eJzs3c9vHFcdAPDvjH82desEeoAKSIFCQFF2400bVb00uYBQVQlRcUAcUmNvLJPdrPGuS20s4f4NIIHECf4EDkgckHriwI0jEgeEVA5IBixQjATSopkdu1t7XW/j9S71fj7SaObN23nf9+LMvJm39rwAxtZzEbETEdMR8UZEzBf7k2KJO50l+9yjve2l/b3tpSTa7df/nuT52b7oOibzZFHmbER846sR30mOx21ubj1YrNWq60W63KqvlZubWzdW64sr1ZXqw0rl9sLtmy/derEysLZerf9y9yurr37zN7/+9Lu/3/nyD7JqzRV53e0YpE7Tpw7jZCYj4tXzCDYCE8V6esT14PGkEfGxiPhcfv7Px0T+vxMAuMja7floz3enAYCLLs3HwJK0VIwFzEWalkqdMbxn4lJaazRb1+83Nh4ud8bKLsdUen+1Vr15ZeaP38vvGKaSLL2Q5+X5ebpyJH0rIq5ExI9nnsjTpaVGbXl0tz0AMNaePNL//2um0//3oce3egDAR8bsqCsAAAyd/h8Axo/+HwDGTx/9f/Fl/8651wUAGA7P/wAwfvT/ADB+9P8AMFa+/tpr2dLeL95/vfzm5saDxps3lqvNB6X6xlJpqbG+VlppNFbyd/bUTyuv1misLbwQG2+VW9Vmq9zc3LpXb2w8bN3L3+t9rzo1lFYBAB/kytV3/pBExM7LT+RLdM3loK+Giy0ddQWAkZkYdQWAkTHbF4yv/p/xf3eu9QBGp+fLvGd7br7fTz9EEL9nBP9Xrn2y//F/czzDxWL8H8bX443/vzLwegDDZ/wfxle7nRyd83/6MAsAuJDO8Dv+7R8O6iYEGKnTJvMeyPf/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcMHMRcR3I0lLxVzgc5GmpVLEUxFxOaaS+6u16s2IeDquRsTUTJZeGHWlAYAzSv+aFPN/XZt/fu5o7nTy75l8HRHf/9nrP3lrsdVaX8j2/+Nw/8zB9GGV9447w7yCAECfnuvzc3n/XSnWXQ/yj/a2lw6W7s+nA67nUbt347/FVMRL+3vb+dLJmYzJfD2b30tc+mdSpDtzkT4bERMDiL/zdkR8olf7k3xs5HIx82l3/ChiPzXU+On74qd5Xmed3Xx9fAB1gXHzzt2IuNPr/EuLa2rv8382v0Kd3e7dTmEH1779rvgH17+JHvGTD3HN333ht187trM938l7O+LZyV7xk8P4yQnxn+8z/p8+9ZkfvXJCXvvnEdeid/zuWOVWfa3c3Ny6sVpfXKmuVB9WKrcXbt986daLlXI+Rl0+GKk+7m8vX3/6pLpl7b90QvzZnu2fPjz2C322/xf/eePbn/2A+F/6fO+f/zM943dkfeIX+4y/eOlXJ07fncVfPqH9p/38r/cZ/92/bC33+VEAYAiam1sPFmu16vqZNrKn0EGUc2wjq+JACzxl488xyALvnO3wqfP6Vz33jcnDe8XBlvytrMQhNycdeCvOtPGosxHnHmu01yXg/L130o+6JgAAAAAAAAAAAAAAwEmG8adLo24jAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAF9f/AgAA//91qMwl") chdir(0x0) syz_emit_ethernet(0x2a, &(0x7f0000000540)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000919c4c0040000008060001080006040002ffffffffffffac1414bbaaaaaaaaaaaaac1414bb"], 0x0) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000280)='kfree\x00', r2}, 0x18) (async) ioctl$KDFONTOP_SET(r1, 0x4b72, &(0x7f0000000080)={0x0, 0x3000000, 0x8, 0x1b, 0x100, &(0x7f00000000c0)="387ed7626d850509a2d6c1aa38f15cd00f85c263cb226db671261fff7ce9c555f189afae3530db6dd493f28fd988721b9ae21b3e3b4523ae2594f47d8f62b480c4160b1f90ac9c41fae6ab12ac4c113fef588684ef495689092883b902a41cd75387ef6f7bc7d460d5e665f398ff95596dc94ec97003a3db08e500c2fb07e11aa4031a61c51caf7a65a2b613bda33f3eaeae635d7cd81761e74c38a7695800a15516eb337056e02335f9a7d10aa2eaf7beb7e1f7a1e850ecb3421143c5c4ded0f083a0c524dcf320827266819b6a952db5bc96141b26c54db857edbcbbc81c7af7aadf50bc549974b6401a19cdb130282b955592efa94242065a4c8d695a2cdd9ada350defd58c775b92d348305774d3a256c7520b285d8da0dbf5e20d604413ed2ddf9bcbf881caf811852806175d63892a15234fbcd7a88a2a0aea45d19148f0e7dada7d6d0d77881387fdeaa02863be90b88dfff412bff40c31c6415c54ae3335e54a49d315851feffe30d999c36def4df7df747695ef060000001bbe1b649f42f310859122c0d2c1e558dc6586958a28374f386ecf369274e43003a09b5159ea515eb44521901ef0d00baa91c10a8e44a76aac3468a15bd3d45ad389977467f306f9bcde071b30769795eed2f1580414d168f557cd90040c4bd2a3d6bc509254a12cece59181fcb5bad8c24bd9f8f78d17ab01831325501e80d899e9252f99d3a2666343392fda115048e4f4dd9f45657f8224fc78eb1168fe0527fac33466aadf48f16994d29a47778566e0f3945b2bf36b6eecc7fa18914beb66ac9e519bd3330000000000000009a3237aebbe3bed781e39d5a0fb0cdc60e196f2261305feb596b5b66ab89d2d6333f699b16db68986ab3eee7b199fefb5f79ffb2d1050e46982af1c14a88dd9b647ba812f56a8404755c73e74bb90e64bab9647c70ed5afca1c3d87907d14df8aa9df6f40a80ace2bb8a2aad3b0c66915927db4173181943d88c0c76d5969e2043db5bd77fd60ba0f012139929ccfec965c1f769785a4d23332d71f0875e3146afef5b20cc306d3ecee65944fe9829e0ad0c3f6bb2fdc1bc31152538db50f47dc38ba908a0d808687e478a609fe0daa0000000000000000e7f2e98597e27f3e1dba9c3c16e9fab3bda6ed33cb1c75513e2264b69d4794ded98eff9aa53d22eb77c9d93169c04ab2490bf28106f770e07eb7a9e8fd4e71929f918b98c4cbfcb11a90139264a9ee807c973167f493760278df0cc34be9e8f86f948d9a62e63ad6ca9d174d2465380b1a00ddc42915e4f3a5db640600000095a3d63904c9ecd1c313c08e29b814bd8fed1ab6d2846c73345962895d289ac77152cac2e04c93a5470774975b42091f218dd1e68a15f8226577bf9481ae0555db64a717eb23a811356d00000000ddffffff00"}) r3 = syz_io_uring_setup(0x4171, &(0x7f0000000180)={0x0, 0x776a, 0x40, 0x2, 0x10f}, &(0x7f0000000440), &(0x7f0000000400)) (async) capset(0x0, &(0x7f0000000080)) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0100000006000000080000000800000040000000", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) io_uring_enter(r3, 0x7b1d, 0xe93c, 0xc, 0x0, 0x0) (async) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = perf_event_open(&(0x7f00000000c0)={0x5, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={&(0x7f00000005c0), 0x2}, 0x15008, 0x100000000}, r4, 0x0, 0xffffffffffffffff, 0x0) (async) syz_clone(0x24084200, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a0000000407a060c24a0400", @ANYBLOB], 0x48) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x1d3301, 0x0) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="5953fdfffffffddbdf256b"], 0x2c}, 0x1, 0x0, 0x0, 0x8441}, 0x20080050) accept4(r7, &(0x7f0000000280)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @private}}, &(0x7f0000000140)=0x80, 0x80800) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) bpf$MAP_DELETE_ELEM(0x15, 0x0, 0x0) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'veth0_vlan\x00', @remote}) (async) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r5, 0x4008240b, &(0x7f0000000040)={0x5, 0x80, 0x0, 0xcb, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x1ff, 0x800}, 0x0, 0x0, 0x0, 0x8}) (async) io_uring_register$IORING_REGISTER_NAPI(r3, 0x1b, &(0x7f00000000c0)={0x5, 0x6}, 0x1) (async) socket$netlink(0x10, 0x3, 0x0) 3m50.260841268s ago: executing program 2 (id=247): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="2c0000001000010400"/20, @ANYRES32=r2, @ANYBLOB="21000200632fdb93d4a422ab0000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000001c0)=0x14) sendmsg$FOU_CMD_ADD(r0, &(0x7f0000000440)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000400)={&(0x7f0000000200)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="020028bd7000fbdb0000050004000400040000000700000000000000020002000000060001004e23000008000b0000000000", @ANYRES32=r2, @ANYBLOB="06000a004e240000050002000200000008000b00", @ANYRES32=r3, @ANYBLOB="040005000500040003000000"], 0x60}, 0x1, 0x0, 0x0, 0x10800}, 0x11) socket$nl_xfrm(0x10, 0x3, 0x6) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000c500000001f0ffff95"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x2100, 0x40) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0xfffffffe, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0xe, 0x19, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000001000000000000000500000018110000", @ANYRES32=r6, @ANYBLOB="0000db9b129e82d4b7b56409255bdbc7000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000050f000000000000080000005d910200f0ffffff184900000100000000000000000000001861000007000000000000000700000006d103000d000000180000000400000000000000ff000000bf91000010000000b7020000000000008500000000000000b700"], &(0x7f0000000040)='GPL\x00', 0xfffffff6, 0xbd, &(0x7f0000000300)=""/189, 0x40f00, 0x50, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x0, 0x5}, 0x8, 0x10, &(0x7f00000000c0)={0x1, 0x2, 0x60, 0x400}, 0x10, r7, 0xffffffffffffffff, 0x7, &(0x7f00000003c0)=[0xffffffffffffffff], &(0x7f0000000400)=[{0x3, 0x3, 0xa, 0x9}, {0x64, 0x3, 0xb, 0xb}, {0x0, 0x1, 0x3, 0xa}, {0x5, 0x4, 0x1, 0x7}, {0x2, 0x5, 0xd, 0xc}, {0x4, 0x1, 0x9, 0x2}, {0x2, 0x4, 0xf, 0x2}], 0x10, 0x7}, 0x94) ioctl$SIOCX25GFACILITIES(0xffffffffffffffff, 0x89e2, &(0x7f0000000840)) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2400000039000900f036d6760000000004000000040000000c000180060006008035"], 0x24}}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000140)='task_rename\x00'}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) dup(0xffffffffffffffff) gettid() r8 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000002c0), 0x0) read$qrtrtun(r8, 0x0, 0xeffd) 3m49.211495792s ago: executing program 2 (id=260): mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000007c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in=@multicast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0xa0b, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0xb4, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x40080) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001a0007000000060000000000fe80000000000000000000000000001be0000002000000000000000000000000ff030000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc0000000000000000000000000000005a0000000000000000b40000000000000200000000000000010000007ffffffe0000000000000000000006000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb"], 0x104}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1e, 0x4, 0x0) r4 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2, 0x4}, 0x10) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000, 0x4, &(0x7f000022a000/0x2000)=nil) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000a0000000001fc3e086580a07000000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r6}, 0x18) r7 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@secondary) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r8 = dup3(r4, r3, 0x0) recvmmsg(r8, &(0x7f0000008840), 0x0, 0x40000001, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1000}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000300)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r9}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x8}, 0x50) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000280), &(0x7f0000000740)={0x0, 0xfb, 0x2e, 0x4, 0x6, "4d27ed20a3f42f5d73dd854bb182f8c2", "46f897933bf31ebae864e3fd4d1fe9355bd881f9c6d9ea4560"}, 0x2e, 0xecedd6f595b04f43) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth1_vlan\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r11, {0x1, 0x6}, {0xd}, {0x11, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x11) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) 3m49.170352084s ago: executing program 32 (id=260): mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000080)=0x9, 0x8, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000007c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in=@multicast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0xa0b, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0xb4, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x40080) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001a0007000000060000000000fe80000000000000000000000000001be0000002000000000000000000000000ff030000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc0000000000000000000000000000005a0000000000000000b40000000000000200000000000000010000007ffffffe0000000000000000000006000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe8000000000000000000000000000bb"], 0x104}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1e, 0x4, 0x0) r4 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x0, 0x2, 0x4}, 0x10) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000, 0x4, &(0x7f000022a000/0x2000)=nil) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000a0000000001fc3e086580a07000000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x6, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r6}, 0x18) r7 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000240)='asymmetric\x00', &(0x7f0000000180)=@secondary) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f00000000c0)='asymmetric\x00', &(0x7f0000000280)=@chain) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x3514}], 0x1}}], 0x400000000000181, 0x9200000000000000) r8 = dup3(r4, r3, 0x0) recvmmsg(r8, &(0x7f0000008840), 0x0, 0x40000001, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1000}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000300)='syzkaller\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r9}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x7, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x8}, 0x50) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) fsetxattr$trusted_overlay_upper(r2, &(0x7f0000000280), &(0x7f0000000740)={0x0, 0xfb, 0x2e, 0x4, 0x6, "4d27ed20a3f42f5d73dd854bb182f8c2", "46f897933bf31ebae864e3fd4d1fe9355bd881f9c6d9ea4560"}, 0x2e, 0xecedd6f595b04f43) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000000)={'veth1_vlan\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r11, {0x1, 0x6}, {0xd}, {0x11, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x11) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) 3m11.70680266s ago: executing program 5 (id=896): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x58, 0x2, 0x6, 0x5, 0x7, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x8404) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x6a) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='cgroup.threads\x00', 0x2, 0x0) sendfile(r4, r4, 0x0, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000200)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000c40), 0x12) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f00000001c0)=0x2) sendfile(r2, r4, 0x0, 0x401) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0xfffff63d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x258}, @IFLA_BR_AGEING_TIME={0x8, 0x4, 0x3}]}}}]}, 0x44}}, 0x0) 3m11.705766511s ago: executing program 5 (id=897): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001800)={0x11, 0xc, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000fa540000850000008200000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r1, 0x0, 0x3}, 0x18) readlink(&(0x7f0000000280)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x80000000}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r4}, 0x10) pipe2(&(0x7f0000001040)={0xffffffffffffffff}, 0x0) r6 = gettid() r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r7}, 0x10) r8 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) write$selinux_attr(r8, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) pipe2(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) tee(r5, r9, 0xfffffffffffffc01, 0x0) r10 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IPT_SO_SET_REPLACE(r10, 0x0, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x8, 0x3, 0x498, 0x320, 0xa, 0x148, 0x368, 0x60, 0x400, 0x2a8, 0x2a8, 0x400, 0x2a8, 0x3, 0x0, {[{{@ip={@multicast2, @multicast2, 0x0, 0x0, 'bridge0\x00', 'rose0\x00'}, 0x0, 0x2f8, 0x368, 0x0, {0x200003ae, 0x7f00}, [@common=@inet=@hashlimit1={{0x58}, {'veth1_to_team\x00', {0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0x7}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x8601, 0x6, './file0\x00'}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x0, 0x0, 0x0, 0x1d, 0x0, "f2f7b9f28413d9d8ad470ad2b60c45cb4ea6e7bf902bdc2ff8a9304d9f655c746adc0bdc773506378bc2d27efd6abb05175089830cc46186074d7de46d5af300"}}}, {{@ip={@empty, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth0_to_team\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x4f8) sendmsg$nl_xfrm(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001540)={&(0x7f0000000240)=ANY=[@ANYBLOB="240100001600010428bd700000000800fe8000000000000000000000000000bbfc01000000000000000000000000000100040000000000000000a00000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="ff02000000000000000000000000000100000000330000000a0101010000000000000000000000000000000000004e340100000000000000000000000000000004000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000a0000002bbd70000000000000000200000000000000000008000020ffffffdf2c00"], 0x124}}, 0x0) 3m10.77832546s ago: executing program 5 (id=926): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(0x0, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffc}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000280), 0x400000000000180, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r5, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='sched_switch\x00', r6}, 0x10) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x1c, r1, 0x9c3fa077fa966179, 0x0, 0x0, {{0x7e}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4008084}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x7}, 0x0) 3m9.935818326s ago: executing program 5 (id=938): r0 = syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x2000008, &(0x7f0000000080), 0x0, 0x52e, &(0x7f0000000f00)="$eJzs3cFvI1cZAPBvnDib7GabFDhApZZCi7IVrJ00tI04lCIhOFVClPsSEieK4sRR7LSbqILsX4CEECBxggsXJP4AJLQSF44IqRKcQSoCIdiCBAfoINvjJDjjxFuceNf5/aTZeW/GM9/3vHnjmfHTOIAr69mIeC0i3k/T9IWImMmWF7IpDttT83XvPXh7pTklkaZv/DWJJFvW2VeSzW9km01GxFe/HPGN5HTc+v7B5nK1WtnN6uXG1k65vn9we2Nreb2yXtleXFx4eemVpZeW5gfSzpsR8eoX//i9b//kS6/+4jNv/eHOn299s5nWdLb+ZDse0vhZK9tNL16b7Npg9wMGexQ121PsVKb62+beBeYDAEBvzXP8D0XEJyPihZiJsbNPZwEAAIDHUPr56fh3EpHmm+ixHAAAAHiMFFpjYJNCKRsLMB2FQqnUHsP7kbheqNbqjU+v1fa2V9tjZWejWFjbqFbms7HCs1FMmvWFVvm4/mJXfTEinoyI785MteqllVp1ddg3PwAAAOCKuNF1/f+Pmfb1PwAAADBiZoedAAAAAHDhXP8DAADA6HP9DwAAACPtK6+/3pzSzu9fr765v7dZe/P2aqW+WdraWymt1HZ3Suu12nrrmX1b5+2vWqvtfDa29+6WG5V6o1zfP7izVdvbbtzZiMlLaRAAAABwypMfv/+7JCIOPzfVmpomhp0UcCnGj0pJNs/p/b9/oj1/95KSAi7FWB+vefda/nLnCfB4G+9e0KOvA6OnOOwEgKFLzlnfc/DOr7P5JwabDwAAMHhzH8v//v/87wUOC5eQHnCBdGK4uro+59OZYSUCXLrWff9+B/I4WYCRUuxrBCAwyv7v7//PlaYPlRAAADBw060pKZSy23vTUSiUShE3Wz8LUEzWNqqV+Yh4IiJ+O1O81qwvtLZMzr1mAAAAAAAAAAAAAAAAAAAAAAAAAADa0jSJFAAAABhpEYU/Jb9sP8t/bub56e77AxPJv1o/CTwREW/98I3v311uNHYXmsv/drS88YNs+YvDuIMBAAAAdOtcp7fm/xx2NgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACMmvcevL3Smfp4+dSg4v7lCxExmxd/PCZb88koRsT1vycxfmK7JCLGBhD/8F5EfDQvftJM6yhkXvxBvAnnxI/Z7F3Ii39jAPHhKrvfPP68ltf/CvFsa57f/8Yj/qf+QfU+/sXR8W+sR/+/2WeMp975Wbln/HsRT43nH3868ZMe8Z/rM/7Xv3Zw0Gtd+qOIuc7nT+uIdzLCcanc2Nop1/cPbm9sLa9X1ivbi4sLLy+9svTS0nx5baNayf7NjfGdp3/+/lntv577+Zdk2fRu//M5+8v7TPrPO3cffLhTOTwd/9ZzOfF/9ePsFafjF7I4n8rKzfVznfJhu3zSMz/9zTNntX/1uP3Fh/n/v9Vrp91OdZSn+/3TAQAuQH3/YHO5Wq3sjmyheZX+CKSh8AgWvjXQHaZpmjb7VM6q+xHRz36SGHBLC/n5HBd6HgGGfWQCAAAG7fikf9iZAAAAAAAAAAAAAAAAAAAAwNV1GU9Z6455/AjkZBCP0AYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGIj/BgAA//8RHtP4") r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_clone(0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_pidfd_open(r2, 0x0) r4 = dup(r3) fsetxattr$trusted_overlay_upper(r4, &(0x7f0000000000), 0x0, 0x0, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8924, &(0x7f0000000140)={'batadv_slave_1\x00', @remote}) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000001100)={0x40, r5, 0x1, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, @ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x80000001}]}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x818}, 0x20000004) r6 = perf_event_open(&(0x7f00000000c0)={0x5, 0x80, 0xec, 0x7, 0x40, 0x6, 0x0, 0x38159f4e, 0xd21f, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x4, 0x2, @perf_bp={0x0, 0x4}, 0x100882, 0x7ff, 0x9, 0x0, 0xb, 0x2, 0x3ff, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x100000b, 0x12011, r6, 0x0) r7 = syz_io_uring_setup(0x22f, &(0x7f0000019140)={0x0, 0x8ffd, 0x10000, 0x0, 0x100002cf}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r8, r9, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r7, 0x7a98, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0x0) utimensat(r0, &(0x7f00000000c0)='.\x00', &(0x7f0000000180)={{0x0, 0xea60}, {0x0, 0xea60}}, 0x100) 3m9.553407641s ago: executing program 5 (id=939): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000280)=[{&(0x7f0000000040)="580000001400192340834b80040d8c560a067fbc45ff81054e220000000058000b480400945f64009400050038925a01000000000000008004000000ffe809000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) 3m9.34729884s ago: executing program 5 (id=940): bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000030701"], 0x20}, 0x1, 0x0, 0x0, 0x2000804d}, 0x24048010) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000f00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="8b33000000000000000005000000080003"], 0x28}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000300)='kmem_cache_free\x00', r1}, 0x18) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="240000003f000500000000000000df25047c0000040000000c0001"], 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000540)={0x2, 0x0, @local}, &(0x7f0000000640)=0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000001c0)={0x0, @remote, @initdev}, &(0x7f0000000500)=0xb) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat(0xffffffffffffffff, &(0x7f0000000680)='./file0\x00', 0x2000, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r6, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, 0x4, 0x1, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000845}, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000003c0)='rxrpc_rx_lose\x00', r5}, 0x18) r7 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x103, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r8}, &(0x7f0000000180), &(0x7f0000000000)=r7}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) ioctl$USBDEVFS_SUBMITURB(r9, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20020006, 0x0, &(0x7f0000000240)={0x20, 0x0, 0xfffc, 0x360, 0x7}, 0x8, 0x7, 0x60000000, 0x0, 0x4, 0x101, 0x0}) 3m9.346411821s ago: executing program 33 (id=940): bpf$MAP_CREATE(0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000030701"], 0x20}, 0x1, 0x0, 0x0, 0x2000804d}, 0x24048010) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000850000000f00000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, 0x2}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="8b33000000000000000005000000080003"], 0x28}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000300)='kmem_cache_free\x00', r1}, 0x18) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000980)=ANY=[@ANYBLOB="240000003f000500000000000000df25047c0000040000000c0001"], 0x24}, 0x1, 0x0, 0x0, 0x48800}, 0x0) accept$inet(0xffffffffffffffff, &(0x7f0000000540)={0x2, 0x0, @local}, &(0x7f0000000640)=0x10) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000001c0)={0x0, @remote, @initdev}, &(0x7f0000000500)=0xb) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat(0xffffffffffffffff, &(0x7f0000000680)='./file0\x00', 0x2000, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(r6, &(0x7f0000000780)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x14, 0x4, 0x1, 0x0, 0x0, 0x0, {0x0, 0x0, 0x3}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000845}, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000003c0)='rxrpc_rx_lose\x00', r5}, 0x18) r7 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x103, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r8}, &(0x7f0000000180), &(0x7f0000000000)=r7}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) ioctl$USBDEVFS_SUBMITURB(r9, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20020006, 0x0, &(0x7f0000000240)={0x20, 0x0, 0xfffc, 0x360, 0x7}, 0x8, 0x7, 0x60000000, 0x0, 0x4, 0x101, 0x0}) 51.335834236s ago: executing program 3 (id=3256): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x16, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000006900000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_tcp(0x2, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b7030000feffffff850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r3}, 0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r4) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r6, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=r7, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYRES32=r3], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r7}, 0x94) r8 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x1000000009, 0x640b9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x8, 0x3fff8000}, 0xa00, 0x81, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0xa) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) clock_adjtime(0x6, &(0x7f00000005c0)={0xfffffffffffffffc, 0xefe8, 0x1, 0x5, 0x2, 0x2, 0x5, 0x2, 0x0, 0x9, 0xe, 0x6a2, 0x5, 0x3, 0x6, 0x3, 0x1, 0x3, 0x3, 0x2, 0x239, 0xfffffffffffffffe, 0x1, 0x40, 0x9, 0x5}) ioctl$PERF_EVENT_IOC_SET_BPF(r8, 0x40042408, r9) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) sendto$inet6(r10, &(0x7f0000000000)="aa", 0xffe0, 0x0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x6}, 0x3}, 0x1c) r11 = open(&(0x7f0000000280)='.\x00', 0x40080, 0x1d2) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r12}, 0x10) fcntl$notify(r11, 0x402, 0x5) fcntl$notify(r11, 0x402, 0x8000003d) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff7ff}, 0x50) syz_emit_ethernet(0xd86, &(0x7f0000001800)=ANY=[], 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 50.260014662s ago: executing program 3 (id=3266): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$iso9660(&(0x7f0000000540), &(0x7f00000001c0)='./file1\x00', 0x14004, &(0x7f00000005c0)=ANY=[@ANYRES32=0x0], 0x1, 0x70a, &(0x7f00000232c0)="$eJzs3V+P21gZBvDnJJkkk0JVAapWVbdzOmWlqRhSJ7NNFRUkjHOSMSRxZHtgRkJaFTqDRs0UaItEc9PODX+k5Qtwtzdc8CFW4oKr/RZwBdIKhIR2BUJGPraTTOJkJm3a2aXPb7Qb5/j18etjr896xj4GERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERERQVgNw6gItO3uzq6czWq4Tif5ksXU/Ki2FdyMJm7OW+dKuF5AhP+gWMRbUfFbXxmFXA7/tY6r0berKIYfRQwuXL5098u5TLL8nIRfBBat8PHTwYN7/f7+ozPEZrFw9ecJmTMEtVTX9hy7Y7aUtD1H1ms149Z205NNu628Pc9XHWm5KuM7rtywbspKvb4lVXnP2em2GmZbJYV3vl41jJr8TiHa0QDKnrVtt9t2t6VjwtlhzB35/g+iAGV2pDw47O9vjeXzLK2Nw6BKSvKZ8eAwqHra5laNarVSqVYrtdv123cMIzdVYISEMYSpiKUftHSeMvHxusAiyzt5E72kjNX4j/FnAbRRRBc72IVM/bHQgAsHnRnzY0n//84tNXe94/1/0suvjGZfge7/r0Xfrs3q/2fkIiH1AmlzxIzyxX5WdEYSj/EUAzzAPfTRxz4eLaFuCbn20jXkjbgll5LPzJ8WFLqw4cGBjQ5MtPBFyLhEoo4aajDwHrbRhAeJJmy0oeBhDx58qPCIyoeZKpjw4cCFxAYs3IREBXXUsQUJhTL24GAHXbTQgIlPgiA4wKFu9604n+cpW40kqDJjIwrIJcfdPqpztnZW///DZ9HScf9vsP9/U0XHQSH6+GheDNFnQBBf/y9o7dVkQ0RERERERESvgtC/fRf6r/JvAwjQtNvKOBFTOLfsiIiIiIiIiGgZBIICrkJEd+XjbYjp638iIiIiIiIi+nwT+hk7AaCkb+oXo8elzvJLgOxrSJGIiIiIiIiIXpJ+8v9aHgj0Xf5rEAtd/xMRERERERHR58Cvx8bYz2XjMXaD5M/6GQBrfymID/9egLsijnu7XxVHZjjHPIpjpu4A8JtXxMV4oF79kQegv1nqqojXJoF/Jb99CH18kD7W//MgIoRwJxLIZ8crmJGACNdcy8Xf8D6uR4tcj8eZvz/IQM+JRhQuNe22KltO+24Fpnkx46td/+cPD38BuMPtPDjs75d/9JP+fZ3LcVh0fBRW+uxEOpn0xhjl8kSPt6CfuUgb3XgVzWSVv+l2SkKv10i2PwvzKDO+onk7oLYKRFv5S6xH+2w9iGJLg+GI+wJY04M/VMp6l53YendFjLKoTG552o6YseVFncWNKObGxo3oI2mTsJ6MKH4tC1TLk/sgTHQsi+p4Fqe3hfjHRPvPzwKiGLbFVpjFH8OKJtri+x9GC2/1dpPhMc6SxdRRQER0Xg5GvZAexHxqjP2ke0hOamfvd5AD4rPcjN59tJYg7j+S3v3J74Koh8oCufhvE+lrSfoVhGf0DaHryUcDuueupJzRjfKnQRCYF4sYP6P/NwiSDTIW6N2OgyCYPKP/YfQOpDjtqSz+HQTB3YruSX470at+EC7wwcz1eu1qFkUU8OTop/gkmb3/4/2H1epWzXjXMG5XsaL/VyH+yIJ9DxERTTn9HTs6IjMnQryL61Ed1+//7Z1o6kSP96X4lgLtFtDHfWwmrxBYS6+1hAN885/RbQib0VUrsF6KPksDefnS3fCqdhh7KHL6DS+bM6/qdGcZxerbG6rD2OS9Q5NXgKPYrVe8F4iIiF6v9Rn9MHCi/8fJ/r94ov/fxEYUsXEl9bq7NHZL4WZydTy8pB9cOE6NrZye/LeW3BhERERvCOV+LEr+r4Tr2r33KvV6xfS3lXQd67vStRstJe2ur1xr2+y2lOy5ju9YTlv2XBTsVeVJb6fXc1xfNh1X9hzP3tVvfpfxq9891TG7vm15vbYyPSUtp+ubli8btmfJ3s6327a3rVy9sNdTlt20LdO3na70nB3XUmUpPaXGAu2G6vp20w4nu7Ln2h3T3ZPfc9o7HSUbyrNcu+c7UYXJuuxu03E7utoygoVfdEhERPT/6PHTwYN7/f7+o8mJ1fDSPCo5xoyY6Yl8SoUcI4iIiOgzZtRdL7BQ8RUmREREREREREREREREREREREREREREREREU05/pG/BiZW0hwWBYcnPLsYleI7RI4ZT9Qi8bD6fun/SA/u9yOKZYYkAcIalkkciBg8+mhO8OixJmn885niRDHEJeOH2+esXgAu6BFFJbokHwPTzo0s/xtImvnEQteisGD0zdVZhuC9yy//PIZx4+PvpWSJs+SAIgvmLF062Yf7sx3MOwKP8nF2wesrx87rPRET0uv0vAAD//ySOL9Y=") r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000093850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r4, 0x0, 0x1ffffffffffffffd}, 0x18) r5 = socket$igmp6(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x4e24, 0x101, @loopback, 0x1}, {0xa, 0xfffe, 0xffdffffd, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x4}, 0x1, {[0xba, 0x2, 0x1, 0x10b, 0x0, 0x40001, 0x8, 0x5]}}, 0x5c) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000440)='kfree\x00', r6}, 0x18) r7 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x120) getdents64(r7, 0x0, 0x700) r8 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x24, r8, 0x1, 0x0, 0x0, {}, [@GTPA_LINK={0x8}, @GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x24}}, 0x8000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x41000}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r9}, 0x70) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42041, 0x0) 49.839452729s ago: executing program 3 (id=3274): r0 = socket$key(0xf, 0x3, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) sendmsg$key(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000180)=ANY=[@ANYBLOB="0209000002"], 0x10}}, 0x0) 49.067977272s ago: executing program 3 (id=3276): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r0, 0x0, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000a40)={&(0x7f0000000980)='sys_enter\x00', r2}, 0x10) (async) rmdir(0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x4, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x5}, [@call={0x85, 0x0, 0x0, 0xa2}]}, &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x11}, 0x94) (async) unshare(0x20000) 49.067743932s ago: executing program 3 (id=3277): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000b80)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000140)={0x0, r0}, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xf, &(0x7f00000004c0)=ANY=[@ANYRES8=r0, @ANYRESHEX=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000800008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b70000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001580)={&(0x7f0000000180)='kmem_cache_free\x00', r1}, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000080)) r3 = socket(0xa, 0x5, 0x0) getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000300)={0x0, @loopback, @private}, &(0x7f00000001c0)=0xfffffe50) syz_open_dev$usbmon(&(0x7f00000002c0), 0x80000000, 0x100) socket$packet(0x11, 0x3, 0x300) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x11, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000200), 0x3, r5}, 0x38) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='block_plug\x00', r6}, 0x10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000240)={r4, 0x1, 0x6, @remote}, 0x10) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, 0x0, &(0x7f0000000200)) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x2) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000100)=0x2000004) pwritev(r2, &(0x7f0000000040)=[{&(0x7f00000000c0)='\x00!', 0x2}], 0x1, 0x7, 0xfffffff9) 48.907900989s ago: executing program 3 (id=3280): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000000000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) syz_mount_image$iso9660(&(0x7f0000000380), &(0x7f0000000000)='./file2\x00', 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="00b94049504d1d4c23d692e4c1ae3da81457ad223dad027cd2412bda37151c79aca171fa844c3b01f84323acc83100610a47da7bbb5f", @ANYBLOB="2087c3964e04d543d44482b9ffb34b7aca30352b30a934804ea7a43f10e30ec41d1569808f2f256b3d8b071397655f588b802e4f8160e6f476666513260a88baae0cb9edd72cfd903a97a41cae56360d94bb0de0302e813406b8227c3465290f4eb36b107be9745ec3d7834d75a45ca7db5b5b9e0f68348dad66fc617bad7492b80e87e94126eb45bdd0697f0c0c8bedd559b2f2afadfddc44a08e2b0ac1fd25146198af1b8ee5d1829a7afaa9ae02b0782252d3a0c2b08f5bec65e2a9b2176f3865e3d46d8c0a7225", @ANYRESOCT, @ANYRES32=0x0, @ANYRES16, @ANYRES16, @ANYRESDEC], 0x9, 0x3a7, &(0x7f00000003c0)="$eJzs3NFO21YcB+CTCjpGVWlStUHpjUWliaEttY0KQlxFwVB3JpkIldbLSWXStFx1V+uL7Zn2CLtisp10o0lJ0qbzhL5PgnOwfzb/yCFHNj4OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBodY/jOGmFIu+9+DF6v+7xef/shvXj/f1xrbnh94bQKr/CyttFmw/+Wf1l+W07bNQ/bYS1slkLb+599cXRg5U74+1vKOg/8dvvb379aTi8fL3IRuVL+XQlfbzV0TGYI3qa9fJBPz/rnGZRPuhHh/v78ZNnJ4PoJC+ywcvBRXYWdc+zzkX/PNrpfhMlh4d7UdZ+2X/ROz3uFNl44cF3aRzvR8/bP2Sd80G/9+R5e9B9lhdF3jutMuXqMnNQvhG/zy+ii6xzFkU//zK83JtVZBlK5gmls0JpnKZJkqbJ/tPDpwdxvDKxIH5HmEg0/6alOXeX9LENS3E1Gv8BAACA26tVXWMvz/9Xw2bVO8mLLJ4MXn3WRHkAAADAElT/+d8om+q2r83Q+vf5/71GawMAAACWY/Ycu5mJ1rfhYZ14+KpuX40So3l+6yd5kbW7/eIoCV9XdxlUVxqm7m21uvywG7bq1NZ63a5f3+NamUraR0nYDY/qxKOdx2XzeGdKMp07uVcmF/DXVe3DDwAANGB7xng8z/i/G0bT/6Otajb/ytaUkTVecGQFAD6Z+gk24/n/w+Hl67fPtFlap+GXCAC84/oo/XnT5QAAAAAAAAAAAAAAAFNMTNe7G5Y+/+/jOn9u/y/KuF2dO6PDv8hWo0cdXTVV8/0PqHmOzv1pfwU6wwY/lAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgPf4OAAD//6Cn0cY=") pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) (async) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) splice(r3, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) (async) splice(r3, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) write$P9_RLERRORu(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="0e"], 0xe) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x34, r6, 0x101, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x4}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x84) r9 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r11 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) getsockname$packet(r11, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r10}, 0x70) getsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000280)=0x7, &(0x7f0000000340)=0x4) (async) getsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000280)=0x7, &(0x7f0000000340)=0x4) r12 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r12, 0x29, 0x16, &(0x7f0000fcb000), 0x4) close_range(r9, 0xffffffffffffffff, 0x0) (async) close_range(r9, 0xffffffffffffffff, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 33.908348074s ago: executing program 34 (id=3280): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000000000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) syz_mount_image$iso9660(&(0x7f0000000380), &(0x7f0000000000)='./file2\x00', 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="00b94049504d1d4c23d692e4c1ae3da81457ad223dad027cd2412bda37151c79aca171fa844c3b01f84323acc83100610a47da7bbb5f", @ANYBLOB="2087c3964e04d543d44482b9ffb34b7aca30352b30a934804ea7a43f10e30ec41d1569808f2f256b3d8b071397655f588b802e4f8160e6f476666513260a88baae0cb9edd72cfd903a97a41cae56360d94bb0de0302e813406b8227c3465290f4eb36b107be9745ec3d7834d75a45ca7db5b5b9e0f68348dad66fc617bad7492b80e87e94126eb45bdd0697f0c0c8bedd559b2f2afadfddc44a08e2b0ac1fd25146198af1b8ee5d1829a7afaa9ae02b0782252d3a0c2b08f5bec65e2a9b2176f3865e3d46d8c0a7225", @ANYRESOCT, @ANYRES32=0x0, @ANYRES16, @ANYRES16, @ANYRESDEC], 0x9, 0x3a7, &(0x7f00000003c0)="$eJzs3NFO21YcB+CTCjpGVWlStUHpjUWliaEttY0KQlxFwVB3JpkIldbLSWXStFx1V+uL7Zn2CLtisp10o0lJ0qbzhL5PgnOwfzb/yCFHNj4OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBodY/jOGmFIu+9+DF6v+7xef/shvXj/f1xrbnh94bQKr/CyttFmw/+Wf1l+W07bNQ/bYS1slkLb+599cXRg5U74+1vKOg/8dvvb379aTi8fL3IRuVL+XQlfbzV0TGYI3qa9fJBPz/rnGZRPuhHh/v78ZNnJ4PoJC+ywcvBRXYWdc+zzkX/PNrpfhMlh4d7UdZ+2X/ROz3uFNl44cF3aRzvR8/bP2Sd80G/9+R5e9B9lhdF3jutMuXqMnNQvhG/zy+ii6xzFkU//zK83JtVZBlK5gmls0JpnKZJkqbJ/tPDpwdxvDKxIH5HmEg0/6alOXeX9LENS3E1Gv8BAACA26tVXWMvz/9Xw2bVO8mLLJ4MXn3WRHkAAADAElT/+d8om+q2r83Q+vf5/71GawMAAACWY/Ycu5mJ1rfhYZ14+KpuX40So3l+6yd5kbW7/eIoCV9XdxlUVxqm7m21uvywG7bq1NZ63a5f3+NamUraR0nYDY/qxKOdx2XzeGdKMp07uVcmF/DXVe3DDwAANGB7xng8z/i/G0bT/6Otajb/ytaUkTVecGQFAD6Z+gk24/n/w+Hl67fPtFlap+GXCAC84/oo/XnT5QAAAAAAAAAAAAAAAFNMTNe7G5Y+/+/jOn9u/y/KuF2dO6PDv8hWo0cdXTVV8/0PqHmOzv1pfwU6wwY/lAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgPf4OAAD//6Cn0cY=") pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f00000000c0)) (async) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) (async) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) splice(r3, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) (async) splice(r3, 0x0, r2, 0x0, 0xffffffffffff8000, 0x0) write$P9_RLERRORu(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="0e"], 0xe) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r5) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f00000001c0)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_DEL_SECLEVEL(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x34, r6, 0x101, 0x70bd29, 0x25dfdbfd, {}, [@IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x4}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r8}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5, 0x35, 0x7}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x84) r9 = socket$inet6_udp(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) r11 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) getsockname$packet(r11, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r10}, 0x70) getsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000280)=0x7, &(0x7f0000000340)=0x4) (async) getsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000280)=0x7, &(0x7f0000000340)=0x4) r12 = socket$inet6(0xa, 0x80003, 0xff) setsockopt$inet6_int(r12, 0x29, 0x16, &(0x7f0000fcb000), 0x4) close_range(r9, 0xffffffffffffffff, 0x0) (async) close_range(r9, 0xffffffffffffffff, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 2.480113505s ago: executing program 0 (id=4253): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r1}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 2.380617169s ago: executing program 0 (id=4256): r0 = socket$inet(0x2, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) getuid() setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r0, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) listen(r0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) prctl$PR_SET_SECUREBITS(0x1c, 0x18) setuid(0xee00) 2.316231513s ago: executing program 4 (id=4257): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020097b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, 0x94) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x29) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='writeback_bdi_register\x00', r2}, 0x10) r3 = dup(r1) mount$9p_fd(0xfe00, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[], [], 0x6b}}) 2.315607353s ago: executing program 0 (id=4258): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 2.294000923s ago: executing program 0 (id=4259): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 2.226298876s ago: executing program 0 (id=4260): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x4, 0x45, 0x1488, 0xffffffffffffffff, 0x5}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000300000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r1}, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000740)=@framed, &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000200)='sched_switch\x00', r2}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x4, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000840)=@abs={0x0, 0x0, 0x4e20}, 0x9) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$key(0xf, 0x3, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xb, &(0x7f00000001c0)=ANY=[@ANYBLOB="03113875c492b796ffffff00000004001801000020206925000000"], &(0x7f0000000600)='syzkaller\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$IPSET_CMD_LIST(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000180)={&(0x7f0000000580)={0x50, 0x7, 0x6, 0x301, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x50}, 0x1, 0x0, 0x0, 0x24040004}, 0x20000000) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000004000000000000000010000851000000600000018020000", @ANYRES32, @ANYBLOB="0000000000000000660002000000ffb0180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r6}, 0x18) 2.156049289s ago: executing program 4 (id=4261): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, &(0x7f0000000400)}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f00000012c0)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x290) close_range(r1, 0xffffffffffffffff, 0x0) 1.612771402s ago: executing program 4 (id=4262): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000840), 0x81, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001cc0)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x30bd27, 0x4000005, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x0, 0x101, 0x3, 0xc, 0x13}, {0x7, 0x2, 0x8001, 0x200, 0x2, 0x7}, 0xffffff80, 0x947, 0xe03}}, @TCA_TBF_RTAB={0x404, 0x2, [0x6, 0x6, 0x6b16, 0x7, 0xfffffffd, 0x8, 0x8, 0x3, 0x7, 0x7, 0x5, 0x0, 0x80, 0x9, 0x30, 0x8, 0x81, 0x9, 0x2, 0x8, 0x40, 0x8, 0x80000001, 0x80, 0x10000400, 0x7a2, 0x5, 0x400, 0x3, 0xfffffffa, 0x6, 0x6, 0xaf8, 0x1, 0x3, 0x3ff, 0x9, 0x2, 0x3, 0x10001, 0x1, 0x5, 0x10001, 0x3, 0x59, 0x3, 0xd54e, 0x40, 0x6, 0xd, 0x0, 0x28, 0x9, 0xa4800000, 0x1, 0xa0, 0x1, 0x7, 0x4, 0x1, 0x7, 0x4, 0xff, 0x5, 0x7, 0x3ff, 0x3, 0xf6a5, 0x7fffffff, 0x8, 0x2, 0xcff, 0xfffffacf, 0x0, 0x4, 0x10001, 0xa, 0x1, 0x2, 0x8002, 0x5, 0x5, 0x5, 0xfffffffb, 0x5, 0x0, 0x4, 0x4edcaeea, 0x2, 0xe, 0xe, 0x4, 0x4, 0x9, 0x4, 0x7fffffff, 0x9, 0x8, 0x12, 0x9, 0x80000001, 0x325b, 0x7, 0x0, 0x80000006, 0x2, 0x3, 0x5, 0x1, 0x18001, 0x5, 0x94, 0x2, 0x9, 0x807, 0x0, 0x5, 0x80, 0x1, 0xffffffff, 0x4, 0x0, 0x4, 0x3, 0x4, 0x5, 0xa993, 0x200, 0x6847adf1, 0xb, 0x9, 0x81, 0x7, 0x5, 0x5, 0x7fffffff, 0x8, 0xc, 0xd, 0x2, 0x1, 0x7fffffff, 0x8, 0x0, 0x8, 0x8, 0x91e, 0x4, 0xe, 0x8001, 0x8, 0x40000, 0x0, 0x9, 0xd, 0x5, 0x8, 0x100, 0x8, 0x0, 0x1, 0x2, 0x9, 0x6, 0x3ff, 0x5, 0x1, 0xf682, 0x40, 0x6, 0x8, 0x3, 0x1fffe, 0xfffdfffe, 0x5, 0x1, 0xfffffff8, 0xa608, 0x23972b48, 0x7, 0x2, 0x0, 0xd, 0x4, 0xa, 0x5, 0x6, 0x10, 0x5, 0x5, 0x10, 0x41, 0x2, 0x76, 0x3, 0xfffffffa, 0x7, 0x2, 0x20004, 0x40, 0x9, 0x6, 0x2ef, 0xfffffffb, 0xcf30, 0x8, 0x4, 0xffffff8a, 0x0, 0x4, 0x80000000, 0x4, 0x2, 0x0, 0x2, 0x6, 0xfff, 0x4, 0x1, 0x40, 0x5, 0x9, 0x5, 0x8, 0x80000000, 0x0, 0x3, 0xeff, 0x6, 0x8001, 0x8, 0xc, 0x3, 0x1, 0x0, 0x5, 0x8, 0x6c67, 0x800, 0xffffff59, 0x9, 0x0, 0x303, 0x7, 0x1, 0x2, 0x6, 0x6561, 0x7, 0x4, 0xc, 0x42, 0x3c04, 0x5f, 0x5fa, 0x1]}]}}]}, 0x45c}}, 0x8000) 1.564937354s ago: executing program 6 (id=4263): bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000080200000e"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0x8, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='kfree\x00', r0}, 0x18) (async) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) openat$nci(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x403, 0x70b528, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xa1}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6}]}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x44}, 0x1, 0xba01, 0x0, 0x4004}, 0x810) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'syztnl0\x00', &(0x7f00000000c0)={'gre0\x00', 0x0, 0x10, 0x8000, 0xc, 0x7, {{0x25, 0x4, 0x0, 0x8, 0x94, 0x65, 0x0, 0xa2, 0x2f, 0x0, @rand_addr=0x64010101, @private=0xa010102, {[@ssrr={0x89, 0x2b, 0xd8, [@multicast1, @multicast2, @empty, @multicast2, @remote, @empty, @dev={0xac, 0x14, 0x14, 0x33}, @multicast2, @private=0xa010102, @remote]}, @cipso={0x86, 0xa, 0xffffffffffffffff, [{0x6, 0x4, "db52"}]}, @lsrr={0x83, 0x17, 0xda, [@private=0xa010101, @rand_addr=0x64010100, @broadcast, @multicast2, @multicast1]}, @end, @lsrr={0x83, 0xb, 0x94, [@remote, @loopback]}, @ssrr={0x89, 0x27, 0x2d, [@dev={0xac, 0x14, 0x14, 0x3a}, @private=0xa010102, @broadcast, @local, @empty, @private=0xa010101, @private=0xa010101, @multicast2, @local]}]}}}}}) (async) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000200)={@ipv4={""/10, ""/2, @multicast1}, 0x0}, &(0x7f0000000240)=0x14) r6 = perf_event_open(&(0x7f0000000940)={0x5, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffffffff}, 0x0, 0x4, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r6, 0x40082404, &(0x7f00000002c0)=0x8000) (async) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) mmap$xdp(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x200000d, 0x11, 0xffffffffffffffff, 0x100000000) (async) prlimit64(0x0, 0x0, &(0x7f0000000300)={0x42, 0x80}, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00'}, 0x10) r7 = openat$tun(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xd, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="180000000008002b000000000000000018040000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000002000000b704000000000000850000004300000095"], 0x0, 0x18, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f00000003c0)='sched_switch\x00'}, 0x10) ioctl$TUNSETQUEUE(r7, 0x400454d9, &(0x7f0000000080)={'ip6tnl0\x00', 0x400}) (async) r8 = io_uring_setup(0x4e67, &(0x7f0000000400)={0x0, 0xcdc6, 0x3f44cdfc68c0e7a1, 0x2, 0x7}) mmap$IORING_OFF_SQ_RING(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000004, 0x810, r8, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000340)={'gretap0\x00', &(0x7f00000002c0)={'gretap0\x00', 0x0, 0x80, 0x1, 0x5047, 0xfffffff9, {{0xa, 0x4, 0x1, 0x9, 0x28, 0x66, 0x0, 0xe, 0x2f, 0x0, @rand_addr=0x64010101, @remote, {[@rr={0x7, 0x13, 0x7c, [@broadcast, @private=0xa010101, @multicast1, @private=0xa010100]}]}}}}}) (async) r10 = socket$netlink(0x10, 0x3, 0xe) r11 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400df7f08000a00", @ANYRES32=r12], 0x3c}}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000380)={&(0x7f00000007c0)=ANY=[@ANYBLOB="60010000", @ANYRES16=0x0, @ANYBLOB="010026bd7000fedbdf250100000008000100", @ANYRES32=r3, @ANYBLOB="fc00028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e00000008000400a1d0000008000600", @ANYRES32=0x0, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004008b3bb81b08000600", @ANYRES32=r4, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004000400000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r5, @ANYBLOB="080207000000000008000100", @ANYRES32=r9, @ANYBLOB="400002803c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r12, @ANYBLOB], 0x160}, 0x1, 0x0, 0x0, 0x10}, 0x24048014) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000500)=ANY=[@ANYBLOB="280000001800010000000000000000000a00000008000000e00000020c0008800800", @ANYRES32], 0x28}}, 0x45) 1.339243234s ago: executing program 6 (id=4265): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = io_uring_setup(0x2b9f, &(0x7f00000002c0)={0x0, 0x27f9, 0x4000, 0x0, 0x283}) syz_io_uring_setup(0x416f, &(0x7f0000000780)={0x0, 0xc20c, 0x10100, 0x1, 0x1c3, 0x0, r0}, &(0x7f0000000280), &(0x7f00000001c0)) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x2, @perf_bp={0x0, 0x8}, 0x4, 0x0, 0x10000, 0x0, 0x2, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5393, &(0x7f0000000000)) r2 = socket(0x10, 0x3, 0x0) r3 = getpgrp(0x0) capset(&(0x7f0000000080)={0x20080522, r3}, &(0x7f0000000380)={0x4, 0x2, 0x7, 0x186, 0x7b33, 0x2f32}) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x3, 0x8, 0x0, 0x401}, 0xc) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000680)={0x0, 0xe, 0x6}, 0x8) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000400)={0x0, {0x2, 0x4e24, @rand_addr=0x64010102}, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e22, @multicast2}, 0x210, 0x0, 0x0, 0x0, 0x4, &(0x7f00000003c0)='batadv_slave_1\x00', 0xffffffffffffffff, 0xffffffffffffffff}) r4 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timerfd_create(0x0, 0x0) socket$key(0xf, 0x3, 0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='rxrpc_recvmsg\x00', r6}, 0x18) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x100) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r5}, 0x10) 1.334812324s ago: executing program 4 (id=4267): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r1}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 1.066969375s ago: executing program 4 (id=4268): open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000240)='syzkaller\x00', 0x4, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x1000040, &(0x7f00000002c0)={[{@barrier}, {@nodioread_nolock}, {@noquota}, {@barrier}, {@auto_da_alloc}, {@nodioread_nolock}]}, 0x21, 0x59c, &(0x7f0000001840)="$eJzs3U9oHGUbAPBnZrNN/+T70g++Dz6lh6JChdJN0j9aPbVXsVDoQfCiYbMNJZtsySbahIDpvYg9iEov9aYHj4oHD+LFo1cvimeh2KDQ9KArm51N03S3bmI2W7O/H0z2fWdm93nfmX3e7AwzTAB962j9TxrxVERcTCKGNywbiGzh0cZ6qytLxfsrS8UkarVLvySRRMS9laVic/0kez0UEcsR8f+I+CYfcTxd/8h9zUJ1YXFqvFwuzWb1kbnpqyPVhcUTV6bHJ0uTpZlTL7505uzpM2MnxzY2935tYy2/tb7e+PHmuze+e+X2zU8/O7JcfH88iXMxlC3b2I+d1Ngm+Ti3af7pbgTroaTXDWBbclme11PpfzEcuSzrW6ltHBwGd6V5QBfVBiNq6zYUgT6QSHroU83fAfXj3+a0m78/7pxvHIDU466uLBXfiWb8gca5idi/dmxy8NfkoSOT+vHm4d1sKHvS8vWIGB0YePT7n2Tfv+0b3YkG0lVfn2/sqEf3f7o+/kSL8Weoee70b2qOf6vZ+LfaIn6uzfh3scMYv7/+00dt418fjKdbxk/W4yct4qcR8WaH8W+99uXZdstqH0cci9bxm5LHnx8euXylXBpt/G0Z46tjR15u3/+Ig23iN87Z7l9ryMb+78valHbY/y++/fyZ5cfEf/7Zx+//Vtv/QES812H8/9z75NV2y+5cT+7WfwVsdf8nkY/bHcZ/4dzRH7Kis4YAAAAAAAAAALCD0rVr2ZK0sF5O00KhcQ/vf+NgWq5U545frszPTDSueTsc+bR5pdVwo57U62PZ9bjN+slN9VO5LGDuwFq9UKyUJ3rcdwAAAAAAAAAAAAAAAAAAAHhSHNp0//9vubX7/zc/rhrYq9o/8hvY6+Q/9K+H8z/pWTuA3ef/P/StmvyH/iX/oX/Jf+hf8h/6l/yH/iX/oX/JfwAAAAAAAAAAAAAAAAAAAAAAAAAA6IqLFy7Up9r9laVivT4xsDA/VXnrxESpOlWYni8WipXZq4XJSmWyXCoUK9N/9XlJpXJ1NGbmr43MlapzI9WFxTemK/MzzWeKlvJd7xEAAAAAAAAAAAAAAAAAAAD88wytTUlaiMg36mlaKET8KyIOJ5FcvlIujUbEvyPi+1x+sF4f63WjAQAAAAAAAAAAAAAAAAAAYI+pLixOjZfLpdnuFQayUF0M0XlhYCsrR8Tyzjaj/olbflc+24A93nR7o5B7Mr6HT36hh4MSAAAAAAAAAAAAAAAAAAD0qQc3/Xb6jj+62yAAAAAAAAAAAAAAAAAAAADoS+nPSUTUp2PDzw1tXrovWc2tvUbE27cufXBtfG5udqw+/+76/LkPs/kne9F+oFPNPE0jop7HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAPVhcWp8XK5NLvNwmAH6/S6jwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADb8WcAAAD//y4WzlE=") bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000300)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x94) unshare(0x22020600) r0 = socket(0x2d, 0x2, 0x0) bind$xdp(r0, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0x1000000c}, 0x10) 980.174799ms ago: executing program 7 (id=4269): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) connect$inet(r1, 0x0, 0x0) 973.524629ms ago: executing program 7 (id=4270): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 958.17134ms ago: executing program 1 (id=4271): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000440)='kmem_cache_free\x00', r0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)}, 0x20048812) 926.844641ms ago: executing program 7 (id=4272): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, &(0x7f0000000400)}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f00000012c0)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x290) close_range(r1, 0xffffffffffffffff, 0x0) 848.106185ms ago: executing program 6 (id=4273): r0 = socket$inet(0x2, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) getuid() setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r0, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) listen(r0, 0x0) socket$inet6(0xa, 0x1, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) prctl$PR_SET_SECUREBITS(0x1c, 0x18) setuid(0xee00) 847.775854ms ago: executing program 1 (id=4274): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x4, &(0x7f0000000980)=ANY=[@ANYBLOB="1801000000000000000000006dfeff00850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000040)='kfree\x00', r0, 0x0, 0x401}, 0x11) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000002c0000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000001000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r3}, 0x10) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) close(r4) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_GET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="14000000", @ANYRES16=r5, @ANYBLOB="010000000000fcdbcf2554"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40010) 824.149016ms ago: executing program 7 (id=4275): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00'}, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) fsetxattr$security_selinux(r0, &(0x7f0000000040), &(0x7f0000000140)='system_u:object_r:tmpreaper_exec_t:s0\x00', 0x26, 0x1) 791.340097ms ago: executing program 6 (id=4276): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40041, 0x141) r2 = socket$inet_sctp(0x2, 0x1, 0x84) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000040), 0x4898, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) r3 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file1\x00', 0x80c2, 0x13a) fcntl$setlease(r3, 0x400, 0x1) fcntl$getflags(r3, 0x401) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x0, 0x2000000000000107, &(0x7f00000004c0)=ANY=[@ANYRES8=r0, @ANYRES8, @ANYBLOB="d7c9ed2922bebd6632777380cfa63374be2e942363a91b69a082bfc6f5a952fea24288246b20b069ff774bf2e2356765723a4db45d7234a3138a8e0528109784508b112f6a7b5a0a43082b92213b0e9eeb0d9fa889d441afd322b4c1fe", @ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x3e, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) pipe2$9p(&(0x7f0000001900), 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x29) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r4, 0x29, 0x1b, &(0x7f0000000200)={@dev}, 0x14) setsockopt$inet6_mreq(r4, 0x29, 0x1c, &(0x7f0000000000)={@remote}, 0x19) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r5, 0x84, 0xa, &(0x7f0000000340)={0x3, 0x9, 0x2, 0xdb75, 0x9, 0x1, 0x7, 0x7fff, r7}, &(0x7f00000003c0)=0x20) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='.\x00', 0x0) setresuid(0x0, 0xee00, 0x0) r9 = socket$kcm(0x2, 0x200000000000001, 0x0) semop(0x0, &(0x7f0000000180)=[{0x0, 0x203}, {}], 0x2) semctl$IPC_RMID(0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(r9, 0x1, 0x3e, &(0x7f0000000100), 0x4) r10 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r10, &(0x7f00000000c0)={0x0, 0xfe, &(0x7f0000000000)=[{&(0x7f0000000040)="0207000902000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f00000001c0)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300", 0xffffffff}, 0x48, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) faccessat(r8, &(0x7f0000000000)='./file0\x00', 0x1) 786.300617ms ago: executing program 7 (id=4277): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000840), 0x81, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001cc0)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x30bd27, 0x4000005, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x0, 0x101, 0x3, 0xc, 0x13}, {0x7, 0x2, 0x8001, 0x200, 0x2, 0x7}, 0xffffff80, 0x947, 0xe03}}, @TCA_TBF_RTAB={0x404, 0x2, [0x6, 0x6, 0x6b16, 0x7, 0xfffffffd, 0x8, 0x8, 0x3, 0x7, 0x7, 0x5, 0x0, 0x80, 0x9, 0x30, 0x8, 0x81, 0x9, 0x2, 0x8, 0x40, 0x8, 0x80000001, 0x80, 0x10000400, 0x7a2, 0x5, 0x400, 0x3, 0xfffffffa, 0x6, 0x6, 0xaf8, 0x1, 0x3, 0x3ff, 0x9, 0x2, 0x3, 0x10001, 0x1, 0x5, 0x10001, 0x3, 0x59, 0x3, 0xd54e, 0x40, 0x6, 0xd, 0x0, 0x28, 0x9, 0xa4800000, 0x1, 0xa0, 0x1, 0x7, 0x4, 0x1, 0x7, 0x4, 0xff, 0x5, 0x7, 0x3ff, 0x3, 0xf6a5, 0x7fffffff, 0x8, 0x2, 0xcff, 0xfffffacf, 0x0, 0x4, 0x10001, 0xa, 0x1, 0x2, 0x8002, 0x5, 0x5, 0x5, 0xfffffffb, 0x5, 0x0, 0x4, 0x4edcaeea, 0x2, 0xe, 0xe, 0x4, 0x4, 0x9, 0x4, 0x7fffffff, 0x9, 0x8, 0x12, 0x9, 0x80000001, 0x325b, 0x7, 0x0, 0x80000006, 0x2, 0x3, 0x5, 0x1, 0x18001, 0x5, 0x94, 0x2, 0x9, 0x807, 0x0, 0x5, 0x80, 0x1, 0xffffffff, 0x4, 0x0, 0x4, 0x3, 0x4, 0x5, 0xa993, 0x200, 0x6847adf1, 0xb, 0x9, 0x81, 0x7, 0x5, 0x5, 0x7fffffff, 0x8, 0xc, 0xd, 0x2, 0x1, 0x7fffffff, 0x8, 0x0, 0x8, 0x8, 0x91e, 0x4, 0xe, 0x8001, 0x8, 0x40000, 0x0, 0x9, 0xd, 0x5, 0x8, 0x100, 0x8, 0x0, 0x1, 0x2, 0x9, 0x6, 0x3ff, 0x5, 0x1, 0xf682, 0x40, 0x6, 0x8, 0x3, 0x1fffe, 0xfffdfffe, 0x5, 0x1, 0xfffffff8, 0xa608, 0x23972b48, 0x7, 0x2, 0x0, 0xd, 0x4, 0xa, 0x5, 0x6, 0x10, 0x5, 0x5, 0x10, 0x41, 0x2, 0x76, 0x3, 0xfffffffa, 0x7, 0x2, 0x20004, 0x40, 0x9, 0x6, 0x2ef, 0xfffffffb, 0xcf30, 0x8, 0x4, 0xffffff8a, 0x0, 0x4, 0x80000000, 0x4, 0x2, 0x0, 0x2, 0x6, 0xfff, 0x4, 0x1, 0x40, 0x5, 0x9, 0x5, 0x8, 0x80000000, 0x0, 0x3, 0xeff, 0x6, 0x8001, 0x8, 0xc, 0x3, 0x1, 0x0, 0x5, 0x8, 0x6c67, 0x800, 0xffffff59, 0x9, 0x0, 0x303, 0x7, 0x1, 0x2, 0x6, 0x6561, 0x7, 0x4, 0xc, 0x42, 0x3c04, 0x5f, 0x5fa, 0x1]}]}}]}, 0x45c}}, 0x8000) 762.062028ms ago: executing program 1 (id=4278): r0 = perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x4, 0x0, 0x0, 0x0, 0x0, 0x103, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100002, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000000000"], 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r0}, 0x20) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) lstat(&(0x7f0000001800)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) r3 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) write$selinux_validatetrans(r3, &(0x7f0000001cc0)=ANY=[@ANYBLOB='system_u:object_r:semanage_t system_u:object_r:fixed_disk_device_t:s0 0'], 0x79) 706.41792ms ago: executing program 6 (id=4279): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800"/15, @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='task_newtask\x00', r1}, 0x10) syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) 706.05174ms ago: executing program 1 (id=4280): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r0, 0xfffffffc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) add_key(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) connect$inet(r1, 0x0, 0x0) 639.409193ms ago: executing program 1 (id=4281): mremap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffc000/0x2000)=nil) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x3, 0xf3, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000a40)={0x0, 0x0}) r1 = eventfd2(0x0, 0x0) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)}, 0x21) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000000002200000000000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='kmem_cache_free\x00', r2}, 0x10) fadvise64(0xffffffffffffffff, 0x2, 0x401, 0x1) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000e80)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26765ba5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b2506f3bb506f1d7fbdf8010000000000a073d0de5538ab42e170b3baae34c35987b0dda497ac3f5e97e6e6aeea15c6d5ed24310100000003bb6030f84b63aaf8690db0221b1705c501f802ff59b4e683efa4b6e77e042072bd2ac37d413008ec9eb8166f6e28b49a77ed91befc65315896f88a8fb1dd679fb4c515f8b7a5b7aca6a251a89d47b728502f7e621cc0e3ba04000000c149ee6601728c750d304197c22da8650579475afd96187d881e93b42a5fdfd686d8900c44c67133dad58037fda65885a15a429edfe3027a5ebf95254744f10fd607bc3300b94932b8d9447c4df6e21ee0e54f8be072e0b083bbd86b19cb074577a25ff581d92af08a06f857310a2f14326b0b290205e91a682e00c8762cbc6b904c980eef6e6a1def886c95676dce6a8194479700a02b92bdc8d05eae1f24fdd7b80d1bb404c22f681594de2ebb9687219de8d73ac83823feb402a2415a9850d5f0183ec67be96dc0e4c2d7acf1dfe79d6771903b76e21190c22d641030e1ddacf006c3116e1803af20a5f2b5f7ba58aca5bcabbbab24414a3810788e5503e4be66d683daac5f0001000077339b4200000000108a3c87b19d5b9a00c75d84a92d6dcf00ba96edf35ede0e2b57c26e94801b498924166bde57d5f24258d9fd028096cc15a8b912b494d4bbe609031ea1ca65a548971d5d16296dd08e020000007a27310d5d01f8a8a0f5212d7f628f554afea715ccbc66cbb1016490f5d579308cb3188cf2fcaf67e0c16443d526ba4b968f07ae362c2133c168313e84beb871203880dd453c45d0a137d7f5a8b039dbfa62fb2b4214f8e69f967bf1fbd89e77fcca110000000800000000000000f8877994ebdc35f7efd41e3babd9b3782edd6776d5b6cb4ecd72c9de9b5503747d71440378cf2c2c7ea2dc5febb654a867f853713cf4c0bb322fbbe446d18dee4c821275ef18259cafc346c8b3b9fb0f3adcf6ea310a6b9a3f59e29a5909ea047fb61affb4bc8bbea1fb761b8933795b1a91358a7791aa843d07020e8bb6fc18458c49ac6313e7165b7d9f65e94a62b69f1011b94340cdb7303f01e5cdb5682ddf73d65c3de1d88dd7496d6345d5b9de0223988056a53e19a8b96b9640bc6c09d3c2ff894d626b57c776ed53f94d5e22ff148061b37f72bd92924cb1d0a725e19b264346b7cae0251a850de78316503f3c3d395c7e3f04fc8d52583327cd2341ce4b2d092815376299686f41353b2823814563011a2223b9dd"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0xfeffff, 0xe80, 0x3f000002, &(0x7f0000000700)="c45c57ce395de5b289f07d637a223920f181c2e57d71483cfb2d075a3ff07258e080a194805cdb0c26d3f7ffb1e0d9cf4fa36dcb2168b72de48ac8f93e6804f1c4d70898d0810e044d7e1778eaac5dfdcc9f1208905522025bcfdf1b6f969b094d5c022c2b7ffefde71e0627b9a2069cc1e0175c4b8860aad4b0a103c589f676b6c4e85eb3950c533b6e62c39ccf9ae9bfe54ee5887358d44f46337fbe090d7c7e55847edee8130ffd3d1e719e01a68b0e691c0d35b0b56e0b514036342fd56f08ac0083f3c2fe41a1295a3d23cf3d160d4fd90f66beba68860456ed41272e1e68d16c2564c85f5556e18784113c493d13253e14d6eb891707fba3c30d07d5ee8619e4426cafec4cf6a3723c455d09b586b248", 0x0, 0xf0, 0x0, 0xf0, 0xffffff0c}, 0x40) r4 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) mbind(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x4000, &(0x7f0000000000)=0x4, 0x800, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) shmat(0x0, &(0x7f0000ffe000/0x2000)=nil, 0x5000) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1b, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1004}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xeb48195b69e85694, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kfree\x00', r6, 0x0, 0x5}, 0x18) mount$9p_tcp(0x0, &(0x7f0000001040)='.\x00', &(0x7f00000006c0), 0x8010, &(0x7f0000001000)=ANY=[@ANYBLOB='trans=tcp']) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f00000008c0)=ANY=[@ANYRES64=r7, @ANYRESOCT=r4, @ANYRESOCT=r0, @ANYRESHEX=0x0, @ANYRES16=r0, @ANYRES32=r1, @ANYRESOCT=r4, @ANYRES64], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x34, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) 639.147763ms ago: executing program 4 (id=4282): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000040)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r0}, 0x18) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r1) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf2531000000"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) 638.717804ms ago: executing program 6 (id=4283): openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = io_uring_setup(0x2b9f, &(0x7f00000002c0)={0x0, 0x27f9, 0x4000, 0x0, 0x283}) syz_io_uring_setup(0x416f, &(0x7f0000000780)={0x0, 0xc20c, 0x10100, 0x1, 0x1c3, 0x0, r0}, &(0x7f0000000280), &(0x7f00000001c0)) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x2, @perf_bp={0x0, 0x8}, 0x4, 0x0, 0x10000, 0x0, 0x2, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) r1 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5393, &(0x7f0000000000)) r2 = socket(0x10, 0x3, 0x0) r3 = getpgrp(0x0) capset(&(0x7f0000000080)={0x20080522, r3}, &(0x7f0000000380)={0x4, 0x2, 0x7, 0x186, 0x7b33, 0x2f32}) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x3, 0x8, 0x0, 0x401}, 0xc) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000680)={0x0, 0xe, 0x6}, 0x8) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000400)={0x0, {0x2, 0x4e24, @rand_addr=0x64010102}, {0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x2, 0x4e22, @multicast2}, 0x210, 0x0, 0x0, 0x0, 0x4, &(0x7f00000003c0)='batadv_slave_1\x00', 0xffffffffffffffff, 0xffffffffffffffff}) r4 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) timerfd_create(0x0, 0x0) socket$key(0xf, 0x3, 0x2) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r6, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x100) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r5}, 0x10) 626.024114ms ago: executing program 7 (id=4284): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x0, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@ptr={0xa, 0x0, 0x0, 0x2, 0x5}]}}, 0x0, 0x26, 0x0, 0x1}, 0x28) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) listen(0xffffffffffffffff, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='9p_protocol_dump\x00', r3}, 0x10) mount$9p_fd(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000600)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_SET(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)={0x54, r6, 0x113, 0x0, 0x0, {0x41}, [{@nsim={{0xe}, {0x18, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x87}, {0xc}, {0xc}}]}, 0x54}}, 0x800) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x34, r6, 0x400, 0x70bd27, 0x25dfdbff, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x10008011) r7 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) recvfrom(r4, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) r9 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x14080, 0x0) setsockopt$MRT_FLUSH(r9, 0x0, 0xd4, &(0x7f0000000440)=0x6, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000380)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)='%pI4 \x00'}, 0x20) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000003c0)=@o_path={&(0x7f0000000000)='./file0\x00', r10}, 0x18) ioctl$HCIINQUIRY(r9, 0x800448f0, &(0x7f0000000480)={0x3, 0x9, "19cbf9", 0x7, 0x6}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r8}, 0x10) 49.676878ms ago: executing program 1 (id=4285): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000440)='kmem_cache_free\x00', r0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500)}, 0x20048812) 0s ago: executing program 0 (id=4286): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a999850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0}, 0x10) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x0, &(0x7f0000000400)}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f00000012c0)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f00000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x290) close_range(r1, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): beyond EOF (i_pos 899) [ 240.540726][T13205] FAT-fs (loop0): Filesystem has been set read-only [ 240.547689][T13205] syz.0.3350: attempt to access beyond end of device [ 240.547689][T13205] loop0: rw=524288, sector=1736, nr_sectors = 32 limit=256 [ 240.561753][T13205] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 899) [ 240.570447][T13205] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 899) [ 240.579615][T13205] syz.0.3350: attempt to access beyond end of device [ 240.579615][T13205] loop0: rw=0, sector=1736, nr_sectors = 8 limit=256 [ 240.601013][T13205] syz.0.3350: attempt to access beyond end of device [ 240.601013][T13205] loop0: rw=0, sector=1736, nr_sectors = 8 limit=256 [ 240.634237][T13211] loop6: detected capacity change from 0 to 512 [ 240.648802][T13211] EXT4-fs warning (device loop6): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 240.666230][T13211] EXT4-fs (loop6): mount failed [ 240.686491][T13217] loop0: detected capacity change from 0 to 256 [ 240.720030][T13217] FAT-fs (loop0): Directory bread(block 64) failed [ 240.728578][T13217] FAT-fs (loop0): Directory bread(block 65) failed [ 240.735503][T13217] FAT-fs (loop0): Directory bread(block 66) failed [ 240.742380][T13217] FAT-fs (loop0): Directory bread(block 67) failed [ 240.749212][T13217] FAT-fs (loop0): Directory bread(block 68) failed [ 240.756115][T13217] FAT-fs (loop0): Directory bread(block 69) failed [ 240.762953][T13217] FAT-fs (loop0): Directory bread(block 70) failed [ 240.770061][T13217] FAT-fs (loop0): Directory bread(block 71) failed [ 240.776754][T13217] FAT-fs (loop0): Directory bread(block 72) failed [ 240.783520][T13217] FAT-fs (loop0): Directory bread(block 73) failed [ 240.801757][T13217] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 899) [ 240.810567][T13217] FAT-fs (loop0): Filesystem has been set read-only [ 240.817417][T13217] syz.0.3354: attempt to access beyond end of device [ 240.817417][T13217] loop0: rw=524288, sector=1736, nr_sectors = 32 limit=256 [ 240.831273][T13217] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 899) [ 240.841974][T13217] FAT-fs (loop0): error, fat_bmap_cluster: request beyond EOF (i_pos 899) [ 240.851844][T13217] syz.0.3354: attempt to access beyond end of device [ 240.851844][T13217] loop0: rw=0, sector=1736, nr_sectors = 8 limit=256 [ 240.865883][T13217] syz.0.3354: attempt to access beyond end of device [ 240.865883][T13217] loop0: rw=0, sector=1736, nr_sectors = 8 limit=256 [ 240.961156][T13226] bond0: (slave dummy0): Releasing backup interface [ 240.986408][T13226] team0: Port device dummy0 added [ 241.001168][T13226] team0: Port device dummy0 removed [ 241.009817][T13226] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 241.082452][T13228] xt_CT: You must specify a L4 protocol and not use inversions on it [ 241.131547][T13236] bond0: (slave dummy0): Releasing backup interface [ 241.141036][T13236] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 241.165501][T13236] team0: Failed to send options change via netlink (err -105) [ 241.173046][T13236] team0: Port device dummy0 added [ 241.184843][T13241] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 241.197151][T13241] team0: Failed to send options change via netlink (err -105) [ 241.205174][T13241] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 241.214184][T13241] team0: Port device dummy0 removed [ 241.222732][T13241] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 241.277781][T13244] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 241.308419][T13247] loop4: detected capacity change from 0 to 764 [ 241.346297][T13247] rock: directory entry would overflow storage [ 241.353508][T13247] rock: sig=0x4f50, size=4, remaining=3 [ 241.359578][T13247] iso9660: Corrupted directory entry in block 6 of inode 1792 [ 241.412383][T13247] __nla_validate_parse: 12 callbacks suppressed [ 241.412404][T13247] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3366'. [ 241.439984][T13247] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 241.473141][T13252] loop6: detected capacity change from 0 to 2048 [ 241.518909][T13252] Alternate GPT is invalid, using primary GPT. [ 241.525541][T13252] loop6: p2 p3 p7 [ 241.704609][T13265] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3373'. [ 241.713860][T13265] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3373'. [ 241.796397][T13271] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 242.005032][T13283] pim6reg: entered allmulticast mode [ 242.017606][T13283] loop0: detected capacity change from 0 to 1024 [ 242.028978][T13283] EXT4-fs: Ignoring removed orlov option [ 242.054496][T13283] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 242.085767][T13283] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 242.124979][ T29] kauditd_printk_skb: 216 callbacks suppressed [ 242.124996][ T29] audit: type=1326 audit(1764755605.691:13815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13289 comm="syz.1.3383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.155017][ T29] audit: type=1326 audit(1764755605.691:13816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13289 comm="syz.1.3383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=128 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.178915][ T29] audit: type=1326 audit(1764755605.691:13817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13289 comm="syz.1.3383" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.244744][T13295] loop0: detected capacity change from 0 to 512 [ 242.258044][T13297] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3386'. [ 242.265669][T13295] FAT-fs (loop0): error, corrupted directory (invalid entries) [ 242.267182][T13297] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3386'. [ 242.300740][T13295] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 242.309870][T13295] FAT-fs (loop0): error, fat_get_cluster: invalid cluster chain (i_pos 0) [ 242.326236][ T29] audit: type=1400 audit(1764755605.901:13818): avc: denied { remount } for pid=13294 comm="syz.0.3385" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dosfs_t tclass=filesystem permissive=1 [ 242.367034][ T29] audit: type=1326 audit(1764755605.921:13819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.1.3387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.391268][ T29] audit: type=1326 audit(1764755605.921:13820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.1.3387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.415539][ T29] audit: type=1326 audit(1764755605.921:13821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.1.3387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.439234][ T29] audit: type=1326 audit(1764755605.921:13822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.1.3387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.463454][ T29] audit: type=1326 audit(1764755605.921:13823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.1.3387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.487116][ T29] audit: type=1326 audit(1764755605.921:13824): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13298 comm="syz.1.3387" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 242.550963][T13305] 9pnet: Could not find request transport: tcp0/ . %+ [ 242.563087][T13307] loop0: detected capacity change from 0 to 512 [ 242.584408][T13307] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 242.593942][T13307] EXT4-fs (loop0): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 242.603883][T13307] EXT4-fs (loop0): group descriptors corrupted! [ 242.690906][T13320] validate_nla: 13 callbacks suppressed [ 242.690924][T13320] netlink: 'syz.6.3396': attribute type 10 has an invalid length. [ 242.707617][T13320] bond0: (slave dummy0): Releasing backup interface [ 242.716324][T13320] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 242.725681][T13320] team0: Failed to send options change via netlink (err -105) [ 242.733283][T13320] team0: Port device dummy0 added [ 242.750013][T13320] netlink: 'syz.6.3396': attribute type 10 has an invalid length. [ 242.759112][T13320] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 242.771419][T13320] team0: Failed to send options change via netlink (err -105) [ 242.786802][T13320] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 242.795956][T13320] team0: Port device dummy0 removed [ 242.802564][T13320] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 242.884092][T13327] netlink: 'syz.6.3398': attribute type 1 has an invalid length. [ 242.891922][T13327] netlink: 224 bytes leftover after parsing attributes in process `syz.6.3398'. [ 242.936137][T13330] netlink: 'syz.6.3398': attribute type 6 has an invalid length. [ 242.983293][T13334] netlink: 'syz.6.3400': attribute type 6 has an invalid length. [ 243.218899][T13348] program syz.4.3406 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 243.470918][T13356] loop1: detected capacity change from 0 to 164 [ 243.479794][T13356] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 243.498443][T13356] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 243.513649][T13356] Symlink component flag not implemented [ 243.519473][T13356] Symlink component flag not implemented [ 243.525835][T13356] Symlink component flag not implemented (7) [ 243.531845][T13356] Symlink component flag not implemented (116) [ 243.565102][T13360] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3411'. [ 243.615867][T13365] netlink: 48 bytes leftover after parsing attributes in process `syz.6.3414'. [ 243.837008][T13381] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 243.905212][T13385] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 243.930692][T13389] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3424'. [ 244.012730][T13395] 9pnet: Could not find request transport: tcp0/ . %+ [ 244.076350][T13398] netlink: 'syz.4.3429': attribute type 10 has an invalid length. [ 244.095357][T13398] bond0: (slave dummy0): Releasing backup interface [ 244.106920][T13398] team0: Port device dummy0 added [ 244.118054][T13398] netlink: 'syz.4.3429': attribute type 10 has an invalid length. [ 244.129444][T13398] team0: Port device dummy0 removed [ 244.137904][T13398] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 244.242516][ T4650] hid-generic 0000:0000:0000.002C: unknown main item tag 0x0 [ 244.253471][ T4650] hid-generic 0000:0000:0000.002C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 244.556890][T13418] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3437'. [ 244.657541][T13428] loop6: detected capacity change from 0 to 1024 [ 244.676614][T13428] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 244.756992][T13436] rdma_op ffff88811a57f180 conn xmit_rdma 0000000000000000 [ 244.987008][T13447] netlink: 'syz.0.3449': attribute type 10 has an invalid length. [ 244.997453][T13447] bond0: (slave dummy0): Releasing backup interface [ 245.007746][T13447] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 245.017235][T13447] team0: Failed to send options change via netlink (err -105) [ 245.024940][T13447] team0: Port device dummy0 added [ 245.039037][T13447] netlink: 'syz.0.3449': attribute type 10 has an invalid length. [ 245.048507][T13447] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 245.061603][T13449] loop4: detected capacity change from 0 to 128 [ 245.075912][T13447] team0: Failed to send options change via netlink (err -105) [ 245.083704][T13447] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 245.094341][T13447] team0: Port device dummy0 removed [ 245.102544][T13447] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 245.263464][T13460] loop0: detected capacity change from 0 to 128 [ 245.330418][T13466] loop1: detected capacity change from 0 to 128 [ 245.339824][T13467] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 245.581693][ T6430] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 245.836330][T13491] loop4: detected capacity change from 0 to 2048 [ 245.969396][T10433] Alternate GPT is invalid, using primary GPT. [ 245.975986][T10433] loop4: p2 p3 p7 [ 246.060423][T13491] Alternate GPT is invalid, using primary GPT. [ 246.067037][T13491] loop4: p2 p3 p7 [ 246.136091][T13488] Set syz1 is full, maxelem 65536 reached [ 246.549826][T13517] netlink: 'syz.0.3479': attribute type 10 has an invalid length. [ 246.559962][T13517] bond0: (slave dummy0): Releasing backup interface [ 246.569426][T13517] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 246.579322][T13517] team0: Failed to send options change via netlink (err -105) [ 246.586939][T13517] team0: Port device dummy0 added [ 246.605549][T13517] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 246.617475][T13517] team0: Failed to send options change via netlink (err -105) [ 246.625805][T13517] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 246.652062][T13517] team0: Port device dummy0 removed [ 246.672327][T13517] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 246.672976][T13521] __nla_validate_parse: 3 callbacks suppressed [ 246.672994][T13521] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3480'. [ 246.740330][T13525] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3482'. [ 246.763085][T13528] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 246.763085][T13528] program syz.1.3483 not setting count and/or reply_len properly [ 246.868010][T13534] bond0: (slave dummy0): Releasing backup interface [ 246.877963][T13534] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 246.887332][T13534] team0: Failed to send options change via netlink (err -105) [ 246.894898][T13534] team0: Port device dummy0 added [ 246.907419][T13539] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 246.940038][T13539] team0: Failed to send options change via netlink (err -105) [ 246.948275][T13539] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 246.958153][T13539] team0: Port device dummy0 removed [ 246.967230][T13539] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 247.008175][T13543] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3490'. [ 247.017216][T13543] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3490'. [ 247.219589][ T29] kauditd_printk_skb: 776 callbacks suppressed [ 247.219618][ T29] audit: type=1326 audit(1764755610.791:14601): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.250545][ T29] audit: type=1326 audit(1764755610.791:14602): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.274332][ T29] audit: type=1326 audit(1764755610.821:14603): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.298013][ T29] audit: type=1326 audit(1764755610.821:14604): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.321799][ T29] audit: type=1326 audit(1764755610.821:14605): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.345517][ T29] audit: type=1326 audit(1764755610.821:14606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.369241][ T29] audit: type=1326 audit(1764755610.821:14607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.392916][ T29] audit: type=1326 audit(1764755610.821:14608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.416853][ T29] audit: type=1326 audit(1764755610.871:14609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=254 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.441683][ T29] audit: type=1326 audit(1764755610.871:14610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13548 comm="syz.0.3493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 247.539005][T13551] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3494'. [ 247.545395][T13554] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3493'. [ 247.561102][T13554] netem: change failed [ 247.578116][T13556] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 247.578116][T13556] program syz.6.3496 not setting count and/or reply_len properly [ 247.625836][T13558] program syz.4.3497 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 247.694514][T13567] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 247.852539][T13579] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3507'. [ 248.009264][T13594] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 248.056325][T13598] team0: Cannot enslave team device to itself [ 248.062493][T13598] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 248.238180][T13614] validate_nla: 3 callbacks suppressed [ 248.238195][T13614] netlink: 'syz.0.3524': attribute type 10 has an invalid length. [ 248.257464][T13614] team0 (unregistering): Port device team_slave_0 removed [ 248.266904][T13614] team0 (unregistering): Port device team_slave_1 removed [ 248.279518][ T3484] syz!: Port: 1 Link DOWN [ 248.397869][T13626] netlink: 'syz.0.3528': attribute type 10 has an invalid length. [ 248.407664][T13626] bond0: (slave dummy0): Releasing backup interface [ 248.416393][T13626] netlink: 'syz.0.3528': attribute type 10 has an invalid length. [ 248.426468][T13626] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 248.620219][T13645] netlink: 'syz.0.3537': attribute type 10 has an invalid length. [ 248.635391][T13645] bond0: (slave dummy0): Releasing backup interface [ 248.647630][T13645] netlink: 'syz.0.3537': attribute type 10 has an invalid length. [ 248.658400][T13645] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 248.667255][T13646] loop4: detected capacity change from 0 to 2048 [ 248.725149][T13646] Alternate GPT is invalid, using primary GPT. [ 248.731746][T13646] loop4: p2 p3 p7 [ 248.773466][T13654] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 248.774736][T10134] udevd[10134]: inotify_add_watch(7, /dev/loop4p3, 10) failed: No such file or directory [ 248.791715][ T8760] udevd[8760]: inotify_add_watch(7, /dev/loop4p7, 10) failed: No such file or directory [ 248.804169][T10433] udevd[10433]: inotify_add_watch(7, /dev/loop4p2, 10) failed: No such file or directory [ 248.839465][T13656] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 248.839465][T13656] program syz.0.3543 not setting count and/or reply_len properly [ 248.894400][T13652] loop6: detected capacity change from 0 to 2048 [ 248.904093][T13660] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3545'. [ 248.918562][T10433] Alternate GPT is invalid, using primary GPT. [ 248.925093][T10433] loop6: p2 p3 p7 [ 248.936351][T13652] Alternate GPT is invalid, using primary GPT. [ 248.942700][T13652] loop6: p2 p3 p7 [ 249.015741][T13668] program syz.6.3549 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 249.031179][T10134] udevd[10134]: inotify_add_watch(7, /dev/loop6p3, 10) failed: No such file or directory [ 249.031205][T10433] udevd[10433]: inotify_add_watch(7, /dev/loop6p2, 10) failed: No such file or directory [ 249.042933][ T8760] udevd[8760]: inotify_add_watch(7, /dev/loop6p7, 10) failed: No such file or directory [ 249.075269][T10134] udevd[10134]: inotify_add_watch(7, /dev/loop6p3, 10) failed: No such file or directory [ 249.086185][T10433] udevd[10433]: inotify_add_watch(7, /dev/loop6p2, 10) failed: No such file or directory [ 249.097755][ T8760] udevd[8760]: inotify_add_watch(7, /dev/loop6p7, 10) failed: No such file or directory [ 249.195411][T13679] rdma_op ffff888103e28d80 conn xmit_rdma 0000000000000000 [ 249.220832][T13683] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 249.220832][T13683] program syz.0.3556 not setting count and/or reply_len properly [ 249.241949][T13685] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3557'. [ 249.251006][T13685] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3557'. [ 249.303837][T13692] netlink: 'syz.1.3560': attribute type 10 has an invalid length. [ 249.320278][T13692] bond0: (slave dummy0): Releasing backup interface [ 249.330201][T13692] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.339193][T13692] team0: Failed to send options change via netlink (err -105) [ 249.346769][T13692] team0: Port device dummy0 added [ 249.353525][T13692] netlink: 'syz.1.3560': attribute type 10 has an invalid length. [ 249.361927][T13692] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.376086][T13692] team0: Failed to send options change via netlink (err -105) [ 249.384591][T13692] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.402923][T13692] team0: Port device dummy0 removed [ 249.411104][T13692] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 249.589162][T13702] netlink: 'syz.1.3565': attribute type 10 has an invalid length. [ 249.603416][T13702] bond0: (slave dummy0): Releasing backup interface [ 249.612813][T13702] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.622029][T13702] team0: Failed to send options change via netlink (err -105) [ 249.629590][T13702] team0: Port device dummy0 added [ 249.638979][T13702] netlink: 'syz.1.3565': attribute type 10 has an invalid length. [ 249.647381][T13702] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.670746][T13702] team0: Failed to send options change via netlink (err -105) [ 249.678425][T13702] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.687571][T13702] team0: Port device dummy0 removed [ 249.694645][T13702] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 249.780250][T13712] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 249.838913][T13718] netlink: 'syz.4.3573': attribute type 10 has an invalid length. [ 249.864611][T13718] bond0: (slave dummy0): Releasing backup interface [ 249.883307][T13718] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.895415][T13718] team0: Failed to send options change via netlink (err -105) [ 249.903019][T13718] team0: Port device dummy0 added [ 249.910731][T13723] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.922112][T13723] team0: Failed to send options change via netlink (err -105) [ 249.929896][T13723] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 249.938939][T13723] team0: Port device dummy0 removed [ 249.947238][T13723] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 250.037940][ T3502] hid-generic 0000:0000:0000.002D: unknown main item tag 0x0 [ 250.048073][T13730] rdma_op ffff88810371cd80 conn xmit_rdma 0000000000000000 [ 250.062953][ T3502] hid-generic 0000:0000:0000.002D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 250.218336][T13748] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 250.218336][T13748] program syz.4.3586 not setting count and/or reply_len properly [ 250.271272][T13752] bond0: (slave dummy0): Releasing backup interface [ 250.281188][T13752] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 250.290089][T13752] team0: Failed to send options change via netlink (err -105) [ 250.297791][T13752] team0: Port device dummy0 added [ 250.307347][T13752] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 250.319549][T13752] team0: Failed to send options change via netlink (err -105) [ 250.327442][T13752] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 250.336677][T13752] team0: Port device dummy0 removed [ 250.345066][T13752] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 250.397936][T13759] rdma_op ffff88810371d180 conn xmit_rdma 0000000000000000 [ 250.514257][T13769] loop4: detected capacity change from 0 to 1024 [ 250.522335][T13769] EXT4-fs: Ignoring removed nomblk_io_submit option [ 250.546534][T13769] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 250.559225][T13769] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 251.063923][T13785] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 251.169507][T13791] rdma_op ffff88810371d980 conn xmit_rdma 0000000000000000 [ 251.366717][T13807] bond0: (slave dummy0): Releasing backup interface [ 251.378219][T13807] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 251.395462][T13807] team0: Failed to send options change via netlink (err -105) [ 251.403236][T13807] team0: Port device dummy0 added [ 251.413756][T13807] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 251.423815][T13809] IPv6: Can't replace route, no match found [ 251.429930][T13807] team0: Failed to send options change via netlink (err -105) [ 251.449432][T13807] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 251.459946][T13767] syz.4.3595 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=1000 [ 251.468840][T13807] team0: Port device dummy0 removed [ 251.471063][T13767] CPU: 1 UID: 0 PID: 13767 Comm: syz.4.3595 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 251.471147][T13767] Tainted: [W]=WARN [ 251.471218][T13767] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 251.471245][T13767] Call Trace: [ 251.471262][T13767] [ 251.471274][T13767] __dump_stack+0x1d/0x30 [ 251.471305][T13767] dump_stack_lvl+0xe8/0x140 [ 251.471335][T13767] dump_stack+0x15/0x1b [ 251.471361][T13767] dump_header+0x81/0x220 [ 251.471406][T13767] oom_kill_process+0x342/0x400 [ 251.471446][T13767] out_of_memory+0x979/0xb80 [ 251.471489][T13767] try_charge_memcg+0x610/0xa10 [ 251.471610][T13767] charge_memcg+0x51/0xc0 [ 251.471638][T13767] mem_cgroup_swapin_charge_folio+0xcc/0x150 [ 251.471673][T13767] __read_swap_cache_async+0x17b/0x2d0 [ 251.471753][T13767] swap_cluster_readahead+0x362/0x3c0 [ 251.471809][T13767] swapin_readahead+0xde/0x800 [ 251.471858][T13767] ? mod_memcg_lruvec_state+0x1a1/0x280 [ 251.471900][T13767] ? __rcu_read_unlock+0x34/0x70 [ 251.471946][T13767] ? __rcu_read_unlock+0x4f/0x70 [ 251.471992][T13767] ? swap_cache_get_folio+0x277/0x280 [ 251.472107][T13767] do_swap_page+0x2ae/0x2370 [ 251.472139][T13767] ? css_rstat_updated+0xb7/0x240 [ 251.472246][T13767] ? __pfx_default_wake_function+0x10/0x10 [ 251.472305][T13767] handle_mm_fault+0x9a5/0x2be0 [ 251.472348][T13767] do_user_addr_fault+0x630/0x1080 [ 251.472444][T13767] exc_page_fault+0x62/0xa0 [ 251.472486][T13767] asm_exc_page_fault+0x26/0x30 [ 251.472516][T13767] RIP: 0033:0x7f7d1b13f8a8 [ 251.472620][T13767] Code: 0f 85 a4 01 00 00 85 ed 0f 84 d4 00 00 00 8b 43 28 41 be 01 00 00 00 eb 3f 66 0f 1f 84 00 00 00 00 00 be 08 00 00 00 48 89 df f3 95 fe ff 48 8b 53 38 48 8d 42 f8 48 89 43 38 8b 43 28 83 c0 [ 251.472646][T13767] RSP: 002b:00007ffcac13b9e0 EFLAGS: 00010246 [ 251.472668][T13767] RAX: 000000000001ab88 RBX: 00007f7d1bfe5720 RCX: 0000000000000000 [ 251.472687][T13767] RDX: 0000000000000890 RSI: 0000000000000008 RDI: 00007f7d1bfe5720 [ 251.472740][T13767] RBP: 0000000000000891 R08: 00007f7d1acc7060 R09: 00007f7d1b4a2000 [ 251.472758][T13767] R10: 00007f7d1acc7008 R11: 000000000000000d R12: ffffffff856ed94c [ 251.472816][T13767] R13: 00007f7d1b4b6038 R14: 0000000000000001 R15: fffffffffffe5478 [ 251.472836][T13767] ? xa_load+0xac/0xe0 [ 251.472892][T13767] [ 251.472908][T13767] memory: usage 307200kB, limit 307200kB, failcnt 2288 [ 251.478078][T13807] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 251.487852][T13767] memory+swap: usage 323796kB, limit 9007199254740988kB, failcnt 0 [ 251.487873][T13767] kmem: usage 238764kB, limit 9007199254740988kB, failcnt 0 [ 251.731004][T13767] Memory cgroup stats for /syz4: [ 251.731304][T13767] cache 70078464 [ 251.739819][T13767] rss 0 [ 251.742635][T13767] shmem 0 [ 251.745595][T13767] mapped_file 0 [ 251.749055][T13767] dirty 0 [ 251.752031][T13767] writeback 0 [ 251.755333][T13767] workingset_refault_anon 348 [ 251.760013][T13767] workingset_refault_file 4758 [ 251.764770][T13767] swap 16994304 [ 251.768320][T13767] swapcached 0 [ 251.771719][T13767] pgpgin 273866 [ 251.775197][T13767] pgpgout 256757 [ 251.778830][T13767] pgfault 304473 [ 251.782383][T13767] pgmajfault 259 [ 251.786018][T13767] inactive_anon 0 [ 251.789643][T13767] active_anon 0 [ 251.793145][T13767] inactive_file 0 [ 251.796781][T13767] active_file 0 [ 251.800262][T13767] unevictable 70078464 [ 251.804334][T13767] hierarchical_memory_limit 314572800 [ 251.809800][T13767] hierarchical_memsw_limit 9223372036854771712 [ 251.815984][T13767] total_cache 70078464 [ 251.820053][T13767] total_rss 0 [ 251.823333][T13767] total_shmem 0 [ 251.826826][T13767] total_mapped_file 0 [ 251.830820][T13767] total_dirty 0 [ 251.834280][T13767] total_writeback 0 [ 251.838180][T13767] total_workingset_refault_anon 348 [ 251.843381][T13767] total_workingset_refault_file 4758 [ 251.848709][T13767] total_swap 16994304 [ 251.852687][T13767] total_swapcached 0 [ 251.856592][T13767] total_pgpgin 273866 [ 251.860585][T13767] total_pgpgout 256757 [ 251.864717][T13767] total_pgfault 304473 [ 251.868889][T13767] total_pgmajfault 259 [ 251.873019][T13767] total_inactive_anon 0 [ 251.877289][T13767] total_active_anon 0 [ 251.881305][T13767] total_inactive_file 0 [ 251.885520][T13767] total_active_file 0 [ 251.889514][T13767] total_unevictable 70078464 [ 251.894105][T13767] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.3595,pid=13767,uid=0 [ 251.908971][T13767] Memory cgroup out of memory: Killed process 13767 (syz.4.3595) total-vm:96148kB, anon-rss:1136kB, file-rss:22596kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 251.982804][T13815] __nla_validate_parse: 11 callbacks suppressed [ 251.982825][T13815] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3616'. [ 252.046325][T13817] rdma_op ffff88816c214d80 conn xmit_rdma 0000000000000000 [ 252.183044][T13828] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3622'. [ 252.192117][T13828] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3622'. [ 252.238757][ T29] kauditd_printk_skb: 1356 callbacks suppressed [ 252.238841][ T29] audit: type=1326 audit(1764755615.811:15967): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13831 comm="syz.1.3624" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 252.271696][ T29] audit: type=1326 audit(1764755615.811:15968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13831 comm="syz.1.3624" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 252.276987][T13834] IPv6: Can't replace route, no match found [ 252.296004][ T29] audit: type=1326 audit(1764755615.841:15969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13831 comm="syz.1.3624" exe="/root/syz-executor" sig=0 arch=c000003e syscall=100 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 252.326377][ T29] audit: type=1326 audit(1764755615.841:15970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13831 comm="syz.1.3624" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 252.350055][ T29] audit: type=1326 audit(1764755615.841:15971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13831 comm="syz.1.3624" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 252.380203][T13836] bond0: (slave dummy0): Releasing backup interface [ 252.394624][T13836] team0: Port device dummy0 added [ 252.411134][ T29] audit: type=1400 audit(1764755615.981:15972): avc: denied { sys_module } for pid=13837 comm="syz.4.3627" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 252.433470][T13836] team0: Port device dummy0 removed [ 252.442227][T13836] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 252.449951][T13838] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3627'. [ 252.519278][T13848] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 252.603867][T13858] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 252.603867][T13858] program syz.6.3636 not setting count and/or reply_len properly [ 252.688179][ T29] audit: type=1400 audit(1764755616.261:15973): avc: denied { mounton } for pid=13865 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 252.741363][ T29] audit: type=1400 audit(1764755616.311:15974): avc: denied { ioctl } for pid=13869 comm="syz.6.3642" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=46417 ioctlcmd=0xf50e scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 252.856930][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3646'. [ 252.866385][ T29] audit: type=1326 audit(1764755616.421:15975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13889 comm="syz.4.3646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 252.890088][ T29] audit: type=1326 audit(1764755616.421:15976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=13889 comm="syz.4.3646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 252.957679][T13895] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 252.957679][T13895] program syz.6.3648 not setting count and/or reply_len properly [ 253.040731][T13903] rdma_op ffff888103cb7580 conn xmit_rdma 0000000000000000 [ 253.070639][T13905] bond0: (slave dummy0): Releasing backup interface [ 253.086383][T13905] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 253.207804][T13865] chnl_net:caif_netlink_parms(): no params data found [ 253.291054][T13926] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 253.291054][T13926] program syz.1.3661 not setting count and/or reply_len properly [ 253.319363][T13923] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3660'. [ 253.378443][T13934] rdma_op ffff8881481b8980 conn xmit_rdma 0000000000000000 [ 253.387341][T13865] bridge0: port 1(bridge_slave_0) entered blocking state [ 253.394471][T13865] bridge0: port 1(bridge_slave_0) entered disabled state [ 253.401785][T13865] bridge_slave_0: entered allmulticast mode [ 253.408748][T13865] bridge_slave_0: entered promiscuous mode [ 253.409758][T13865] bridge0: port 2(bridge_slave_1) entered blocking state [ 253.409796][T13865] bridge0: port 2(bridge_slave_1) entered disabled state [ 253.409905][T13865] bridge_slave_1: entered allmulticast mode [ 253.410475][T13865] bridge_slave_1: entered promiscuous mode [ 253.427107][T13865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 253.428559][T13865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 253.464568][T13865] team0: Port device team_slave_0 added [ 253.466132][T13865] team0: Port device team_slave_1 added [ 253.466426][T13940] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3666'. [ 253.482943][T13865] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 253.482961][T13865] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 253.483029][T13865] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 253.483478][T13942] validate_nla: 9 callbacks suppressed [ 253.483566][T13942] netlink: 'syz.0.3667': attribute type 10 has an invalid length. [ 253.483669][T13865] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 253.483691][T13865] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 253.483726][T13865] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 253.497334][T13944] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 253.497334][T13944] program syz.1.3668 not setting count and/or reply_len properly [ 253.540471][T13946] netlink: 'syz.0.3667': attribute type 10 has an invalid length. [ 253.560256][T13940] team0 (unregistering): Port device team_slave_0 removed [ 253.674155][T13940] team0 (unregistering): Port device team_slave_1 removed [ 253.743119][T13942] bond0: (slave dummy0): Releasing backup interface [ 253.795550][T13946] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 253.814495][T13953] loop1: detected capacity change from 0 to 2048 [ 253.829778][T13952] ip6gre2: entered promiscuous mode [ 253.835091][T13952] ip6gre2: entered allmulticast mode [ 253.864968][T13865] hsr_slave_0: entered promiscuous mode [ 253.876042][T13958] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3672'. [ 253.885338][T13958] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3672'. [ 253.910169][T13865] hsr_slave_1: entered promiscuous mode [ 253.924025][T13865] debugfs: 'hsr0' already exists in 'hsr' [ 253.929903][T13865] Cannot create hsr debugfs directory [ 253.935360][T13948] Set syz1 is full, maxelem 65536 reached [ 253.947727][T10433] Alternate GPT is invalid, using primary GPT. [ 253.954056][T10433] loop1: p2 p3 p7 [ 254.008501][T13966] IPv6: Can't replace route, no match found [ 254.016200][T13953] Alternate GPT is invalid, using primary GPT. [ 254.022664][T13953] loop1: p2 p3 p7 [ 254.030306][T13964] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3674'. [ 254.059124][T13968] netlink: 'syz.4.3676': attribute type 10 has an invalid length. [ 254.071354][T13968] bond0: (slave dummy0): Releasing backup interface [ 254.080752][T13968] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 254.091417][T13948] netlink: 'syz.1.3669': attribute type 3 has an invalid length. [ 254.091555][T13970] sg_write: data in/out 49276/1 bytes for SCSI command 0x6-- guessing data in; [ 254.091555][T13970] program syz.0.3677 not setting count and/or reply_len properly [ 254.103698][T13968] team0: Failed to send options change via netlink (err -105) [ 254.123994][T13968] team0: Port device dummy0 added [ 254.125752][T13971] netlink: 'syz.4.3676': attribute type 10 has an invalid length. [ 254.155937][ T3006] Alternate GPT is invalid, using primary GPT. [ 254.162472][ T3006] loop1: p2 p3 p7 [ 254.165417][T13865] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 254.180640][T13971] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 254.193568][T13971] team0: Failed to send options change via netlink (err -105) [ 254.203202][T13971] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 254.229161][T13971] team0: Port device dummy0 removed [ 254.248555][T10433] udevd[10433]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 254.265218][T13971] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 254.275599][ T8760] udevd[8760]: inotify_add_watch(7, /dev/loop1p7, 10) failed: No such file or directory [ 254.285504][T10134] udevd[10134]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 254.296069][T13865] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 254.312131][T13982] program syz.0.3681 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 254.334764][T13865] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 254.352469][T10433] udevd[10433]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 254.353351][ T8760] udevd[8760]: inotify_add_watch(7, /dev/loop1p7, 10) failed: No such file or directory [ 254.365008][T10134] udevd[10134]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 254.382370][T13865] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 254.406888][ T8760] udevd[8760]: inotify_add_watch(7, /dev/loop1p7, 10) failed: No such file or directory [ 254.407042][T10433] udevd[10433]: inotify_add_watch(7, /dev/loop1p2, 10) failed: No such file or directory [ 254.443184][T10134] udevd[10134]: inotify_add_watch(7, /dev/loop1p3, 10) failed: No such file or directory [ 254.503321][T13865] 8021q: adding VLAN 0 to HW filter on device bond0 [ 254.527412][T13865] 8021q: adding VLAN 0 to HW filter on device team0 [ 254.548226][ T2141] bridge0: port 1(bridge_slave_0) entered blocking state [ 254.555376][ T2141] bridge0: port 1(bridge_slave_0) entered forwarding state [ 254.568432][ T4416] bridge0: port 2(bridge_slave_1) entered blocking state [ 254.575737][ T4416] bridge0: port 2(bridge_slave_1) entered forwarding state [ 254.710225][T14016] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 254.725320][T13865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 254.811963][T14031] netlink: 'syz.1.3698': attribute type 10 has an invalid length. [ 254.832969][T14031] bond0: (slave dummy0): Releasing backup interface [ 254.843034][T14031] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 254.853716][T14031] team0: Failed to send options change via netlink (err -105) [ 254.861450][T14031] team0: Port device dummy0 added [ 254.867012][T14035] netlink: 'syz.1.3698': attribute type 10 has an invalid length. [ 254.881319][T14035] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 254.896210][T14035] team0: Failed to send options change via netlink (err -105) [ 254.910913][T14035] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 254.920108][T14035] team0: Port device dummy0 removed [ 254.928114][T14035] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 255.026516][T13865] veth0_vlan: entered promiscuous mode [ 255.035547][T13865] veth1_vlan: entered promiscuous mode [ 255.053021][T13865] veth0_macvtap: entered promiscuous mode [ 255.061992][T13865] veth1_macvtap: entered promiscuous mode [ 255.074559][T13865] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 255.087845][T13865] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 255.099595][ T2141] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.099639][ T2141] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.099728][ T2141] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.099784][ T2141] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 255.194306][T14059] netlink: 'syz.1.3704': attribute type 10 has an invalid length. [ 255.205525][T14060] loop7: detected capacity change from 0 to 1024 [ 255.219354][T14059] bond0: (slave dummy0): Releasing backup interface [ 255.237321][T14059] team0: Port device dummy0 added [ 255.243287][T14060] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 255.257162][T14059] netlink: 'syz.1.3704': attribute type 10 has an invalid length. [ 255.279418][T14059] team0: Port device dummy0 removed [ 255.291784][T14059] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 255.317847][T14067] IPv6: Can't replace route, no match found [ 255.357683][T14072] loop6: detected capacity change from 0 to 512 [ 255.396885][T14072] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 255.443463][T14072] ext4 filesystem being mounted at /565/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 255.629824][T14098] IPv6: Can't replace route, no match found [ 255.687360][T14097] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 255.858512][T14109] loop1: detected capacity change from 0 to 1024 [ 255.914818][T14109] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 256.223190][ T6430] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 256.282772][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 256.345790][T14133] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 256.355381][T14131] IPv6: Can't replace route, no match found [ 256.458109][T14143] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=14143 comm=syz.0.3731 [ 256.520429][T14145] 9pnet: Could not find request transport: tcp0/ . %+ [ 256.603339][T14152] netlink: 'syz.0.3738': attribute type 10 has an invalid length. [ 256.615141][T14152] bond0: (slave dummy0): Releasing backup interface [ 256.637262][T14152] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 256.734567][T14161] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 256.789922][T14167] bond0: (slave dummy0): Releasing backup interface [ 256.800797][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 256.810205][T14167] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 257.032685][T14194] bond0: (slave dummy0): Releasing backup interface [ 257.057657][T14194] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 257.069175][T14198] __nla_validate_parse: 12 callbacks suppressed [ 257.069195][T14198] netlink: 444 bytes leftover after parsing attributes in process `syz.4.3757'. [ 257.088972][T14198] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3757'. [ 257.110092][T14200] loop1: detected capacity change from 0 to 2048 [ 257.130917][T14200] EXT4-fs (loop1): failed to initialize system zone (-117) [ 257.139713][T14200] EXT4-fs (loop1): mount failed [ 257.147862][T14205] IPv6: Can't replace route, no match found [ 257.256225][T14211] loop7: detected capacity change from 0 to 164 [ 257.262985][T14211] iso9660: Unknown parameter '€' [ 257.268909][T14211] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3761'. [ 257.840965][T14215] gre1: entered allmulticast mode [ 257.851368][ T29] kauditd_printk_skb: 649 callbacks suppressed [ 257.851421][ T29] audit: type=1400 audit(1764755621.421:16624): avc: denied { create } for pid=14214 comm="syz.6.3762" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 257.856021][T14215] syzkaller0: entered allmulticast mode [ 257.858728][ T29] audit: type=1400 audit(1764755621.421:16625): avc: denied { ioctl } for pid=14214 comm="syz.6.3762" path="socket:[47088]" dev="sockfs" ino=47088 ioctlcmd=0x89a0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 257.878318][T14215] syzkaller0: entered promiscuous mode [ 257.883416][ T29] audit: type=1400 audit(1764755621.421:16626): avc: denied { setopt } for pid=14214 comm="syz.6.3762" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 257.950996][T14215] syzkaller0 (unregistering): left allmulticast mode [ 257.957865][T14215] syzkaller0 (unregistering): left promiscuous mode [ 257.969900][T14221] loop1: detected capacity change from 0 to 512 [ 258.001054][T14221] Quota error (device loop1): v2_read_file_info: Free block number 1 out of range (1, 6). [ 258.032400][T14221] EXT4-fs warning (device loop1): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 258.057201][T14221] EXT4-fs (loop1): mount failed [ 258.062653][ T29] audit: type=1400 audit(1764755621.631:16627): avc: denied { write } for pid=14228 comm="syz.0.3767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 258.137487][T14221] loop1: detected capacity change from 0 to 512 [ 258.176760][T14221] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 258.198161][T14241] IPv6: Can't replace route, no match found [ 258.206026][T14221] ext4 filesystem being mounted at /149/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 258.212176][ T29] audit: type=1400 audit(1764755621.781:16628): avc: denied { mount } for pid=14220 comm="syz.1.3764" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 258.281090][T14243] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3772'. [ 258.283045][ T29] audit: type=1400 audit(1764755621.801:16629): avc: denied { add_name } for pid=14220 comm="syz.1.3764" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 258.311391][ T29] audit: type=1400 audit(1764755621.801:16630): avc: denied { create } for pid=14220 comm="syz.1.3764" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 258.331956][ T29] audit: type=1400 audit(1764755621.801:16631): avc: denied { read write } for pid=14220 comm="syz.1.3764" name="file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 258.355026][ T29] audit: type=1400 audit(1764755621.801:16632): avc: denied { open } for pid=14220 comm="syz.1.3764" path="/149/file1/file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 258.416832][T14247] 9pnet: Could not find request transport: tcp0/ . %+ [ 258.460432][T14253] 9pnet: Could not find request transport: tcp0/ . %+ [ 258.897462][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 259.013051][T14272] IPv6: Can't replace route, no match found [ 259.051094][T14274] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3785'. [ 259.117367][T14284] FAULT_INJECTION: forcing a failure. [ 259.117367][T14284] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 259.130104][T14282] 9pnet: Could not find request transport: tcp0/ . %+ [ 259.131036][T14284] CPU: 1 UID: 0 PID: 14284 Comm: syz.1.3789 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 259.131083][T14284] Tainted: [W]=WARN [ 259.131094][T14284] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 259.131152][T14284] Call Trace: [ 259.131162][T14284] [ 259.131175][T14284] __dump_stack+0x1d/0x30 [ 259.131206][T14284] dump_stack_lvl+0xe8/0x140 [ 259.131238][T14284] dump_stack+0x15/0x1b [ 259.131262][T14284] should_fail_ex+0x265/0x280 [ 259.131291][T14284] should_fail_alloc_page+0xf2/0x100 [ 259.131397][T14284] __alloc_frozen_pages_noprof+0xff/0x360 [ 259.131447][T14284] alloc_pages_mpol+0xb3/0x260 [ 259.131494][T14284] ? anon_pipe_write+0x21/0xb30 [ 259.131602][T14284] alloc_pages_noprof+0x90/0x130 [ 259.131629][T14284] anon_pipe_write+0x6a1/0xb30 [ 259.131665][T14284] ? anon_pipe_write+0x21/0xb30 [ 259.131770][T14284] ? __pfx_anon_pipe_write+0x10/0x10 [ 259.131869][T14284] vfs_write+0x52a/0x960 [ 259.131913][T14284] ksys_write+0xda/0x1a0 [ 259.131973][T14284] __x64_sys_write+0x40/0x50 [ 259.132005][T14284] x64_sys_call+0x2847/0x3000 [ 259.132038][T14284] do_syscall_64+0xd8/0x2a0 [ 259.132151][T14284] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.132181][T14284] RIP: 0033:0x7f1db91df749 [ 259.132203][T14284] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 259.132295][T14284] RSP: 002b:00007f1db7c47038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 259.132322][T14284] RAX: ffffffffffffffda RBX: 00007f1db9435fa0 RCX: 00007f1db91df749 [ 259.132340][T14284] RDX: 00000000fffffecc RSI: 0000200000000000 RDI: 0000000000000007 [ 259.132357][T14284] RBP: 00007f1db7c47090 R08: 0000000000000000 R09: 0000000000000000 [ 259.132376][T14284] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 259.132428][T14284] R13: 00007f1db9436038 R14: 00007f1db9435fa0 R15: 00007ffcd75d7528 [ 259.132457][T14284] [ 259.145280][T14284] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=14284 comm=syz.1.3789 [ 259.212967][ T3502] hid-generic 0000:0000:0000.002E: unknown main item tag 0x0 [ 259.356662][ T3502] hid-generic 0000:0000:0000.002E: hidraw0: HID v0.00 Device [syz1] on syz0 [ 259.448348][T14292] fido_id[14292]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 259.507414][T14301] validate_nla: 5 callbacks suppressed [ 259.507435][T14301] netlink: 'syz.4.3797': attribute type 10 has an invalid length. [ 259.568875][T14301] bond0: (slave dummy0): Releasing backup interface [ 259.578226][T14301] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 259.587690][T14301] team0: Failed to send options change via netlink (err -105) [ 259.595210][T14301] team0: Port device dummy0 added [ 259.624331][T14305] netlink: 'syz.4.3797': attribute type 10 has an invalid length. [ 259.661151][T14305] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 259.671292][T14309] netlink: 'syz.7.3799': attribute type 10 has an invalid length. [ 259.682446][T14305] team0: Failed to send options change via netlink (err -105) [ 259.690361][T14305] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 259.700071][T14305] team0: Port device dummy0 removed [ 259.708405][T14305] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 259.721819][T14309] team0: Port device dummy0 added [ 259.733526][T14309] netlink: 'syz.7.3799': attribute type 10 has an invalid length. [ 259.784689][T14309] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 259.829433][T14314] loop4: detected capacity change from 0 to 1024 [ 259.842773][T14309] team0: Failed to send options change via netlink (err -105) [ 259.877846][T14309] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 259.922968][T14309] team0: Port device dummy0 removed [ 259.971147][T14309] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 259.992020][T14314] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 260.138131][ T3502] hid-generic 0000:0000:0000.002F: unknown main item tag 0x0 [ 260.147422][ T3502] hid-generic 0000:0000:0000.002F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 260.181180][T14329] loop7: detected capacity change from 0 to 512 [ 260.228148][T14329] EXT4-fs (loop7): 1 orphan inode deleted [ 260.259641][ T8068] EXT4-fs error (device loop7): ext4_release_dquot:6981: comm kworker/u8:30: Failed to release dquot type 1 [ 260.265832][T14329] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 260.364755][T14329] ext4 filesystem being mounted at /15/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 260.481290][T14311] Set syz1 is full, maxelem 65536 reached [ 260.523185][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 260.670074][T14346] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 260.754072][T14353] loop7: detected capacity change from 0 to 1024 [ 260.766252][T14349] 9pnet: Could not find request transport: tcp0/ . %+ [ 260.774825][T14353] EXT4-fs: Ignoring removed orlov option [ 260.800891][T14353] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 260.814221][T14353] FAULT_INJECTION: forcing a failure. [ 260.814221][T14353] name failslab, interval 1, probability 0, space 0, times 0 [ 260.826951][T14353] CPU: 1 UID: 0 PID: 14353 Comm: syz.7.3814 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 260.827064][T14353] Tainted: [W]=WARN [ 260.827074][T14353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 260.827091][T14353] Call Trace: [ 260.827102][T14353] [ 260.827113][T14353] __dump_stack+0x1d/0x30 [ 260.827143][T14353] dump_stack_lvl+0xe8/0x140 [ 260.827171][T14353] dump_stack+0x15/0x1b [ 260.827204][T14353] should_fail_ex+0x265/0x280 [ 260.827232][T14353] should_failslab+0x8c/0xb0 [ 260.827267][T14353] kmem_cache_alloc_noprof+0x50/0x480 [ 260.827302][T14353] ? alloc_empty_file+0x76/0x200 [ 260.827377][T14353] alloc_empty_file+0x76/0x200 [ 260.827420][T14353] path_openat+0x63/0x23b0 [ 260.827447][T14353] ? bpf_bprintf_prepare+0xc3d/0xd20 [ 260.827487][T14353] ? _parse_integer_limit+0x170/0x190 [ 260.827604][T14353] ? _parse_integer+0x27/0x40 [ 260.827638][T14353] ? kstrtoull+0x111/0x140 [ 260.827670][T14353] ? kstrtouint+0x76/0xc0 [ 260.827748][T14353] do_filp_open+0x109/0x230 [ 260.827915][T14353] do_sys_openat2+0xa6/0x150 [ 260.827953][T14353] __x64_sys_openat+0xf2/0x120 [ 260.828057][T14353] x64_sys_call+0x2b07/0x3000 [ 260.828088][T14353] do_syscall_64+0xd8/0x2a0 [ 260.828194][T14353] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.828224][T14353] RIP: 0033:0x7fce2bbaf749 [ 260.828244][T14353] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 260.828269][T14353] RSP: 002b:00007fce2a617038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 260.828295][T14353] RAX: ffffffffffffffda RBX: 00007fce2be05fa0 RCX: 00007fce2bbaf749 [ 260.828320][T14353] RDX: 0000000000000042 RSI: 0000200000000400 RDI: ffffffffffffff9c [ 260.828337][T14353] RBP: 00007fce2a617090 R08: 0000000000000000 R09: 0000000000000000 [ 260.828354][T14353] R10: 0000000000000061 R11: 0000000000000246 R12: 0000000000000001 [ 260.828393][T14353] R13: 00007fce2be06038 R14: 00007fce2be05fa0 R15: 00007ffda4f39e08 [ 260.828450][T14353] [ 261.043842][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.128673][T14362] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 261.182778][T14366] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 261.237095][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.284755][T14372] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3820'. [ 261.293929][T14372] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3820'. [ 261.343939][T14380] loop1: detected capacity change from 0 to 512 [ 261.351335][T14380] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 261.372536][T14380] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 261.396658][T14380] ext4 filesystem being mounted at /164/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 261.407942][T14384] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 261.447448][T14380] EXT4-fs error (device loop1): ext4_lookup:1787: inode #12: comm syz.1.3824: iget: bad i_size value: 2533274857506816 [ 261.487858][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.516631][ T3502] hid-generic 0000:0000:0000.0030: unknown main item tag 0x0 [ 261.535303][ T3502] hid-generic 0000:0000:0000.0030: hidraw0: HID v0.00 Device [syz1] on syz0 [ 261.631845][T14392] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 261.708024][T14396] netlink: 'syz.1.3830': attribute type 10 has an invalid length. [ 261.725877][T14396] bond0: (slave dummy0): Releasing backup interface [ 261.735311][T14396] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 261.744136][T14396] team0: Failed to send options change via netlink (err -105) [ 261.751688][T14396] team0: Port device dummy0 added [ 261.759234][T14396] netlink: 'syz.1.3830': attribute type 10 has an invalid length. [ 261.768141][T14396] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 261.779425][T14396] team0: Failed to send options change via netlink (err -105) [ 261.793508][T14396] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 261.802552][T14396] team0: Port device dummy0 removed [ 261.810704][T14396] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 261.843012][T14398] netlink: 'syz.1.3831': attribute type 10 has an invalid length. [ 261.860538][T14398] bond0: (slave dummy0): Releasing backup interface [ 261.870470][T14398] team0: Port device dummy0 added [ 261.877721][T14398] netlink: 'syz.1.3831': attribute type 10 has an invalid length. [ 261.895902][T14398] team0: Port device dummy0 removed [ 261.903455][T14398] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 262.010590][T14410] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3836'. [ 262.053762][T14413] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3838'. [ 262.063420][T14415] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3839'. [ 262.098789][T14417] FAULT_INJECTION: forcing a failure. [ 262.098789][T14417] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.112203][T14417] CPU: 1 UID: 0 PID: 14417 Comm: syz.7.3840 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 262.112241][T14417] Tainted: [W]=WARN [ 262.112250][T14417] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 262.112275][T14417] Call Trace: [ 262.112283][T14417] [ 262.112292][T14417] __dump_stack+0x1d/0x30 [ 262.112330][T14417] dump_stack_lvl+0xe8/0x140 [ 262.112357][T14417] dump_stack+0x15/0x1b [ 262.112388][T14417] should_fail_ex+0x265/0x280 [ 262.112411][T14417] should_fail+0xb/0x20 [ 262.112429][T14417] should_fail_usercopy+0x1a/0x20 [ 262.112451][T14417] _copy_from_iter+0xcf/0xe70 [ 262.112550][T14417] ? __build_skb_around+0x164/0x1c0 [ 262.112595][T14417] ? __alloc_skb+0x223/0x320 [ 262.112641][T14417] netlink_sendmsg+0x471/0x6b0 [ 262.112666][T14417] ? __pfx_netlink_sendmsg+0x10/0x10 [ 262.112690][T14417] __sock_sendmsg+0x145/0x180 [ 262.112729][T14417] ____sys_sendmsg+0x31e/0x4a0 [ 262.112763][T14417] ___sys_sendmsg+0x17b/0x1d0 [ 262.112810][T14417] __x64_sys_sendmsg+0xd4/0x160 [ 262.112846][T14417] x64_sys_call+0x17ba/0x3000 [ 262.112908][T14417] do_syscall_64+0xd8/0x2a0 [ 262.112945][T14417] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.112974][T14417] RIP: 0033:0x7fce2bbaf749 [ 262.112991][T14417] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 262.113075][T14417] RSP: 002b:00007fce2a617038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 262.113096][T14417] RAX: ffffffffffffffda RBX: 00007fce2be05fa0 RCX: 00007fce2bbaf749 [ 262.113110][T14417] RDX: 0000000000000000 RSI: 0000200000001540 RDI: 0000000000000009 [ 262.113139][T14417] RBP: 00007fce2a617090 R08: 0000000000000000 R09: 0000000000000000 [ 262.113199][T14417] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 262.113295][T14417] R13: 00007fce2be06038 R14: 00007fce2be05fa0 R15: 00007ffda4f39e08 [ 262.113318][T14417] [ 262.317982][T14421] netlink: 'syz.0.3842': attribute type 1 has an invalid length. [ 262.342889][T14425] netlink: 'syz.4.3844': attribute type 10 has an invalid length. [ 262.364308][T14421] bond1: entered promiscuous mode [ 262.369543][T14421] bond1: entered allmulticast mode [ 262.377697][T14425] bond0: (slave dummy0): Releasing backup interface [ 262.386712][T14429] FAULT_INJECTION: forcing a failure. [ 262.386712][T14429] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 262.400007][T14429] CPU: 1 UID: 0 PID: 14429 Comm: syz.7.3845 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 262.400111][T14429] Tainted: [W]=WARN [ 262.400117][T14429] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 262.400129][T14429] Call Trace: [ 262.400136][T14429] [ 262.400144][T14429] __dump_stack+0x1d/0x30 [ 262.400211][T14429] dump_stack_lvl+0xe8/0x140 [ 262.400266][T14429] dump_stack+0x15/0x1b [ 262.400300][T14429] should_fail_ex+0x265/0x280 [ 262.400319][T14429] should_fail+0xb/0x20 [ 262.400334][T14429] should_fail_usercopy+0x1a/0x20 [ 262.400353][T14429] _copy_from_user+0x1c/0xb0 [ 262.400392][T14429] __sys_sendto+0x19e/0x330 [ 262.400417][T14429] __x64_sys_sendto+0x76/0x90 [ 262.400436][T14429] x64_sys_call+0x29a7/0x3000 [ 262.400512][T14429] do_syscall_64+0xd8/0x2a0 [ 262.400620][T14429] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.400639][T14429] RIP: 0033:0x7fce2bbaf749 [ 262.400653][T14429] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 262.400669][T14429] RSP: 002b:00007fce2a617038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 262.400686][T14429] RAX: ffffffffffffffda RBX: 00007fce2be05fa0 RCX: 00007fce2bbaf749 [ 262.400697][T14429] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000006 [ 262.400750][T14429] RBP: 00007fce2a617090 R08: 0000200000000140 R09: 000000000000001c [ 262.400762][T14429] R10: 000000002000c851 R11: 0000000000000246 R12: 0000000000000001 [ 262.400773][T14429] R13: 00007fce2be06038 R14: 00007fce2be05fa0 R15: 00007ffda4f39e08 [ 262.400790][T14429] [ 262.403598][T14425] team0: Port device dummy0 added [ 262.561188][T14433] xt_hashlimit: max too large, truncated to 1048576 [ 262.585430][T14421] bond0: (slave dummy0): Releasing backup interface [ 262.599620][T14421] bond1: (slave dummy0): making interface the new active one [ 262.607327][T14421] dummy0: entered promiscuous mode [ 262.614776][T14421] dummy0: entered allmulticast mode [ 262.621277][T14421] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 262.634049][T14430] team0: Port device dummy0 removed [ 262.643984][T14430] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 262.704513][T14445] __nla_validate_parse: 1 callbacks suppressed [ 262.704528][T14445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3850'. [ 262.782383][T14451] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3853'. [ 262.791602][T14451] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3853'. [ 262.851567][T14459] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 262.885272][ T29] kauditd_printk_skb: 667 callbacks suppressed [ 262.885291][ T29] audit: type=1400 audit(1764755626.461:17296): avc: denied { ioctl } for pid=14464 comm="syz.4.3860" path="socket:[48621]" dev="sockfs" ino=48621 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 262.930569][ T29] audit: type=1400 audit(1764755626.461:17297): avc: denied { sys_module } for pid=14464 comm="syz.4.3860" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 262.970081][ T29] audit: type=1326 audit(1764755626.541:17298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 262.996537][ T29] audit: type=1326 audit(1764755626.571:17299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.008539][T14470] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3861'. [ 263.020639][ T29] audit: type=1326 audit(1764755626.571:17300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.053177][ T29] audit: type=1326 audit(1764755626.571:17301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.076841][ T29] audit: type=1326 audit(1764755626.571:17302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.100358][ T29] audit: type=1326 audit(1764755626.571:17303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.124160][ T29] audit: type=1326 audit(1764755626.571:17304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.147936][ T29] audit: type=1326 audit(1764755626.571:17305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14468 comm="syz.1.3861" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 263.202585][T14474] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.236161][T14480] loop4: detected capacity change from 0 to 512 [ 263.243380][T14480] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 263.256238][T14480] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.3865: invalid indirect mapped block 4294967295 (level 0) [ 263.271632][T14480] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.3865: invalid indirect mapped block 4294967295 (level 1) [ 263.286856][T14480] EXT4-fs (loop4): 1 orphan inode deleted [ 263.292637][T14480] EXT4-fs (loop4): 1 truncate cleaned up [ 263.298931][T14480] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 263.312725][T14474] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.349695][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 263.373276][T14474] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.430558][T14474] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 263.528319][T14499] program syz.4.3873 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 263.537994][ T31] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.551599][T14500] loop7: detected capacity change from 0 to 512 [ 263.558407][ T31] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.570002][ T31] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.580575][T14500] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 263.593221][ T31] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 263.601552][T14500] ext4 filesystem being mounted at /31/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 263.612567][T14500] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 263.917817][T14523] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3883'. [ 263.927053][T14523] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3883'. [ 264.113814][T14537] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 264.149930][T14540] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 264.194746][T14545] loop6: detected capacity change from 0 to 1024 [ 264.216857][T14545] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 264.240790][T14549] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3894'. [ 264.250019][T14549] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3894'. [ 264.378679][T14556] bond0: (slave dummy0): Releasing backup interface [ 264.425116][T14556] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 264.455014][T14556] team0: Failed to send options change via netlink (err -105) [ 264.462534][T14556] team0: Port device dummy0 added [ 264.496479][T14564] IPv6: Can't replace route, no match found [ 264.526759][T14558] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 264.562981][T14558] team0: Failed to send options change via netlink (err -105) [ 264.598362][T14572] loop7: detected capacity change from 0 to 1024 [ 264.606183][T14558] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 264.620069][T14558] team0: Port device dummy0 removed [ 264.636459][T14572] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 264.637760][T14558] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 264.698290][T14567] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 264.792450][T14580] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3905'. [ 264.801540][T14580] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3905'. [ 264.944403][T14586] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 264.953320][T14588] validate_nla: 3 callbacks suppressed [ 264.953340][T14588] netlink: 'syz.1.3909': attribute type 10 has an invalid length. [ 265.002301][T14588] bond0: (slave dummy0): Releasing backup interface [ 265.004268][T14591] netlink: 'syz.1.3909': attribute type 10 has an invalid length. [ 265.018779][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.030528][T14588] team0: Port device dummy0 added [ 265.080716][T14591] team0: Port device dummy0 removed [ 265.096461][T14591] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 265.183872][ T6430] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 265.434167][T14624] netlink: 'syz.1.3924': attribute type 10 has an invalid length. [ 265.466798][T14624] bond0: (slave dummy0): Releasing backup interface [ 265.477633][T14624] team0: Port device dummy0 added [ 265.494937][T14624] netlink: 'syz.1.3924': attribute type 10 has an invalid length. [ 265.515977][T14624] team0: Port device dummy0 removed [ 265.522961][T14624] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 265.729567][ T8068] bridge_slave_1: left allmulticast mode [ 265.735327][ T8068] bridge_slave_1: left promiscuous mode [ 265.741162][ T8068] bridge0: port 2(bridge_slave_1) entered disabled state [ 265.744554][T14640] loop1: detected capacity change from 0 to 8192 [ 265.755370][ T8068] bridge_slave_0: left allmulticast mode [ 265.761161][ T8068] bridge_slave_0: left promiscuous mode [ 265.765734][T14640] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 265.766939][ T8068] bridge0: port 1(bridge_slave_0) entered disabled state [ 265.839192][ T8068] dvmrp1 (unregistering): left allmulticast mode [ 265.879993][ T8068] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 265.930203][ T8068] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 265.940285][ T8068] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 265.956832][ T8068] bond0 (unregistering): Released all slaves [ 265.980374][ T8068] bond1 (unregistering): Released all slaves [ 265.999889][T14617] chnl_net:caif_netlink_parms(): no params data found [ 266.042084][ T8068] tipc: Left network mode [ 266.124607][ T8068] hsr_slave_0: left promiscuous mode [ 266.127518][ T9] hid-generic 0000:0000:0000.0031: unknown main item tag 0x0 [ 266.137921][ T8068] hsr_slave_1: left promiscuous mode [ 266.143717][ T8068] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 266.148545][ T9] hid-generic 0000:0000:0000.0031: hidraw0: HID v0.00 Device [syz1] on syz0 [ 266.165519][ T8068] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 266.260985][T14617] bridge0: port 1(bridge_slave_0) entered blocking state [ 266.268179][T14617] bridge0: port 1(bridge_slave_0) entered disabled state [ 266.285136][T14617] bridge_slave_0: entered allmulticast mode [ 266.292115][T14617] bridge_slave_0: entered promiscuous mode [ 266.305627][T14617] bridge0: port 2(bridge_slave_1) entered blocking state [ 266.312864][T14617] bridge0: port 2(bridge_slave_1) entered disabled state [ 266.321282][T14617] bridge_slave_1: entered allmulticast mode [ 266.328166][T14617] bridge_slave_1: entered promiscuous mode [ 266.350682][T14670] loop7: detected capacity change from 0 to 512 [ 266.357525][T14670] journal_path: Non-blockdev passed as './bus' [ 266.363723][T14670] EXT4-fs: error: could not find journal device path [ 266.384226][T14617] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 266.407899][T14617] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 266.439313][T14670] team0 (unregistering): Port device team_slave_0 removed [ 266.457360][T14670] team0 (unregistering): Port device team_slave_1 removed [ 266.500078][ T8068] IPVS: stop unused estimator thread 0... [ 266.536908][T14617] team0: Port device team_slave_0 added [ 266.543975][T14617] team0: Port device team_slave_1 added [ 266.581524][T14617] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 266.588600][T14617] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 266.614659][T14617] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 266.627138][T14617] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 266.634123][T14617] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 266.660118][T14617] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 266.708221][T14617] hsr_slave_0: entered promiscuous mode [ 266.719284][T14617] hsr_slave_1: entered promiscuous mode [ 266.729626][T14680] loop7: detected capacity change from 0 to 512 [ 266.758382][T14680] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 266.775885][T14680] ext4 filesystem being mounted at /45/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 266.795980][T14680] EXT4-fs error (device loop7): ext4_lookup:1787: inode #12: comm syz.7.3942: iget: bad i_size value: 2533274857506816 [ 266.809788][T14680] EXT4-fs error (device loop7): ext4_lookup:1787: inode #12: comm syz.7.3942: iget: bad i_size value: 2533274857506816 [ 266.873351][ T3617] hid-generic 0000:0000:0000.0032: unknown main item tag 0x0 [ 266.893031][ T3617] hid-generic 0000:0000:0000.0032: hidraw0: HID v0.00 Device [syz1] on syz0 [ 266.949698][T14698] netlink: 'syz.1.3947': attribute type 10 has an invalid length. [ 266.969748][T14698] bond0: (slave dummy0): Releasing backup interface [ 266.979592][T14698] team0: Port device dummy0 added [ 266.989008][T14698] netlink: 'syz.1.3947': attribute type 10 has an invalid length. [ 267.007916][T14698] team0: Port device dummy0 removed [ 267.024013][T14698] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 267.087925][T14617] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 267.096945][T14617] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 267.107659][T14706] loop1: detected capacity change from 0 to 128 [ 267.108241][T14617] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 267.127273][T14706] veth0: entered promiscuous mode [ 267.132531][T14617] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 267.205879][T14617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 267.219064][T14617] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.228988][ T8100] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.236158][ T8100] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.248222][ T8059] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.255376][ T8059] bridge0: port 2(bridge_slave_1) entered forwarding state [ 267.371100][T14617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 267.568569][ T3617] hid-generic 0000:0000:0000.0033: unknown main item tag 0x0 [ 267.595852][ T3617] hid-generic 0000:0000:0000.0033: hidraw0: HID v0.00 Device [syz1] on syz0 [ 267.615349][T14617] veth0_vlan: entered promiscuous mode [ 267.633322][T14617] veth1_vlan: entered promiscuous mode [ 267.663654][T14617] veth0_macvtap: entered promiscuous mode [ 267.674446][T14617] veth1_macvtap: entered promiscuous mode [ 267.694395][T14617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 267.708186][T14617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 267.722724][ T1456] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.736317][ T1456] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.755098][ T1456] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.764126][ T1456] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 267.790900][T14754] netlink: 'syz.6.3921': attribute type 10 has an invalid length. [ 267.802926][T14754] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 267.816317][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 267.860010][T14758] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 267.872185][T14760] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 267.931658][ T29] kauditd_printk_skb: 423 callbacks suppressed [ 267.931737][ T29] audit: type=1400 audit(1764755631.501:17729): avc: denied { read write } for pid=14763 comm="syz.6.3961" name="rdma_cm" dev="devtmpfs" ino=252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 267.964557][T14766] loop4: detected capacity change from 0 to 1024 [ 267.981913][T14762] IPv6: Can't replace route, no match found [ 268.015826][T14766] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 268.048328][ T29] audit: type=1400 audit(1764755631.501:17730): avc: denied { open } for pid=14763 comm="syz.6.3961" path="/dev/infiniband/rdma_cm" dev="devtmpfs" ino=252 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:infiniband_device_t tclass=chr_file permissive=1 [ 268.075357][ T29] audit: type=1400 audit(1764755631.551:17731): avc: denied { write } for pid=14763 comm="syz.6.3961" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 268.099359][ T29] audit: type=1400 audit(1764755631.611:17732): avc: denied { read } for pid=14763 comm="syz.6.3961" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 268.152990][T14774] netlink: 'syz.7.3965': attribute type 10 has an invalid length. [ 268.163774][T14774] bond0: (slave dummy0): Releasing backup interface [ 268.172914][T14774] netlink: 'syz.7.3965': attribute type 10 has an invalid length. [ 268.184181][T14774] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 268.264212][T14778] IPv6: Can't replace route, no match found [ 268.349575][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 268.360985][T14787] loop7: detected capacity change from 0 to 1024 [ 268.387047][T14789] loop1: detected capacity change from 0 to 1024 [ 268.409690][T14791] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 268.432602][T14789] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 268.459023][T14797] IPv6: Can't replace route, no match found [ 268.485313][T14789] ext4 filesystem being mounted at /211/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 268.515979][ T29] audit: type=1326 audit(1764755632.081:17733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14799 comm="syz.4.3975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 268.540019][ T29] audit: type=1326 audit(1764755632.081:17734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14799 comm="syz.4.3975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 268.564592][ T29] audit: type=1326 audit(1764755632.081:17735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14799 comm="syz.4.3975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=240 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 268.588595][ T29] audit: type=1326 audit(1764755632.081:17736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14799 comm="syz.4.3975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 268.612806][ T29] audit: type=1326 audit(1764755632.081:17737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14799 comm="syz.4.3975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 268.636565][ T29] audit: type=1326 audit(1764755632.081:17738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=14799 comm="syz.4.3975" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 268.661685][T14800] __nla_validate_parse: 4 callbacks suppressed [ 268.661700][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3975'. [ 268.679724][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 268.693203][ T3502] hid-generic 0000:0000:0000.0034: unknown main item tag 0x0 [ 268.703128][ T3502] hid-generic 0000:0000:0000.0034: hidraw0: HID v0.00 Device [syz1] on syz0 [ 268.860622][T14812] 9pnet: Could not find request transport: tcp0/ . %+ [ 268.886030][T14820] loop6: detected capacity change from 0 to 1024 [ 268.915660][T14820] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 268.949881][T14826] IPv6: Can't replace route, no match found [ 268.975137][T14828] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 269.103583][T14840] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 269.213848][T14851] loop7: detected capacity change from 0 to 512 [ 269.227089][T14851] EXT4-fs (loop7): feature flags set on rev 0 fs, running e2fsck is recommended [ 269.248525][T14854] IPv6: Can't replace route, no match found [ 269.260371][T14851] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=42c028, mo2=0002] [ 269.280688][T14851] EXT4-fs (loop7): orphan cleanup on readonly fs [ 269.288545][T14851] EXT4-fs error (device loop7): ext4_mb_mark_diskspace_used:4193: comm syz.7.3996: Allocating blocks 41-42 which overlap fs metadata [ 269.303403][T14851] EXT4-fs (loop7): Remounting filesystem read-only [ 269.303645][T14617] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 269.319898][T14851] EXT4-fs (loop7): 1 truncate cleaned up [ 269.326822][T14851] EXT4-fs (loop7): pa ffff888106da9ee0: logic 1, phys. 41, len 23 [ 269.329868][T14857] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 269.336240][T14851] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 269.355282][T14851] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 269.396649][T14859] program syz.6.3999 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 269.456083][T14869] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 269.472024][T14870] SELinux: Context system_u:object_r:restorecond_exec_t:s0 is not valid (left unmapped). [ 269.597959][T14882] IPv6: Can't replace route, no match found [ 269.642971][T14886] netlink: 'syz.4.4011': attribute type 10 has an invalid length. [ 269.657195][T14886] bond0: (slave dummy0): Releasing backup interface [ 269.668142][T14886] team0: Port device dummy0 added [ 269.677990][T14888] bond0: (slave dummy0): Releasing backup interface [ 269.691898][T14886] team0: Port device dummy0 removed [ 269.708504][T14886] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 269.721443][T14888] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 269.768857][T14898] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 269.854517][T14902] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 269.933669][T14902] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.010295][T14902] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.025142][T14922] validate_nla: 3 callbacks suppressed [ 270.025157][T14922] netlink: 'syz.0.4027': attribute type 10 has an invalid length. [ 270.040187][T14922] bond1: (slave dummy0): Releasing active interface [ 270.047447][T14922] dummy0: left promiscuous mode [ 270.052576][T14922] dummy0: left allmulticast mode [ 270.058945][T14922] netlink: 'syz.0.4027': attribute type 10 has an invalid length. [ 270.076145][T14902] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 270.090807][T14922] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 270.145779][ T8059] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.158107][ T8059] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.170679][ T8059] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.183111][ T8059] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 270.554602][T14955] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4040'. [ 270.617050][T14959] 9pnet: Could not find request transport: tcp0/ . %+ [ 272.718383][T14984] random: crng reseeded on system resumption [ 272.829201][T14999] loop4: detected capacity change from 0 to 1024 [ 272.898869][T14999] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 272.988902][ T29] kauditd_printk_skb: 1316 callbacks suppressed [ 272.988922][ T29] audit: type=1400 audit(1764755636.561:19045): avc: denied { read write } for pid=15009 comm="syz.1.4059" name="usbmon9" dev="devtmpfs" ino=169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 273.034292][T15010] netlink: 660 bytes leftover after parsing attributes in process `syz.1.4059'. [ 273.138791][T15012] 9pnet: Could not find request transport: tcp0/ . %+ [ 273.454054][T15018] netlink: 'syz.7.4062': attribute type 1 has an invalid length. [ 273.463636][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 273.539508][ T29] audit: type=1400 audit(1764755636.561:19046): avc: denied { open } for pid=15009 comm="syz.1.4059" path="/dev/usbmon9" dev="devtmpfs" ino=169 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 273.563631][ T29] audit: type=1326 audit(1764755636.671:19047): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.587765][ T29] audit: type=1326 audit(1764755636.671:19048): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.612018][ T29] audit: type=1326 audit(1764755636.671:19049): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.635836][ T29] audit: type=1326 audit(1764755636.671:19050): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.659525][ T29] audit: type=1326 audit(1764755636.671:19051): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.683387][ T29] audit: type=1326 audit(1764755636.671:19052): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.707063][ T29] audit: type=1326 audit(1764755636.671:19053): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.732118][ T29] audit: type=1326 audit(1764755636.671:19054): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15011 comm="syz.1.4060" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f1db91df749 code=0x7ffc0000 [ 273.814142][T15024] loop7: detected capacity change from 0 to 128 [ 273.824544][T15024] loop7: detected capacity change from 0 to 512 [ 273.857524][T15024] EXT4-fs error (device loop7): ext4_init_orphan_info:581: comm syz.7.4065: inode #0: comm syz.7.4065: iget: illegal inode # [ 273.917821][T15024] EXT4-fs (loop7): get orphan inode failed [ 273.923804][T15024] EXT4-fs (loop7): mount failed [ 273.936490][T15030] FAULT_INJECTION: forcing a failure. [ 273.936490][T15030] name failslab, interval 1, probability 0, space 0, times 0 [ 273.949270][T15030] CPU: 1 UID: 0 PID: 15030 Comm: syz.1.4066 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 273.949312][T15030] Tainted: [W]=WARN [ 273.949392][T15030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 273.949453][T15030] Call Trace: [ 273.949462][T15030] [ 273.949491][T15030] __dump_stack+0x1d/0x30 [ 273.949515][T15030] dump_stack_lvl+0xe8/0x140 [ 273.949536][T15030] dump_stack+0x15/0x1b [ 273.949555][T15030] should_fail_ex+0x265/0x280 [ 273.949582][T15030] should_failslab+0x8c/0xb0 [ 273.949655][T15030] __kmalloc_noprof+0xa5/0x570 [ 273.949736][T15030] ? sock_kmalloc+0x85/0xc0 [ 273.949758][T15030] ? iovec_from_user+0x5e/0x210 [ 273.949811][T15030] sock_kmalloc+0x85/0xc0 [ 273.949852][T15030] ____sys_sendmsg+0xf8/0x4a0 [ 273.949950][T15030] ___sys_sendmsg+0x17b/0x1d0 [ 273.950071][T15030] __sys_sendmmsg+0x178/0x300 [ 273.950187][T15030] __x64_sys_sendmmsg+0x57/0x70 [ 273.950213][T15030] x64_sys_call+0x1e28/0x3000 [ 273.950238][T15030] do_syscall_64+0xd8/0x2a0 [ 273.950273][T15030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.950301][T15030] RIP: 0033:0x7f1db91df749 [ 273.950320][T15030] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 273.950344][T15030] RSP: 002b:00007f1db7c47038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 273.950409][T15030] RAX: ffffffffffffffda RBX: 00007f1db9435fa0 RCX: 00007f1db91df749 [ 273.950426][T15030] RDX: 0000000000000002 RSI: 0000200000000e80 RDI: 0000000000000005 [ 273.950442][T15030] RBP: 00007f1db7c47090 R08: 0000000000000000 R09: 0000000000000000 [ 273.950458][T15030] R10: 0000000004000804 R11: 0000000000000246 R12: 0000000000000001 [ 273.950538][T15030] R13: 00007f1db9436038 R14: 00007f1db9435fa0 R15: 00007ffcd75d7528 [ 273.950564][T15030] [ 274.207580][T15036] loop4: detected capacity change from 0 to 2048 [ 274.231331][T15041] loop7: detected capacity change from 0 to 1024 [ 274.246273][T15036] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 274.283617][T15050] IPv6: Can't replace route, no match found [ 274.284003][T15045] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4070'. [ 274.315209][T15041] EXT4-fs: Ignoring removed orlov option [ 274.358374][T15036] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 274.372810][T15041] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 274.556722][T15065] 9pnet: Could not find request transport: tcp0/ . %+ [ 275.426724][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 275.506914][T15080] loop4: detected capacity change from 0 to 128 [ 275.508875][T15084] IPv6: Can't replace route, no match found [ 275.528423][T15080] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 275.544477][T15080] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 275.621891][T15090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4085'. [ 275.630986][T15090] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4085'. [ 275.640032][T15090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4085'. [ 275.752094][T15088] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4086'. [ 275.807161][T15095] program syz.4.4087 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 275.850125][T15090] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4085'. [ 275.859297][T15090] netlink: 'syz.0.4085': attribute type 6 has an invalid length. [ 275.887881][T15093] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4084'. [ 276.057172][T15101] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4088'. [ 276.471452][T15113] IPv6: Can't replace route, no match found [ 276.803461][T15124] loop7: detected capacity change from 0 to 1024 [ 276.866204][T15131] FAULT_INJECTION: forcing a failure. [ 276.866204][T15131] name failslab, interval 1, probability 0, space 0, times 0 [ 276.879216][T15131] CPU: 1 UID: 0 PID: 15131 Comm: syz.0.4101 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 276.879249][T15131] Tainted: [W]=WARN [ 276.879256][T15131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 276.879268][T15131] Call Trace: [ 276.879276][T15131] [ 276.879284][T15131] __dump_stack+0x1d/0x30 [ 276.879312][T15131] dump_stack_lvl+0xe8/0x140 [ 276.879406][T15131] dump_stack+0x15/0x1b [ 276.879485][T15131] should_fail_ex+0x265/0x280 [ 276.879586][T15131] should_failslab+0x8c/0xb0 [ 276.879620][T15131] kmem_cache_alloc_node_noprof+0x57/0x4a0 [ 276.879704][T15131] ? __alloc_skb+0x101/0x320 [ 276.879737][T15131] __alloc_skb+0x101/0x320 [ 276.879849][T15131] netlink_alloc_large_skb+0xbf/0xf0 [ 276.879894][T15131] netlink_sendmsg+0x3cf/0x6b0 [ 276.879925][T15131] ? __pfx_netlink_sendmsg+0x10/0x10 [ 276.879964][T15131] __sock_sendmsg+0x145/0x180 [ 276.880001][T15131] ____sys_sendmsg+0x31e/0x4a0 [ 276.880028][T15131] ___sys_sendmsg+0x17b/0x1d0 [ 276.880074][T15131] __x64_sys_sendmsg+0xd4/0x160 [ 276.880149][T15131] x64_sys_call+0x17ba/0x3000 [ 276.880172][T15131] do_syscall_64+0xd8/0x2a0 [ 276.880210][T15131] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 276.880236][T15131] RIP: 0033:0x7f5233c1f749 [ 276.880304][T15131] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 276.880322][T15131] RSP: 002b:00007f523267f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 276.880344][T15131] RAX: ffffffffffffffda RBX: 00007f5233e75fa0 RCX: 00007f5233c1f749 [ 276.880427][T15131] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 0000000000000003 [ 276.880440][T15131] RBP: 00007f523267f090 R08: 0000000000000000 R09: 0000000000000000 [ 276.880453][T15131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 276.880469][T15131] R13: 00007f5233e76038 R14: 00007f5233e75fa0 R15: 00007ffce49480a8 [ 276.880494][T15131] [ 277.164191][T15124] EXT4-fs (loop7): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 277.188894][T15139] netlink: 'syz.6.4104': attribute type 10 has an invalid length. [ 277.202892][T15124] ext4 filesystem being mounted at /70/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 277.259379][T15144] IPv6: Can't replace route, no match found [ 277.295530][T13865] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 277.339508][T15151] program syz.6.4107 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 277.394692][T15158] loop1: detected capacity change from 0 to 1024 [ 277.444631][T15158] EXT4-fs: quotafile must be on filesystem root [ 277.478656][T15169] loop4: detected capacity change from 0 to 1024 [ 277.573797][T15176] IPv6: Can't replace route, no match found [ 277.594314][T15169] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 277.626361][T15169] ext4 filesystem being mounted at /321/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 277.708274][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 278.000363][ T29] kauditd_printk_skb: 435 callbacks suppressed [ 278.000378][ T29] audit: type=1326 audit(1764755641.571:19490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.069320][ T29] audit: type=1326 audit(1764755641.611:19491): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.093260][ T29] audit: type=1326 audit(1764755641.611:19492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.116926][ T29] audit: type=1326 audit(1764755641.621:19493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.140653][ T29] audit: type=1326 audit(1764755641.631:19494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.657976][ T29] audit: type=1326 audit(1764755641.741:19495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.681577][ T29] audit: type=1326 audit(1764755641.751:19496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.712510][ T29] audit: type=1326 audit(1764755641.761:19497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15149 comm="syz.6.4107" exe="/root/syz-executor" sig=0 arch=c000003e syscall=34 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 278.736434][ T29] audit: type=1326 audit(1764755642.221:19498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15196 comm="syz.4.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 278.760164][ T29] audit: type=1326 audit(1764755642.221:19499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15196 comm="syz.4.4120" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7d1b25f749 code=0x7ffc0000 [ 278.869642][T15204] loop6: detected capacity change from 0 to 512 [ 278.915772][T15204] EXT4-fs warning (device loop6): ext4_enable_quotas:7180: Failed to enable quota tracking (type=1, err=-117, ino=4). Please run e2fsck to fix. [ 278.943106][T15210] netlink: 'syz.4.4130': attribute type 3 has an invalid length. [ 279.030903][T15204] EXT4-fs (loop6): mount failed [ 279.092611][T15219] netlink: 'syz.4.4134': attribute type 10 has an invalid length. [ 279.143470][T15221] netlink: 'syz.4.4134': attribute type 10 has an invalid length. [ 279.185230][T15219] bond0: (slave dummy0): Releasing backup interface [ 279.207807][T15219] team0: Port device dummy0 added [ 279.233629][T15221] team0: Port device dummy0 removed [ 279.260931][T15221] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 279.372605][T15225] loop6: detected capacity change from 0 to 1024 [ 279.446386][T15225] EXT4-fs (loop6): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 279.470507][T15225] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 279.506899][T14617] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 279.597759][T15250] loop6: detected capacity change from 0 to 512 [ 279.600752][T15254] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 279.630132][T15256] loop7: detected capacity change from 0 to 128 [ 279.631781][ T9] hid-generic 0000:0000:0000.0035: unknown main item tag 0x0 [ 279.651682][T15258] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4149'. [ 279.660866][T15258] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4149'. [ 279.670916][ T9] hid-generic 0000:0000:0000.0035: hidraw0: HID v0.00 Device [syz1] on syz0 [ 279.686819][T15250] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 279.705421][T15250] ext4 filesystem being mounted at /43/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 279.747198][T15259] fido_id[15259]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 279.783221][T14617] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 279.809749][T15270] loop1: detected capacity change from 0 to 1024 [ 279.827564][T15270] EXT4-fs (loop1): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 279.885164][T15270] ext4 filesystem being mounted at /240/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 279.915406][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 279.946812][ T9] hid-generic 0000:0000:0000.0036: unknown main item tag 0x0 [ 279.967298][ T9] hid-generic 0000:0000:0000.0036: hidraw0: HID v0.00 Device [syz1] on syz0 [ 279.981671][T15281] loop1: detected capacity change from 0 to 764 [ 279.999231][T15281] rock: corrupted directory entry. extent=32, offset=2044, size=237 [ 280.023859][T15282] fido_id[15282]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 280.128564][T15291] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 280.240337][T15301] loop7: detected capacity change from 0 to 1024 [ 280.255669][T15301] ext4: Unknown parameter 'subj_role' [ 280.265707][T15281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 280.288634][T15281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 280.297655][T15301] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4163'. [ 280.319384][ T3484] hid-generic 0000:0000:0000.0037: unknown main item tag 0x0 [ 280.339883][ T3484] hid-generic 0000:0000:0000.0037: hidraw0: HID v0.00 Device [syz1] on syz0 [ 280.413652][T15315] netlink: 'syz.6.4169': attribute type 10 has an invalid length. [ 280.428071][T15317] netlink: 'syz.7.4170': attribute type 10 has an invalid length. [ 280.453255][T15317] bond0: (slave dummy0): Releasing backup interface [ 280.480356][T15317] netlink: 'syz.7.4170': attribute type 10 has an invalid length. [ 280.493870][T15317] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 280.576892][T15331] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 280.619021][ T3484] hid-generic 0000:0000:0000.0038: unknown main item tag 0x0 [ 280.626953][T15338] netlink: 12 bytes leftover after parsing attributes in process `syz.7.4181'. [ 280.636077][T15338] netlink: 16 bytes leftover after parsing attributes in process `syz.7.4181'. [ 280.636738][ T3484] hid-generic 0000:0000:0000.0038: hidraw0: HID v0.00 Device [syz1] on syz0 [ 280.680573][T15344] netlink: 'syz.6.4182': attribute type 10 has an invalid length. [ 280.710369][T15343] loop4: detected capacity change from 0 to 1024 [ 280.717443][T15343] ext4: Unknown parameter 'subj_role' [ 280.747306][T15343] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4180'. [ 280.769379][T15352] netlink: 'syz.6.4186': attribute type 10 has an invalid length. [ 280.791074][T15352] bond0: (slave dummy0): Releasing backup interface [ 280.797953][T15353] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4184'. [ 280.807074][T15353] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4184'. [ 280.819481][T15352] team0: Port device dummy0 added [ 280.829277][T15356] team0: Port device dummy0 removed [ 280.846996][T15356] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 280.897868][T15364] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 280.946353][T15362] 9pnet_fd: Insufficient options for proto=fd [ 280.964731][ T3502] hid-generic 0000:0000:0000.0039: unknown main item tag 0x0 [ 280.986554][ T3502] hid-generic 0000:0000:0000.0039: hidraw0: HID v0.00 Device [syz1] on syz0 [ 281.006970][T15377] validate_nla: 1 callbacks suppressed [ 281.006987][T15377] netlink: 'syz.6.4196': attribute type 10 has an invalid length. [ 281.024376][T15378] fido_id[15378]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 281.092019][T15383] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4200'. [ 281.165906][T15396] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 281.173399][T15397] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 281.231219][T15404] loop1: detected capacity change from 0 to 1024 [ 281.244245][T15404] EXT4-fs: Ignoring removed bh option [ 281.275927][T15401] 9pnet: Could not find request transport: tcp0/ . %+ [ 281.286724][T15404] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 281.302508][T15404] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4193: comm syz.1.4210: Allocating blocks 385-513 which overlap fs metadata [ 281.873450][T15422] netlink: 'syz.7.4215': attribute type 10 has an invalid length. [ 281.975960][T15424] loop4: detected capacity change from 0 to 1024 [ 281.993421][T15424] ext4: Unknown parameter 'subj_role' [ 282.031478][T15424] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4216'. [ 282.075266][T15403] EXT4-fs (loop1): pa ffff888106e5aa10: logic 16, phys. 129, len 24 [ 282.083499][T15403] EXT4-fs error (device loop1): ext4_mb_release_inode_pa:5444: group 0, free 0, pa_free 8 [ 282.146851][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 282.349352][T15432] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 282.437573][T15436] loop4: detected capacity change from 0 to 512 [ 282.467329][T15436] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 282.511085][T15436] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 282.532822][T15436] ext4 filesystem being mounted at /344/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 282.563433][T15436] FAULT_INJECTION: forcing a failure. [ 282.563433][T15436] name failslab, interval 1, probability 0, space 0, times 0 [ 282.576200][T15436] CPU: 1 UID: 0 PID: 15436 Comm: syz.4.4222 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 282.576260][T15436] Tainted: [W]=WARN [ 282.576270][T15436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 282.576285][T15436] Call Trace: [ 282.576294][T15436] [ 282.576305][T15436] __dump_stack+0x1d/0x30 [ 282.576366][T15436] dump_stack_lvl+0xe8/0x140 [ 282.576393][T15436] dump_stack+0x15/0x1b [ 282.576415][T15436] should_fail_ex+0x265/0x280 [ 282.576435][T15436] should_failslab+0x8c/0xb0 [ 282.576508][T15436] __kmalloc_noprof+0xa5/0x570 [ 282.576541][T15436] ? qtree_write_dquot+0x70/0x300 [ 282.576572][T15436] qtree_write_dquot+0x70/0x300 [ 282.576599][T15436] ? bpf_trace_run3+0xfd/0x1d0 [ 282.576676][T15436] v2_write_dquot+0xda/0x140 [ 282.576704][T15436] dquot_commit+0x21c/0x260 [ 282.576740][T15436] ext4_write_dquot+0x126/0x1d0 [ 282.576803][T15436] ext4_mark_dquot_dirty+0x95/0xd0 [ 282.576831][T15436] __dquot_alloc_space+0x372/0x8a0 [ 282.576872][T15436] ext4_mb_new_blocks+0x91b/0x2080 [ 282.576978][T15436] ? ext4_ext_search_right+0x30b/0x4f0 [ 282.577016][T15436] ? ext4_inode_to_goal_block+0x1be/0x1e0 [ 282.577116][T15436] ext4_ext_map_blocks+0xff5/0x38a0 [ 282.577196][T15436] ext4_map_blocks+0x5ee/0xd00 [ 282.577245][T15436] _ext4_get_block+0x10a/0x350 [ 282.577368][T15436] ext4_get_block_unwritten+0x2a/0xb0 [ 282.577410][T15436] ext4_block_write_begin+0x5e8/0xc00 [ 282.577519][T15436] ? __pfx_ext4_get_block_unwritten+0x10/0x10 [ 282.577566][T15436] ? folio_mapping+0xb9/0xe0 [ 282.577592][T15436] ext4_write_begin+0x633/0xe90 [ 282.577763][T15436] ext4_da_write_begin+0x1f0/0x6b0 [ 282.577796][T15436] ? inode_to_bdi+0x47/0xa0 [ 282.577826][T15436] ? balance_dirty_pages_ratelimited_flags+0x40b/0x5e0 [ 282.577855][T15436] generic_perform_write+0x184/0x490 [ 282.577958][T15436] ext4_buffered_write_iter+0x1ee/0x3c0 [ 282.577983][T15436] ? ext4_file_write_iter+0xfe/0xf60 [ 282.578010][T15436] ext4_file_write_iter+0x387/0xf60 [ 282.578036][T15436] ? kstrtouint_from_user+0x9f/0xf0 [ 282.578130][T15436] ? 0xffffffff81000000 [ 282.578144][T15436] ? __rcu_read_unlock+0x4f/0x70 [ 282.578180][T15436] ? avc_policy_seqno+0x15/0x30 [ 282.578204][T15436] ? selinux_file_permission+0x1e4/0x320 [ 282.578251][T15436] ? __pfx_ext4_file_write_iter+0x10/0x10 [ 282.578273][T15436] vfs_write+0x52a/0x960 [ 282.578334][T15436] __x64_sys_pwrite64+0xfd/0x150 [ 282.578453][T15436] x64_sys_call+0x9f7/0x3000 [ 282.578483][T15436] do_syscall_64+0xd8/0x2a0 [ 282.578524][T15436] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 282.578546][T15436] RIP: 0033:0x7f7d1b25f749 [ 282.578560][T15436] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 282.578607][T15436] RSP: 002b:00007f7d19cbf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 [ 282.578627][T15436] RAX: ffffffffffffffda RBX: 00007f7d1b4b5fa0 RCX: 00007f7d1b25f749 [ 282.578685][T15436] RDX: 000000000000fdef RSI: 0000200000000140 RDI: 0000000000000004 [ 282.578701][T15436] RBP: 00007f7d19cbf090 R08: 0000000000000000 R09: 0000000000000000 [ 282.578717][T15436] R10: 000000000000fecc R11: 0000000000000246 R12: 0000000000000001 [ 282.578731][T15436] R13: 00007f7d1b4b6038 R14: 00007f7d1b4b5fa0 R15: 00007ffcac13b938 [ 282.578750][T15436] [ 282.578758][T15436] EXT4-fs error (device loop4): ext4_write_dquot:6925: comm syz.4.4222: Failed to commit dquot type 0 [ 282.979436][T15444] SELinux: Context ׸ýÿX7ªÞd¹Q¬‰YI{C´¨pUèÒ–hÙ»ŒÐ r: is not valid (left unmapped). [ 283.021311][ T29] kauditd_printk_skb: 382 callbacks suppressed [ 283.021330][ T29] audit: type=1400 audit(1764755646.591:19881): avc: denied { create } for pid=15442 comm="syz.7.4225" name="memory.events" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=D7B8FDFF5837AADE64B91D51AC8959497B4317B4A87055E8D21B9668D9BB8CD00B723A [ 283.065075][ T29] audit: type=1400 audit(1764755646.591:19882): avc: denied { associate } for pid=15442 comm="syz.7.4225" name="memory.events" scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon=D7B8FDFF5837AADE64B91D51AC8959497B4317B4A87055E8D21B9668D9BB8CD00B723A [ 283.095297][ T29] audit: type=1400 audit(1764755646.591:19883): avc: denied { append open } for pid=15442 comm="syz.7.4225" path="/94/memory.events" dev="tmpfs" ino=515 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=D7B8FDFF5837AADE64B91D51AC8959497B4317B4A87055E8D21B9668D9BB8CD00B723A [ 283.140684][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 283.333610][ T29] audit: type=1326 audit(1764755646.901:19884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15450 comm="syz.0.4228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 283.386796][ T29] audit: type=1326 audit(1764755646.931:19885): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15450 comm="syz.0.4228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=128 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 283.410478][ T29] audit: type=1326 audit(1764755646.931:19886): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15450 comm="syz.0.4228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 283.434549][ T29] audit: type=1326 audit(1764755646.931:19887): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15450 comm="syz.0.4228" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5233c1f749 code=0x7ffc0000 [ 283.471967][T15455] netlink: 'syz.0.4230': attribute type 10 has an invalid length. [ 283.483442][T15455] bond0: (slave dummy0): Releasing backup interface [ 283.493154][T15455] netlink: 'syz.0.4230': attribute type 10 has an invalid length. [ 283.503112][T15455] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 283.565237][T15463] loop1: detected capacity change from 0 to 1024 [ 283.590790][T15463] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 283.593330][T15470] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 283.642707][T15475] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 283.681613][ T29] audit: type=1400 audit(1764755647.231:19888): avc: denied { unlink } for pid=13865 comm="syz-executor" name="memory.events" dev="tmpfs" ino=515 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=D7B8FDFF5837AADE64B91D51AC8959497B4317B4A87055E8D21B9668D9BB8CD00B723A [ 283.712214][ T29] audit: type=1326 audit(1764755647.251:19889): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.6.4239" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 283.736136][ T29] audit: type=1326 audit(1764755647.251:19890): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=15477 comm="syz.6.4239" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fa17ad0f749 code=0x7ffc0000 [ 283.872937][T15494] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 283.923893][T15502] loop4: detected capacity change from 0 to 1024 [ 283.961542][T15502] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 284.011850][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 284.055508][T15515] loop4: detected capacity change from 0 to 1024 [ 284.103566][T15515] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 284.151117][T15515] ext4 filesystem being mounted at /350/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 284.177842][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 284.928565][T15540] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 284.944536][T12863] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 285.004110][T15544] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 285.200893][T15552] FAULT_INJECTION: forcing a failure. [ 285.200893][T15552] name failslab, interval 1, probability 0, space 0, times 0 [ 285.222761][T15552] CPU: 1 UID: 0 PID: 15552 Comm: wÞ£ÿ Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 285.222804][T15552] Tainted: [W]=WARN [ 285.222867][T15552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 285.222889][T15552] Call Trace: [ 285.222897][T15552] [ 285.222907][T15552] __dump_stack+0x1d/0x30 [ 285.222930][T15552] dump_stack_lvl+0xe8/0x140 [ 285.222989][T15552] dump_stack+0x15/0x1b [ 285.223013][T15552] should_fail_ex+0x265/0x280 [ 285.223038][T15552] should_failslab+0x8c/0xb0 [ 285.223072][T15552] kmem_cache_alloc_noprof+0x50/0x480 [ 285.223157][T15552] ? dup_fd+0x3a/0x510 [ 285.223183][T15552] dup_fd+0x3a/0x510 [ 285.223208][T15552] ? _raw_spin_unlock+0x26/0x50 [ 285.223236][T15552] ksys_unshare+0x346/0x6d0 [ 285.223263][T15552] ? ksys_write+0x192/0x1a0 [ 285.223335][T15552] __x64_sys_unshare+0x1f/0x30 [ 285.223360][T15552] x64_sys_call+0x2ae6/0x3000 [ 285.223466][T15552] do_syscall_64+0xd8/0x2a0 [ 285.223537][T15552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 285.223634][T15552] RIP: 0033:0x7fce2bbaf749 [ 285.223649][T15552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 285.223668][T15552] RSP: 002b:00007fce2a617038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 285.223687][T15552] RAX: ffffffffffffffda RBX: 00007fce2be05fa0 RCX: 00007fce2bbaf749 [ 285.223702][T15552] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000028000600 [ 285.223787][T15552] RBP: 00007fce2a617090 R08: 0000000000000000 R09: 0000000000000000 [ 285.223801][T15552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 285.223813][T15552] R13: 00007fce2be06038 R14: 00007fce2be05fa0 R15: 00007ffda4f39e08 [ 285.223834][T15552] [ 285.491975][T15558] loop4: detected capacity change from 0 to 1024 [ 285.679020][T15558] EXT4-fs (loop4): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 285.742091][T15558] ext4 filesystem being mounted at /355/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 285.795513][T15581] sch_tbf: peakrate 7 is lower than or equals to rate 19 ! [ 285.867702][T10726] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 285.953681][T15594] 9pnet: Could not find request transport: tcp0/ . %+ [ 286.481589][ T2969] ================================================================== [ 286.489778][ T2969] BUG: KCSAN: data-race in __filemap_remove_folio / nr_blockdev_pages [ 286.497983][ T2969] [ 286.500323][ T2969] read-write to 0xffff8881005f1e78 of 8 bytes by task 10726 on cpu 1: [ 286.508490][ T2969] __filemap_remove_folio+0x1bc/0x2a0 [ 286.513876][ T2969] __remove_mapping+0x390/0x4c0 [ 286.518759][ T2969] remove_mapping+0x22/0x90 [ 286.523285][ T2969] mapping_try_invalidate+0x26a/0x3f0 [ 286.528673][ T2969] invalidate_mapping_pages+0x27/0x40 [ 286.534063][ T2969] invalidate_bdev+0x58/0x70 [ 286.538756][ T2969] ext4_put_super+0x624/0x7d0 [ 286.543540][ T2969] generic_shutdown_super+0xe6/0x210 [ 286.548843][ T2969] kill_block_super+0x2a/0x70 [ 286.553536][ T2969] ext4_kill_sb+0x42/0x80 [ 286.557875][ T2969] deactivate_locked_super+0x75/0x1c0 [ 286.563269][ T2969] deactivate_super+0x97/0xa0 [ 286.567970][ T2969] cleanup_mnt+0x2a9/0x320 [ 286.572404][ T2969] __cleanup_mnt+0x19/0x20 [ 286.576838][ T2969] task_work_run+0x131/0x1a0 [ 286.581454][ T2969] exit_to_user_mode_loop+0x1fe/0x740 [ 286.586852][ T2969] do_syscall_64+0x202/0x2a0 [ 286.591469][ T2969] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 286.597389][ T2969] [ 286.599731][ T2969] read to 0xffff8881005f1e78 of 8 bytes by task 2969 on cpu 0: [ 286.607279][ T2969] nr_blockdev_pages+0x7e/0xd0 [ 286.612090][ T2969] si_meminfo+0x87/0xd0 [ 286.616266][ T2969] update_defense_level+0x47/0x5c0 [ 286.621404][ T2969] defense_work_handler+0x1f/0x80 [ 286.626460][ T2969] process_scheduled_works+0x4ce/0x9d0 [ 286.631943][ T2969] worker_thread+0x582/0x770 [ 286.636571][ T2969] kthread+0x489/0x510 [ 286.640682][ T2969] ret_from_fork+0x149/0x290 [ 286.645288][ T2969] ret_from_fork_asm+0x1a/0x30 [ 286.650068][ T2969] [ 286.652479][ T2969] value changed: 0x000000000000000a -> 0x0000000000000009 [ 286.659585][ T2969] [ 286.661910][ T2969] Reported by Kernel Concurrency Sanitizer on: [ 286.668176][ T2969] CPU: 0 UID: 0 PID: 2969 Comm: kworker/0:2 Tainted: G W syzkaller #0 PREEMPT(voluntary) [ 286.679559][ T2969] Tainted: [W]=WARN [ 286.683362][ T2969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 286.693426][ T2969] Workqueue: events_long defense_work_handler [ 286.699533][ T2969] ================================================================== [ 286.746461][T15603] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4282'.