last executing test programs: 2.61780467s ago: executing program 3 (id=76): r0 = syz_usbip_server_init(0x2) write$usbip_server(r0, &(0x7f00000005c0)=@ret_submit={{0x3, 0x0, 0x0, 0x1, 0x9}, 0x9, 0x0, 0x401, 0xe9, 0x9, 0x0, "", [{0x7, 0x7ff, 0x7, 0xfff}, {0x40, 0x7, 0x8, 0xff}, {0x0, 0xd5, 0xd, 0xf}, {0x7f, 0x2, 0x6, 0x100}, {0x5, 0x6, 0x9, 0xae}, {0x1, 0x7, 0xf094, 0x47}, {0xa1, 0x7fff, 0x0, 0xb}, {0x6, 0xe1ad, 0x3ebe, 0x9}, {0x1, 0x398, 0x4a9, 0x80}, {0x77339c41, 0x0, 0x9, 0xb829}, {0x1298a82, 0x6, 0x4, 0x4}, {0x4, 0x1, 0x4, 0x4}, {0x6, 0xffff, 0x8, 0x4}, {0x0, 0xfffffffe, 0x400, 0x10}, {0x0, 0x2b, 0x27d, 0x2eb}, {0x6, 0x1, 0x2, 0x2e000000}, {0x2b39bf6, 0xf2, 0x9, 0x10001}, {0x6, 0x6, 0xd3}, {0x2, 0x1000, 0x1, 0x3}, {0x1, 0x2, 0x5, 0x1ff}, {0xfffffffe, 0x7, 0x7, 0x6}, {0x3, 0x7, 0xffffffff}, {0x1, 0x8, 0x401, 0x1ff}, {0x1, 0x3ff, 0xfffffbff, 0x3}, {0x7, 0x7fffffff, 0x7, 0x80}, {0x0, 0x7, 0x9, 0x7}, {0x0, 0x6, 0x0, 0x5}, {0x134, 0x7, 0x1, 0xfffffff9}, {0x4, 0x9, 0x2, 0x2}, {0x4, 0xf5, 0xd, 0x3}, {0x0, 0x10000, 0xffff}, {0x0, 0xff, 0x0, 0x8}, {0x3, 0x3, 0x8, 0xd}, {0x4, 0x3, 0x200, 0x6}, {0x4c8, 0x2, 0x8, 0x3be}, {0xab, 0xfffffffc, 0x66fc, 0x7}, {0x63, 0x7, 0x7, 0x18}, {0x5, 0x7, 0x80000000, 0x800}, {0x8, 0xae8b, 0x80000001, 0x4}, {0xff, 0x6772e858, 0xffff, 0x8}, {0x1, 0x7, 0x6, 0x5}, {0x5, 0x5, 0x4, 0xfffffffe}, {0x3, 0x9, 0x4, 0x3}, {0x4, 0x9, 0x4, 0x3}, {0x7, 0x6, 0x7f, 0x8001}, {0x4, 0xa, 0x482a, 0x6}, {0x0, 0x1505ab19, 0x4, 0x10000}, {0x7f, 0x8, 0x7, 0x6}, {0x7, 0x3, 0x0, 0x2}, {0x2, 0x7fffffff, 0x0, 0xdc}, {0x5, 0x2, 0x10, 0x4}, {0xd54a, 0x5, 0x9, 0x40}, {0x7, 0x30, 0x7e329b3, 0x3a61c2f1}, {0x1, 0xb, 0x7, 0x200000}, {0x74, 0x8, 0x0, 0x3}, {0x401, 0x482, 0x9, 0x5}, {0x6, 0x4, 0x2, 0x40}, {0x800000, 0x8, 0x57f, 0x8}, {0xa50a, 0xf, 0x4, 0x4}, {0x5, 0x31, 0x5, 0x87}, {0x7, 0xd52, 0x3a1, 0x9}, {0xfffffff7, 0x8, 0x1198, 0x4}, {0x4, 0x200, 0x0, 0x9}, {0x86, 0x80000000, 0x0, 0x400}, {0x3, 0x5, 0xfffffffd, 0x931}, {0x4a4, 0x1, 0x6, 0x2}, {0x1, 0x7fff, 0x8, 0x6}, {0x1d63, 0x1006, 0x0, 0x8}, {0x7f, 0x8, 0x90, 0xfff}, {0x48, 0xe3b28000, 0xff, 0x8}, {0x8000, 0xa0, 0x6, 0x6}, {0x70, 0x7, 0x0, 0x8}, {0xe9, 0x6, 0x93, 0x2}, {0xfffff000, 0x9, 0x9, 0x8}, {0x405c, 0x6, 0x7, 0x1}, {0x4, 0xc, 0xe3, 0x1}, {0x2, 0x9, 0x7, 0x5e8}, {0x224, 0x61, 0x100, 0x3}, {0x9605, 0x85, 0x9d8, 0xffffffff}, {0x2, 0x400, 0x8, 0x1}, {0x1, 0x2, 0x7, 0x6}, {0x3, 0x0, 0x5, 0x79}, {0x5, 0x80000000, 0xbb21, 0x7e}, {0x2, 0xa, 0x10001, 0x7ff}, {0x400, 0x6, 0x7, 0x81}, {0x7, 0x1, 0x6}, {0x7, 0x4, 0xfffffffe, 0x4}, {0x2, 0x3c5e, 0xffffffff, 0x8169}, {0x9, 0x977e, 0xfffffc01, 0x401}, {0x1, 0x7, 0x1, 0xfffffffc}, {0x5, 0x2b9d, 0x1, 0xb}, {0x3, 0x2, 0x2, 0x9}, {0x59bd72ec, 0x5, 0x5, 0x62e3}, {0xaf2c, 0x6, 0xfffffff3, 0x400}, {0x5b, 0x7, 0x3, 0x18cf}, {0x80000000, 0x6, 0x8, 0xb}, {0x8, 0x2, 0x3, 0x6e7}, {0x83, 0x8, 0xf, 0x3}, {0x4, 0x200, 0x6, 0x3}, {0x2, 0x1, 0x13c, 0x6}, {0x4, 0x6, 0x9, 0x8}, {0x4, 0xfffffecb, 0x6000, 0x9}, {0x5, 0x1825, 0x618}, {0xac81, 0x0, 0xffffbc7f, 0x9}, {0x9, 0x1, 0x4}, {0xe, 0xffffffff, 0xff, 0x81}, {0xff, 0x5, 0xff, 0x7fffffff}, {0xb8c0, 0x1, 0x8000}, {0x9, 0xfff, 0x2, 0x3}, {0xcd, 0x7, 0x4, 0x4}, {0x1, 0x0, 0x4, 0x4}, {0x5, 0x3, 0x73, 0x9}, {0x3205, 0x7fffffff, 0x80000000, 0x7ff}, {0x0, 0x5, 0xfffffffd, 0xe83}, {0x1ff, 0x1, 0xd07, 0x5}, {0x2, 0x80000000, 0xfffff801, 0x1ff}, {0x8, 0x0, 0x0, 0xffffff7f}, {0x9, 0x9, 0xcb41, 0x3}, {0x0, 0x2, 0xffffd264, 0x68}, {0xff, 0x8, 0xc, 0x4}, {0x7fff, 0x4, 0x2, 0x5}, {0x3, 0x0, 0x1, 0x9}, {0x9, 0x4, 0x5, 0x9}, {0x8b, 0x3, 0x1, 0x413870f4}, {0x4, 0x8, 0x3000000}, {0x1, 0x0, 0xfffffffe, 0x1}, {0xfff, 0x80000001, 0x9, 0x81}, {0x5, 0x5, 0x5, 0x9}, {0x4, 0x3, 0x9, 0x5}, {0x6, 0x7, 0x6, 0x27efdc21}, {0x6, 0x0, 0xd, 0x8}, {0x2, 0x80000000, 0x81, 0x100}, {0x3, 0x37, 0x9, 0x5}, {0xfffff2b4, 0x401, 0xe0c9, 0x9}, {0x7, 0x7, 0x101, 0xe}, {0x3ff, 0x6dd6, 0xa4, 0x80000001}, {0x0, 0x4, 0x1, 0xfff}, {0x0, 0x4, 0x11d, 0x200}, {0x7fff, 0xfffffffa, 0xe, 0x100}, {0x9, 0xfc03, 0x50d8, 0x4}, {0x9, 0x400, 0x6, 0x80}, {0xda14ed52, 0x4, 0x7, 0xffffffff}, {0x6, 0x8, 0x10, 0x3}, {0x4, 0x62e6792f, 0x6}, {0x5, 0x200, 0xd89f, 0x7}, {0x8, 0x7, 0x5, 0x6fbb9799}, {0x56d, 0x3, 0x7ff, 0x4}, {0x1, 0x4179cdf2, 0x3, 0xe70}, {0xfffff0ba, 0x8, 0xffffffeb, 0x4}, {0xa, 0x8001, 0x80000001, 0x8}, {0x0, 0xfffeffff, 0xc, 0x1}, {0x3, 0x9, 0x7fffffff, 0x5}, {0x0, 0xffffffff, 0x8, 0xcbd3}, {0x0, 0xfffffffe, 0xfffff86a}, {0x0, 0x0, 0xffffff7f, 0xfff}, {0x0, 0x2, 0x3, 0xfffffffa}, {0x8, 0x9e1, 0x532, 0x8000}, {0x2, 0x4, 0x8, 0xba}, {0x0, 0x1, 0x9, 0x6}, {0xa, 0x4, 0x8, 0x8}, {0x1, 0x3, 0x2, 0x7a5}, {0x7, 0x6, 0x474b, 0xa319}, {0x9, 0x8000, 0x5, 0x1}, {0x6, 0x2, 0x3, 0x9}, {0x101, 0x1, 0x7fff}, {0x5, 0x314, 0x8, 0x9}, {0xe6, 0x100, 0x7fff, 0x2}, {0x0, 0x2, 0x9, 0x3}, {0x6, 0x9, 0x9, 0x7}, {0x78, 0x5, 0xfff, 0xff}, {0x9, 0x5, 0x1000, 0x1}, {0x0, 0x1, 0x200, 0xb}, {0x9, 0x8, 0x3, 0x1}, {0xe, 0x10001, 0x3, 0x101}, {0x1ff, 0x3, 0xa}, {0xc, 0x14a, 0x3, 0x2}, {0xca98, 0x3, 0xf, 0x9}, {0x5, 0x5, 0x0, 0x4}, {0x8, 0x7, 0x3, 0x3}, {0x80000000, 0x8, 0xffff146c, 0x4}, {0x4, 0xffffff00, 0x8001, 0x9}, {0x1, 0x81, 0x1, 0x5}, {0x3, 0x2, 0x3, 0xd}, {0x10000, 0x80, 0x5, 0x7}, {0x6, 0x5c34, 0x8, 0x9}, {0x401, 0xfffffffd, 0xa, 0x2}, {0x0, 0x6, 0xfd7, 0x1}, {0x8, 0x1000, 0x5, 0x7}, {0xf, 0x8, 0x80, 0x7}, {0x0, 0x4, 0x808, 0x100}, {0x0, 0x7, 0x6, 0x5}, {0x7, 0x9, 0x1ff, 0x76a}, {0x2, 0x0, 0x200, 0x9}, {0x306, 0x7, 0x6, 0x100}, {0x2, 0x9, 0x3}, {0xa8, 0x8, 0xfff, 0x790}, {0x1846, 0x82, 0x2, 0x8}, {0x3, 0x5c9e7a4a}, {0x8, 0x10000, 0x7f, 0x1}, {0x9, 0x2, 0x4, 0x8}, {0xeb, 0xb476, 0x0, 0x8}, {0x8, 0xa7, 0xbd, 0x6f}, {0xfffffffe, 0x4, 0x6}, {0x1748, 0x3, 0x6, 0xfffffffc}, {0x4, 0x8, 0x898, 0x9}, {0xc, 0x4, 0x6, 0x5}, {0x4, 0x34, 0xb, 0x6}, {0xb24e50a, 0x7f, 0xe, 0x7}, {0x9, 0xd5eb, 0xffffffff, 0x2c2a7084}, {0x8000, 0x1, 0x0, 0x6}, {0xfffffff9, 0xb8c, 0x7, 0x7}, {0x9, 0x5, 0x4, 0xb}, {0x3, 0x3, 0x3, 0x3ff}, {0x2, 0x2, 0x4, 0xc000}, {0x8, 0x3, 0x7fff, 0xcc4}, {0x6, 0x10001, 0x61, 0x9}, {0x3, 0xfff, 0x10001, 0xa520}, {0x1, 0x400, 0xde05, 0xc}, {0x0, 0x188, 0x10000, 0xff}, {0xc, 0x0, 0x6, 0xe070}, {0x4, 0x79, 0xff, 0x9}, {0x1, 0x9, 0x6, 0x9}, {0x3, 0x9, 0x9, 0x9}, {0x6, 0x8000, 0x7, 0x2}, {0x7, 0x7, 0x5, 0x545}, {0x7c, 0x5, 0x3, 0x7}, {0x5, 0x80000000, 0x6, 0x7ff}, {0x5, 0x6, 0x7f, 0x1}, {0x10, 0x10, 0x0, 0x5f}, {0x99, 0x2, 0x6, 0x4}, {0x3, 0x10, 0x80000001, 0x8}, {0x71, 0x40000000, 0xfffffff0}, {0x3, 0x9, 0x8, 0xfffffff7}]}, 0xec0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000200)={'gretap0\x00', 0x0, 0x80, 0x700, 0x1, 0x4, {{0x13, 0x4, 0x1, 0x2f, 0x4c, 0x67, 0x0, 0x5, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x1c}, @empty, {[@end, @lsrr={0x83, 0x13, 0xa3, [@multicast1, @empty, @remote, @private=0xa010100]}, @ra={0x94, 0x4}, @timestamp={0x44, 0x20, 0xc3, 0x0, 0x2, [0x6, 0xdc, 0x2, 0x4, 0x14, 0x400, 0x2]}]}}}}}) 1.96371757s ago: executing program 3 (id=82): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x2, 0x1, 0x0, 0x0, 0x7}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x1, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f00000004c0)={'#! ', './file0'}, 0xb) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x9f, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffe, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x10000000000000) 1.698562183s ago: executing program 1 (id=84): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) 1.573734436s ago: executing program 1 (id=86): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xc8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c13c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c77aa"], 0xfdef) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfdef) 1.572519556s ago: executing program 3 (id=87): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="020000000400000010000000"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x10, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x5}, 0x18) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8) dup2(r3, r4) fcntl$setown(r3, 0x8, r2) tkill(r2, 0x13) 1.533994416s ago: executing program 1 (id=89): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) 1.421885268s ago: executing program 1 (id=91): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x21}]}}}]}]}], {0x14}}, 0xd0}}, 0x0) 1.404940938s ago: executing program 3 (id=92): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) readv(r0, &(0x7f0000000000)=[{&(0x7f0000001300)=""/244, 0x940}], 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x69, 0x7ffc0005}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newsa={0x17c, 0x10, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0xc}, {@in=@empty, 0x0, 0x33}, @in=@empty, {0xfffffffffffffffe, 0x0, 0x8000000000000001, 0x0, 0x3}, {0x4, 0x5, 0x0, 0x800000000}, {}, 0xf0bd2a, 0x0, 0xa, 0x2}, [@algo_auth={0x89, 0x1, {{'sha256\x00'}, 0x208, "4b453b2d159285e722bf6aa0604d03408f2de30cad2b0a0e75eda35a0432f646df4d7f0fee84739fdfd68d3f51b660e9089c8e1b17c5b86a75a2bf3a2ebfcf148d"}}]}, 0x17c}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x9c2, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x62, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000005c0)={&(0x7f00000001c0)='siox_set_data\x00'}, 0x18) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f0000000040)=""/73, 0x49}], 0x1) setreuid(0x0, 0xee00) socket$kcm(0x10, 0x8, 0x4) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) 1.368214429s ago: executing program 2 (id=93): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000003940)=ANY=[@ANYBLOB="210000000000000000000000000010000004"], 0x48) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000200)='\f7', 0x2}, {&(0x7f0000000000)='0', 0x1}], 0x2) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000200)='signal_generate\x00'}, 0x18) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000180)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) getrlimit(0x1, &(0x7f00000002c0)) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000140)={0x0, 0x2000000, 0x1, 0x0, 0x1, "ff00f7000000000000000000af88008300"}) r3 = syz_open_pts(r2, 0x141601) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x3938700}, {0x0, 0x3938700}}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) write(r3, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$TCSETSF(r3, 0x5404, &(0x7f0000000080)={0x0, 0x0, 0xfffffffc, 0x0, 0x0, "682341f2fd71a6a76177920ea7e60c0ac7a4a5"}) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xa2, 0x7}}, './file0\x00'}) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r5, 0x2284, &(0x7f0000000080)) mkdir(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000009f910000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) 1.366583178s ago: executing program 1 (id=94): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000008000000060000000010"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='kmem_cache_free\x00', r1}, 0x10) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_read_part_table(0x60d, &(0x7f0000002200)="$eJzs3D9olHcYB/DvJbmcUTAdnFxqHDoJRXE0Q5XkqlgIp1IIDvYfIs0UIXDSw5Q4tBkUM0jHLlK4DhonYwYnRaFzEQeLkMGlYBepHXLl7l6SOyjF0oRS/HyGe353PDzf94F3/V34XxtIuTi1Kp3y/qd/298a3TzP50xzYvJ4q9VqnU5KOZtyxsq7l5MMpX9q9icZ7plz8/udq9/+9mG5+fTUq/fOPVgc2JhZyTtJdvU2Z+SvHqXyzzZlO9wafzi6cGW2erX9pdpYW/84uf1yorZycnFp+UT52Oft3y8nj4r+7osxkoup51K+zCdDbxz19eax1Jc/386vj194Um2sfdd8fnB9b3Xw7vkjr/etXrt/KJlrR0yl87JvGv6Xi/fkL/Tkz41dn15qHD1wZ8+Nw/V7j2svBn9vdRWR5a3JBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABge9xqf1yZrV6tj194Um2sffPzTx/dfjlRWzm5uLR8YvjYs6LvUVGHinox9VxKOclMZvJFZt88crrUmz/+cHRhI/+Pncnzg+t7q82754+8nly9dv9Qp6uUqXYZ2IqN+/XnN9bmxq5PLzWOHriz58bh+r3HtReD3b6ZSj7rrJuksvWPAQAAAAAAAAAAAAAAAAAAwFtuYvL4vqkPaqeTUs7uSPLrV51b9q3KyI/p3Lzv2l/UZ5Vkd5KbO7r/BdB8eurV8LkHi78Ul+LnU8l8kl0/rJxJ3t3IudwfW96czH/pzwAAAP//gTiR5w==") syz_usb_connect$cdc_ecm(0x2, 0x54, &(0x7f0000000480)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x42, 0x1, 0x1, 0x7, 0x40, 0x57, [{{0x9, 0x4, 0x0, 0x3, 0x2, 0x2, 0x6, 0x0, 0x80, {{0x8, 0x24, 0x6, 0x0, 0x0, "73894f"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0xaf2, 0x7, 0x3, 0x9}, [@acm={0x4}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x10, 0xfc, 0x1, 0x2}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x9, 0xb0, 0xf0}}}}}]}}]}}, &(0x7f0000000640)={0xa, &(0x7f0000000340)={0xa, 0x6, 0x300, 0x7, 0x8, 0xe, 0x10, 0x4}, 0x48, &(0x7f0000000500)={0x5, 0xf, 0x48, 0x6, [@ptm_cap={0x3}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x9, 0x0, 0xc48}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x6, 0x1, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0xea, "cb96e6e7046c3dfdc0c92840f1162320"}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "024df30058cf88ce0b923cad45d3f433"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x6, 0x1, 0x21, 0xff}]}, 0x3, [{0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x43f}}, {0x23, &(0x7f00000005c0)=@string={0x23, 0x3, "69853206e69492327cba359483554432248872427b9f847ef4772291e68fcfc83d"}}, {0x4, &(0x7f0000000600)=@lang_id={0x4, 0x3, 0x81a}}]}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = creat(&(0x7f0000000100)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = open(&(0x7f0000000080)='./bus\x00', 0x147842, 0x49) preadv2(r3, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0xfffffdef}], 0x1, 0x0, 0x0, 0x0) 929.766165ms ago: executing program 0 (id=97): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x2, 0x1, 0x0, 0x0, 0x7}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x1, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f00000004c0)={'#! ', './file0'}, 0xb) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x0, 0x9f, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffe, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x10000000000000) 825.860667ms ago: executing program 0 (id=99): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x10, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x5}, 0x18) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8) dup2(r3, r4) fcntl$setown(r3, 0x8, r2) tkill(r2, 0x13) 800.103497ms ago: executing program 4 (id=100): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xc8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c13c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c77aa"], 0xfdef) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0xfdef) 774.253948ms ago: executing program 4 (id=101): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_read_part_table(0x60d, &(0x7f0000002200)="$eJzs3D9olHcYB/DvJbmcUTAdnFxqHDoJRXE0Q5XkqlgIp1IIDvYfIs0UIXDSw5Q4tBkUM0jHLlK4DhonYwYnRaFzEQeLkMGlYBepHXLl7l6SOyjF0oRS/HyGe353PDzf94F3/V34XxtIuTi1Kp3y/qd/298a3TzP50xzYvJ4q9VqnU5KOZtyxsq7l5MMpX9q9icZ7plz8/udq9/+9mG5+fTUq/fOPVgc2JhZyTtJdvU2Z+SvHqXyzzZlO9wafzi6cGW2erX9pdpYW/84uf1yorZycnFp+UT52Oft3y8nj4r+7osxkoup51K+zCdDbxz19eax1Jc/386vj194Um2sfdd8fnB9b3Xw7vkjr/etXrt/KJlrR0yl87JvGv6Xi/fkL/Tkz41dn15qHD1wZ8+Nw/V7j2svBn9vdRWR5a3JBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABge9xqf1yZrV6tj194Um2sffPzTx/dfjlRWzm5uLR8YvjYs6LvUVGHinox9VxKOclMZvJFZt88crrUmz/+cHRhI/+Pncnzg+t7q82754+8nly9dv9Qp6uUqXYZ2IqN+/XnN9bmxq5PLzWOHriz58bh+r3HtReD3b6ZSj7rrJuksvWPAQAAAAAAAAAAAAAAAAAAwFtuYvL4vqkPaqeTUs7uSPLrV51b9q3KyI/p3Lzv2l/UZ5Vkd5KbO7r/BdB8eurV8LkHi78Ul+LnU8l8kl0/rJxJ3t3IudwfW96czH/pzwAAAP//gTiR5w==") syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x147842, 0x49) preadv2(r2, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0xfffffdef}], 0x1, 0x0, 0x0, 0x0) 733.970988ms ago: executing program 0 (id=102): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [], {0x14}}, 0x28}}, 0x0) 706.960359ms ago: executing program 0 (id=103): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="020000000400000010000000"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x10, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x5}, 0x18) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8) dup2(r3, r4) fcntl$setown(r3, 0x8, r2) tkill(r2, 0x13) 662.70457ms ago: executing program 4 (id=104): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x21}]}}}]}]}], {0x14}}, 0xd0}}, 0x0) 595.743671ms ago: executing program 0 (id=105): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1d, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000001b40)='sched_switch\x00', r1}, 0x10) socketpair$unix(0x1, 0x2, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, 0x0, 0x0, 0x4) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0}, 0x0) r2 = syz_io_uring_setup(0x57ab, &(0x7f0000000080), &(0x7f0000000000), &(0x7f0000000040)) accept$unix(0xffffffffffffffff, &(0x7f0000000280), &(0x7f00000001c0)=0x6e) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000100), 0x1000000000000314) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) ioprio_get$pid(0x2, 0x0) 580.937421ms ago: executing program 1 (id=106): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1a5e35c89d69ebf8ff00000000bfa10000ff00000007010000f8ffffffb702000004000000b703000000000000850000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffdffffe, @void, @value}, 0x94) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000015c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000010000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b7000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r2}, 0x10) r3 = syz_usbip_server_init(0x3) write$usbip_server(r3, &(0x7f0000000300)=ANY=[], 0x30) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x930d, 0x4) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b703000000000000850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x0, 0x2, 0x0, @rand_addr, @multicast1}, @address_request}}}}, 0x0) sendmsg(r6, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x2c, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x3e}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) 529.605471ms ago: executing program 3 (id=107): creat(&(0x7f0000000040)='./bus\x00', 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xb, &(0x7f0000000c80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f0000000540)={[{@nolazytime}, {@nobarrier}, {@journal_path={'journal_path', 0x3d, './bus'}}, {@bsdgroups}, {@data_err_ignore}, {@noload}]}, 0x3, 0x45c, &(0x7f0000002400)="$eJzs3MtvG8UfAPDv+pG+m/yq/oA+gCBAlAJJk5bSAxcQSBxAQoJDOYYkrUrdBjVBIlUFBaFyRJU4cUEckfgLOMEFASckLhzgjipVqJcWTkYb76a2a+dVP0j9+UjrzuyuO/P1ztizM7EDGFij6UMSsTMifo+I4Vq28YTR2j+3blya/vvGpekkqtU3/kpK6eGbNy5N56fmz9uRZ0oRhU+SONCi3PnFi2enKpXZC1l+fOHcu+PzixefOXNu6vTs6dnzkydOHDs68dzxyWc7Emca1839H8wd3PfKW1dfmz559e2fvkny+Jvi6JDRlQ4+Xq12uLj+2lWXrrUMNoNirZtGean/D0cxbl+84Xj5475WDuiqarVava/94ctV4B6WRL9rAPRH/kGf3v/mW4+GHv8J11+o3QClcd/KttqRUhSyc8pN97edNBoRJy//82W6RXfmIQAAGnyXjn+ebjX+K0T9vNDubA1lJCL+FxF7IuJ4ROyNiP9HLJ17f0Q8sM7ymxdJ7hz/FK5tKLA1Ssd/z2drW43jv3z0FyPFLLdrKf5ycupMZfZI9pocivKWND+xQhnfv/TrZ+2O1Y//0i0tPx8LZvW4VtrS+JyZqYWpu4m53vWPIvaXWsWfLK8EJBGxLyL2b7CMM4e/Ptju2Orxr6AD60zVryKeqF3/y9EUfy5ZeX1yfGtUZo+M563iTj//cuX1duXfVfwdkF7/7S3b/3L8I0n9eu38ev73L55MH6/88Wnbe5qNtv+h5M2Gfe9PLSxcmIgYSl6tVbp+/2TTeZO3z0/jP/Ro6/6/J26/EgciIm3ED0bEQxHxcFb3R37bveqr8OOLj72z8fi7K41/Zu3XvzockTeExaHIEst7WieKZ3/4tqHQkdbx7257/Y8tpQ5le9by/reWeq23NQMAAMBmVYiInZEUxpbThcLYWO1v+PfG9kJlbn7hqVNz752fqX1HYCTKhXyma7huPnQiu63P85NN+aPZvPHnxW1L+bHpucpMv4OHAbejTf9P/Vnsd+2ArvN9LRhc+j8MLv0fBted/X9rX+oB9F6Lz/9t/agH0Hutxv8fruWJOztfF6C3mvq/ZT8YIOb/YHBtpP97z4B7Q2mln2we6mlVgN6Z3xarf0leYjMl8l+u6UYR5bS1HI6IxYtR6HukEl1M9PudCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDP+DQAA//+CSeFs") 512.894142ms ago: executing program 0 (id=108): r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x4, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20000014, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000000380)="9a78c8", 0x3, 0x0, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000280)={&(0x7f0000005000/0xb000)=nil, 0xb000, 0x0, 0x0, 0x0, &(0x7f00000004c0)=""/218, 0xda, 0x0, 0x0}, &(0x7f0000000040)=0x40) pselect6(0x40, &(0x7f0000001480)={0x8, 0x3, 0x7, 0x0, 0x7, 0xfffffffffffffffb, 0x8, 0x7ff}, 0x0, 0x0, 0x0, 0x0) 500.122392ms ago: executing program 4 (id=109): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000006c0)={&(0x7f0000000700)='kmem_cache_free\x00', r0}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) syz_clone3(&(0x7f00000006c0)={0x192142100, 0x0, 0x0, 0x0, {0x40}, 0x0, 0x0, 0x0, &(0x7f0000000680)=[0x0], 0x1}, 0x58) 418.035613ms ago: executing program 4 (id=110): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r3, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x2, 0x1, 0x0, 0x0, 0x7}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x1, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x275a, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, r4, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r5, &(0x7f00000004c0)={'#! ', './file0'}, 0xb) perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x9f, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffe, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close_range(r0, 0xffffffffffffffff, 0x10000000000000) 358.349294ms ago: executing program 4 (id=111): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) r1 = socket$inet6(0xa, 0x806, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e23}, 0x1c) listen(r1, 0x0) r2 = socket$inet_dccp(0x2, 0x6, 0x0) connect$inet(r2, &(0x7f0000772000)={0x2, 0x4e23}, 0x10) getsockopt$inet_int(r2, 0x10d, 0xd4, &(0x7f0000000240), &(0x7f00000003c0)=0x4) io_setup(0x2278, &(0x7f0000000180)=0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_timeval(r4, 0x1, 0x14, &(0x7f0000000000)={0x0, 0xea60}, 0x10) io_submit(r3, 0x2, &(0x7f0000000140)=[&(0x7f00000001c0)={0x0, 0x4, 0x0, 0x0, 0x0, r4, &(0x7f0000000200)=' ', 0x1, 0x0, 0x0, 0x2}, &(0x7f0000000080)={0x0, 0x0, 0x2, 0x2, 0x2, r4, 0x0, 0x0, 0x3}]) syz_clone(0x640c7000, 0x0, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x70f9a000) recvfrom$inet(r2, &(0x7f0000000280)=""/209, 0xd1, 0x2, &(0x7f0000000040)={0x2, 0x4e23, @remote}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r5) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, 0x0, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x1400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xaffffff7ffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sendmsg$kcm(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181010100000000010000000000000e000a000f00000002800600121f", 0x2e}], 0x1}, 0x0) r7 = syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) ioctl$HIDIOCSFEATURE(r7, 0xc0404806, 0x0) 291.949805ms ago: executing program 2 (id=112): bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000006"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000019007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xc8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c13c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa2c77aa"], 0xfdef) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfdef) 275.316125ms ago: executing program 3 (id=113): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) rt_sigsuspend(&(0x7f0000000040)={[0x2000000]}, 0x8) 266.750495ms ago: executing program 2 (id=114): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x14, 0x3, 0xa, 0x801, 0x0, 0x0, {0x1}}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x21}]}}}]}]}], {0x14}}, 0xac}}, 0x0) 244.586166ms ago: executing program 2 (id=115): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) syz_read_part_table(0x60d, &(0x7f0000002200)="$eJzs3D9olHcYB/DvJbmcUTAdnFxqHDoJRXE0Q5XkqlgIp1IIDvYfIs0UIXDSw5Q4tBkUM0jHLlK4DhonYwYnRaFzEQeLkMGlYBepHXLl7l6SOyjF0oRS/HyGe353PDzf94F3/V34XxtIuTi1Kp3y/qd/298a3TzP50xzYvJ4q9VqnU5KOZtyxsq7l5MMpX9q9icZ7plz8/udq9/+9mG5+fTUq/fOPVgc2JhZyTtJdvU2Z+SvHqXyzzZlO9wafzi6cGW2erX9pdpYW/84uf1yorZycnFp+UT52Oft3y8nj4r+7osxkoup51K+zCdDbxz19eax1Jc/386vj194Um2sfdd8fnB9b3Xw7vkjr/etXrt/KJlrR0yl87JvGv6Xi/fkL/Tkz41dn15qHD1wZ8+Nw/V7j2svBn9vdRWR5a3JBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABge9xqf1yZrV6tj194Um2sffPzTx/dfjlRWzm5uLR8YvjYs6LvUVGHinox9VxKOclMZvJFZt88crrUmz/+cHRhI/+Pncnzg+t7q82754+8nly9dv9Qp6uUqXYZ2IqN+/XnN9bmxq5PLzWOHriz58bh+r3HtReD3b6ZSj7rrJuksvWPAQAAAAAAAAAAAAAAAAAAwFtuYvL4vqkPaqeTUs7uSPLrV51b9q3KyI/p3Lzv2l/UZ5Vkd5KbO7r/BdB8eurV8LkHi78Ul+LnU8l8kl0/rJxJ3t3IudwfW96czH/pzwAAAP//gTiR5w==") syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = open(&(0x7f0000000080)='./bus\x00', 0x147842, 0x49) preadv2(r2, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0xfffffdef}], 0x1, 0x0, 0x0, 0x0) 132.267048ms ago: executing program 2 (id=116): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="02000000040000001000000001"], 0x48) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x11, 0x10, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000030000000000000000000400b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000008000000850000006900000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x5, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='kmem_cache_free\x00', r1, 0x0, 0x5}, 0x18) r2 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000b28000)=0x3) fcntl$setsig(r3, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r4}], 0x2c, 0xffffffffffbffff8) dup2(r3, r4) fcntl$setown(r3, 0x8, r2) tkill(r2, 0x13) 0s ago: executing program 2 (id=117): socket$inet6_tcp(0xa, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x1, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) symlink(&(0x7f00000000c0)='./file0\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001640)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000008b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0xec) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x12, 0xffffffffffffffff, 0x0) syz_clone(0x40200, 0x0, 0x49, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) kernel console output (not intermixed with test programs): [ 21.510417][ T29] audit: type=1400 audit(1742738037.579:81): avc: denied { read } for pid=2982 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.0.108' (ED25519) to the list of known hosts. [ 27.136196][ T29] audit: type=1400 audit(1742738043.199:82): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.137275][ T3286] cgroup: Unknown subsys name 'net' [ 27.159022][ T29] audit: type=1400 audit(1742738043.209:83): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.186440][ T29] audit: type=1400 audit(1742738043.229:84): avc: denied { unmount } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.326954][ T3286] cgroup: Unknown subsys name 'cpuset' [ 27.333247][ T3286] cgroup: Unknown subsys name 'rlimit' [ 27.484451][ T29] audit: type=1400 audit(1742738043.549:85): avc: denied { setattr } for pid=3286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.508339][ T29] audit: type=1400 audit(1742738043.549:86): avc: denied { create } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.529381][ T29] audit: type=1400 audit(1742738043.549:87): avc: denied { write } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.540955][ T3291] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.550059][ T29] audit: type=1400 audit(1742738043.549:88): avc: denied { read } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.579567][ T29] audit: type=1400 audit(1742738043.569:89): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 27.605050][ T29] audit: type=1400 audit(1742738043.569:90): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 27.628147][ T3286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.629009][ T29] audit: type=1400 audit(1742738043.629:91): avc: denied { relabelto } for pid=3291 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 29.507475][ T3302] chnl_net:caif_netlink_parms(): no params data found [ 29.526876][ T3300] chnl_net:caif_netlink_parms(): no params data found [ 29.559972][ T3298] chnl_net:caif_netlink_parms(): no params data found [ 29.568950][ T3297] chnl_net:caif_netlink_parms(): no params data found [ 29.655010][ T3302] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.662218][ T3302] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.669639][ T3302] bridge_slave_0: entered allmulticast mode [ 29.676790][ T3302] bridge_slave_0: entered promiscuous mode [ 29.702990][ T3302] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.710674][ T3302] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.718087][ T3302] bridge_slave_1: entered allmulticast mode [ 29.724527][ T3302] bridge_slave_1: entered promiscuous mode [ 29.731134][ T3301] chnl_net:caif_netlink_parms(): no params data found [ 29.762389][ T3298] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.769595][ T3298] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.777026][ T3298] bridge_slave_0: entered allmulticast mode [ 29.783418][ T3298] bridge_slave_0: entered promiscuous mode [ 29.790280][ T3298] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.797390][ T3298] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.804632][ T3298] bridge_slave_1: entered allmulticast mode [ 29.811249][ T3298] bridge_slave_1: entered promiscuous mode [ 29.839750][ T3300] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.846875][ T3300] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.854089][ T3300] bridge_slave_0: entered allmulticast mode [ 29.860559][ T3300] bridge_slave_0: entered promiscuous mode [ 29.871857][ T3297] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.878976][ T3297] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.886404][ T3297] bridge_slave_0: entered allmulticast mode [ 29.892784][ T3297] bridge_slave_0: entered promiscuous mode [ 29.900298][ T3302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.910528][ T3302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.925206][ T3298] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 29.935893][ T3298] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 29.945240][ T3300] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.952385][ T3300] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.959635][ T3300] bridge_slave_1: entered allmulticast mode [ 29.966266][ T3300] bridge_slave_1: entered promiscuous mode [ 29.975070][ T3297] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.982225][ T3297] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.989372][ T3297] bridge_slave_1: entered allmulticast mode [ 29.995839][ T3297] bridge_slave_1: entered promiscuous mode [ 30.037707][ T3300] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.050083][ T3300] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.064947][ T3297] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.074933][ T3302] team0: Port device team_slave_0 added [ 30.082222][ T3298] team0: Port device team_slave_0 added [ 30.088926][ T3298] team0: Port device team_slave_1 added [ 30.108858][ T3297] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.118564][ T3302] team0: Port device team_slave_1 added [ 30.139545][ T3300] team0: Port device team_slave_0 added [ 30.160885][ T3297] team0: Port device team_slave_0 added [ 30.171816][ T3301] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.178936][ T3301] bridge0: port 1(bridge_slave_0) entered disabled state [ 30.186424][ T3301] bridge_slave_0: entered allmulticast mode [ 30.192734][ T3301] bridge_slave_0: entered promiscuous mode [ 30.199730][ T3300] team0: Port device team_slave_1 added [ 30.205753][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.212745][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.238716][ T3302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.250137][ T3297] team0: Port device team_slave_1 added [ 30.256208][ T3302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.263154][ T3302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.289126][ T3302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.302339][ T3298] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.309353][ T3298] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.335713][ T3298] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.346507][ T3301] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.354069][ T3301] bridge0: port 2(bridge_slave_1) entered disabled state [ 30.361338][ T3301] bridge_slave_1: entered allmulticast mode [ 30.368010][ T3301] bridge_slave_1: entered promiscuous mode [ 30.390074][ T3298] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.397310][ T3298] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.423615][ T3298] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.444800][ T3297] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.451882][ T3297] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.478059][ T3297] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.489854][ T3297] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.497188][ T3297] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.524343][ T3297] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.543949][ T3300] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.551065][ T3300] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.579755][ T3300] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.612711][ T3302] hsr_slave_0: entered promiscuous mode [ 30.619255][ T3302] hsr_slave_1: entered promiscuous mode [ 30.627652][ T3301] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 30.637692][ T3300] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.644652][ T3300] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.671430][ T3300] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 30.691436][ T3301] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 30.734217][ T3298] hsr_slave_0: entered promiscuous mode [ 30.741531][ T3298] hsr_slave_1: entered promiscuous mode [ 30.747445][ T3298] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.755001][ T3298] Cannot create hsr debugfs directory [ 30.779121][ T3301] team0: Port device team_slave_0 added [ 30.800428][ T3297] hsr_slave_0: entered promiscuous mode [ 30.806585][ T3297] hsr_slave_1: entered promiscuous mode [ 30.812525][ T3297] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.820451][ T3297] Cannot create hsr debugfs directory [ 30.828093][ T3300] hsr_slave_0: entered promiscuous mode [ 30.834033][ T3300] hsr_slave_1: entered promiscuous mode [ 30.839988][ T3300] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 30.847622][ T3300] Cannot create hsr debugfs directory [ 30.853747][ T3301] team0: Port device team_slave_1 added [ 30.885555][ T3301] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 30.892643][ T3301] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.918671][ T3301] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 30.949711][ T3301] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 30.956713][ T3301] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 30.982758][ T3301] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 31.051700][ T3301] hsr_slave_0: entered promiscuous mode [ 31.057852][ T3301] hsr_slave_1: entered promiscuous mode [ 31.063706][ T3301] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 31.071391][ T3301] Cannot create hsr debugfs directory [ 31.126608][ T3302] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 31.150240][ T3302] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 31.168804][ T3302] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 31.179756][ T3302] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 31.219945][ T3298] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 31.230761][ T3298] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 31.248557][ T3298] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 31.257840][ T3298] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 31.277090][ T3300] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 31.285697][ T3300] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 31.295231][ T3300] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 31.310012][ T3300] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 31.336389][ T3301] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 31.346136][ T3301] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 31.354892][ T3301] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 31.364444][ T3301] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 31.422342][ T3298] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.438567][ T3297] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 31.449076][ T3297] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 31.458276][ T3297] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 31.467774][ T3297] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 31.486397][ T3302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.506578][ T3302] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.526728][ T3298] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.539396][ T1670] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.546543][ T1670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.555454][ T1670] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.562594][ T1670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.580170][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.587424][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.597111][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.604257][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.628950][ T3301] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.646314][ T3301] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.672757][ T3300] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.681559][ T3298] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.701702][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.708859][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.727983][ T3300] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.741127][ T1670] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.748403][ T1670] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.768430][ T1670] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.775563][ T1670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.795575][ T3301] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 31.806189][ T3301] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 31.834364][ T1670] bridge0: port 2(bridge_slave_1) entered blocking state [ 31.841641][ T1670] bridge0: port 2(bridge_slave_1) entered forwarding state [ 31.861658][ T3298] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.888273][ T3302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 31.902058][ T3297] 8021q: adding VLAN 0 to HW filter on device bond0 [ 31.939883][ T3297] 8021q: adding VLAN 0 to HW filter on device team0 [ 31.978949][ T1670] bridge0: port 1(bridge_slave_0) entered blocking state [ 31.986062][ T1670] bridge0: port 1(bridge_slave_0) entered forwarding state [ 31.995335][ T1670] bridge0: port 2(bridge_slave_1) entered blocking state [ 32.002519][ T1670] bridge0: port 2(bridge_slave_1) entered forwarding state [ 32.042204][ T3301] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.058143][ T3300] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.095410][ T3298] veth0_vlan: entered promiscuous mode [ 32.112393][ T3298] veth1_vlan: entered promiscuous mode [ 32.125556][ T3302] veth0_vlan: entered promiscuous mode [ 32.163029][ T3297] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 32.173114][ T3302] veth1_vlan: entered promiscuous mode [ 32.190671][ T3298] veth0_macvtap: entered promiscuous mode [ 32.204017][ T3301] veth0_vlan: entered promiscuous mode [ 32.216007][ T3298] veth1_macvtap: entered promiscuous mode [ 32.227276][ T3302] veth0_macvtap: entered promiscuous mode [ 32.241155][ T3302] veth1_macvtap: entered promiscuous mode [ 32.253657][ T3298] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.271416][ T3301] veth1_vlan: entered promiscuous mode [ 32.282998][ T3300] veth0_vlan: entered promiscuous mode [ 32.290260][ T3298] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.300127][ T3302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.310746][ T3302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.321438][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.329867][ T3302] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.340507][ T3302] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.351023][ T3302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.364134][ T3301] veth0_macvtap: entered promiscuous mode [ 32.375527][ T3298] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.384347][ T3298] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.393193][ T3298] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.402188][ T3298] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.419716][ T3301] veth1_macvtap: entered promiscuous mode [ 32.426408][ T3302] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.435148][ T3302] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.444303][ T3302] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.453593][ T3302] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.470068][ T3300] veth1_vlan: entered promiscuous mode [ 32.499595][ T29] kauditd_printk_skb: 19 callbacks suppressed [ 32.499612][ T29] audit: type=1400 audit(1742738048.569:111): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/root/syzkaller.SfPjda/syz-tmp" dev="sda1" ino=1944 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 32.505292][ T3301] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.516435][ T29] audit: type=1400 audit(1742738048.569:112): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 32.530752][ T3301] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.541213][ T29] audit: type=1400 audit(1742738048.569:113): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/root/syzkaller.SfPjda/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 32.563364][ T3301] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.563382][ T3301] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.567601][ T3301] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 32.573429][ T29] audit: type=1400 audit(1742738048.569:114): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 32.648425][ T29] audit: type=1400 audit(1742738048.569:115): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/root/syzkaller.SfPjda/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 32.675485][ T29] audit: type=1400 audit(1742738048.569:116): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/root/syzkaller.SfPjda/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3667 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 32.703043][ T29] audit: type=1400 audit(1742738048.569:117): avc: denied { unmount } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 32.724741][ T29] audit: type=1400 audit(1742738048.679:118): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=502 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 32.737297][ T3300] veth0_macvtap: entered promiscuous mode [ 32.747993][ T29] audit: type=1400 audit(1742738048.679:119): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="gadgetfs" ino=3674 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 32.761694][ T3301] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.786729][ T3301] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.796620][ T3301] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 32.807295][ T3301] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.819668][ T3301] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 32.827923][ T3298] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.834639][ T3301] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.851267][ T3301] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.860052][ T3301] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.868846][ T3301] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 32.880984][ T3300] veth1_macvtap: entered promiscuous mode [ 32.904619][ T3297] veth0_vlan: entered promiscuous mode [ 32.911508][ T29] audit: type=1400 audit(1742738048.979:120): avc: denied { read write } for pid=3298 comm="syz-executor" name="loop1" dev="devtmpfs" ino=101 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 32.937962][ T3297] veth1_vlan: entered promiscuous mode [ 32.975823][ T3300] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 32.986455][ T3300] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 32.996317][ T3300] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.006804][ T3300] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.016653][ T3300] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.027195][ T3300] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.039796][ T3300] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.048566][ T3297] veth0_macvtap: entered promiscuous mode [ 33.060116][ T3297] veth1_macvtap: entered promiscuous mode [ 33.078197][ T3443] loop3: detected capacity change from 0 to 512 [ 33.083772][ T3300] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.086655][ T3443] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 33.094955][ T3300] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.108096][ T3443] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 33.117927][ T3300] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.136786][ T3443] EXT4-fs (loop3): 1 truncate cleaned up [ 33.138207][ T3300] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.144277][ T3443] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 33.153768][ T3300] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.153792][ T3300] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.171190][ T3443] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 33.180251][ T3300] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.205907][ T3300] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.214864][ T3300] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.223704][ T3300] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.232630][ T3300] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.248034][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.258643][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.268610][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.279093][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.289003][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.299556][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.309480][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.319983][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.331417][ T3297] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.343268][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.353938][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.363851][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.374368][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.384289][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.394754][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.404588][ T3297] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.415080][ T3297] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.427866][ T3297] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 33.446555][ T3297] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.455460][ T3297] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.464373][ T3297] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.473182][ T3297] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.722391][ T3464] loop2: detected capacity change from 0 to 128 [ 33.729835][ T3464] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 33.762370][ T3465] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 33.768982][ T3465] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 33.776794][ T3465] vhci_hcd vhci_hcd.0: Device attached [ 33.809827][ T3464] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 34.065633][ T25] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 34.075394][ T25] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz0 [ 34.089184][ T3458] usb 3-1: new high-speed USB device number 2 using vhci_hcd [ 34.109321][ T3466] vhci_hcd: connection closed [ 34.109788][ T51] vhci_hcd: stop threads [ 34.119068][ T51] vhci_hcd: release socket [ 34.123544][ T51] vhci_hcd: disconnect device [ 34.134736][ T3458] usb 3-1: enqueue for inactive port 0 [ 34.149782][ T3460] loop4: detected capacity change from 0 to 512 [ 34.150133][ T3458] usb 3-1: enqueue for inactive port 0 [ 34.163388][ T3460] EXT4-fs error (device loop4): ext4_get_journal_inode:5798: inode #32: comm syz.4.5: iget: special inode unallocated [ 34.168368][ T3458] usb 3-1: enqueue for inactive port 0 [ 34.189676][ T3460] EXT4-fs (loop4): Remounting filesystem read-only [ 34.196825][ T3460] EXT4-fs (loop4): no journal found [ 34.202089][ T3460] EXT4-fs (loop4): can't get journal size [ 34.232164][ T3460] EXT4-fs (loop4): warning: mounting fs with errors, running e2fsck is recommended [ 34.246046][ T3460] EXT4-fs (loop4): failed to initialize system zone (-117) [ 34.261642][ T3458] vhci_hcd: vhci_device speed not set [ 34.276046][ T3460] EXT4-fs (loop4): mount failed [ 34.405601][ T3487] loop0: detected capacity change from 0 to 128 [ 34.412561][ T3487] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 34.427902][ T3487] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 34.477296][ T25] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 34.508038][ T25] hid-generic 0000:0000:0000.0002: hidraw1: HID v0.00 Device [syz1] on syz0 [ 34.565672][ T3472] netlink: 'syz.3.11': attribute type 10 has an invalid length. [ 34.586553][ T3472] lo: entered promiscuous mode [ 34.605404][ T3472] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 34.674056][ T3499] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 34.680722][ T3499] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 34.688522][ T3499] vhci_hcd vhci_hcd.0: Device attached [ 34.715337][ T3500] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 0 [ 34.722561][ T37] vhci_hcd: stop threads [ 34.726904][ T37] vhci_hcd: release socket [ 34.731448][ T37] vhci_hcd: disconnect device [ 35.186042][ T3510] loop3: detected capacity change from 0 to 164 [ 35.193720][ T3510] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 35.247622][ T3374] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 35.262667][ T3374] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 35.283442][ T3516] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 35.290004][ T3516] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 35.297766][ T3516] vhci_hcd vhci_hcd.0: Device attached [ 35.351796][ T3521] loop4: detected capacity change from 0 to 164 [ 35.362369][ T3521] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 35.375532][ T3517] vhci_hcd: connection closed [ 35.376921][ T37] vhci_hcd: stop threads [ 35.385969][ T37] vhci_hcd: release socket [ 35.390462][ T37] vhci_hcd: disconnect device [ 35.401923][ T3521] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 35.610132][ T3537] loop2: detected capacity change from 0 to 2048 [ 35.646743][ T3537] loop2: p1 < > p4 [ 35.650920][ T3542] loop0: detected capacity change from 0 to 512 [ 35.651959][ T3537] loop2: p4 size 8388608 extends beyond EOD, truncated [ 35.670200][ T3542] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 35.685766][ T3542] EXT4-fs warning (device loop0): ext4_expand_extra_isize_ea:2863: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 35.701814][ T3000] loop2: p1 < > p4 [ 35.707030][ T3542] EXT4-fs (loop0): 1 truncate cleaned up [ 35.712905][ T3000] loop2: p4 size 8388608 extends beyond EOD, truncated [ 35.717169][ T3542] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 35.735446][ T3537] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 35.752976][ T3537] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 35.796283][ T3000] loop2: p1 < > p4 [ 35.801084][ T3000] loop2: p4 size 8388608 extends beyond EOD, truncated [ 35.846444][ T3374] IPVS: starting estimator thread 0... [ 35.901390][ T3550] loop1: detected capacity change from 0 to 164 [ 35.909860][ T3550] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 35.946311][ T3548] IPVS: using max 2304 ests per chain, 115200 per kthread [ 36.106998][ T3556] loop1: detected capacity change from 0 to 164 [ 36.114790][ T3556] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 36.396822][ T3364] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 36.412387][ T3364] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 36.455985][ T3582] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 36.462621][ T3582] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 36.470432][ T3582] vhci_hcd vhci_hcd.0: Device attached [ 36.491468][ T3300] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 36.492286][ T3584] usbip_core: unknown command [ 36.505405][ T3584] vhci_hcd: unknown pdu 0 [ 36.509819][ T3584] usbip_core: unknown command [ 36.536062][ T31] vhci_hcd: stop threads [ 36.540477][ T31] vhci_hcd: release socket [ 36.544913][ T31] vhci_hcd: disconnect device [ 36.722778][ T3575] netlink: 'syz.2.51': attribute type 10 has an invalid length. [ 36.750493][ T3575] lo: entered promiscuous mode [ 36.755408][ C1] hrtimer: interrupt took 28281 ns [ 36.768737][ T3575] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 36.863190][ T3607] loop4: detected capacity change from 0 to 128 [ 36.877649][ T3607] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 36.939707][ T3607] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 37.057878][ T3364] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 37.067477][ T3615] loop0: detected capacity change from 0 to 128 [ 37.074205][ T3615] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 37.087976][ T3615] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 37.201443][ T3618] Zero length message leads to an empty skb [ 37.264650][ T3364] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 37.517416][ T29] kauditd_printk_skb: 676 callbacks suppressed [ 37.517432][ T29] audit: type=1400 audit(1742738053.579:797): avc: denied { create } for pid=3620 comm="syz.1.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.527098][ T3621] sctp: [Deprecated]: syz.1.66 (pid 3621) Use of int in max_burst socket option. [ 37.527098][ T3621] Use struct sctp_assoc_value instead [ 37.627708][ T29] audit: type=1400 audit(1742738053.589:798): avc: denied { setopt } for pid=3620 comm="syz.1.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 37.647737][ T29] audit: type=1400 audit(1742738053.589:799): avc: denied { getopt } for pid=3620 comm="syz.1.66" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 37.827976][ T29] audit: type=1400 audit(1742738053.749:800): avc: denied { write } for pid=3620 comm="syz.1.66" name="ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 37.851352][ T29] audit: type=1400 audit(1742738053.749:801): avc: denied { open } for pid=3620 comm="syz.1.66" path="/dev/ppp" dev="devtmpfs" ino=140 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 37.875154][ T29] audit: type=1400 audit(1742738053.749:802): avc: denied { ioctl } for pid=3620 comm="syz.1.66" path="/dev/ppp" dev="devtmpfs" ino=140 ioctlcmd=0x7438 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 37.899895][ T29] audit: type=1400 audit(1742738053.779:803): avc: denied { sqpoll } for pid=3625 comm="syz.3.68" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 38.172951][ T29] audit: type=1326 audit(1742738054.229:804): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3637 comm="syz.0.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f525b324127 code=0x7ffc0000 [ 38.196471][ T29] audit: type=1326 audit(1742738054.229:805): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3637 comm="syz.0.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f525b2c9359 code=0x7ffc0000 [ 38.220318][ T29] audit: type=1326 audit(1742738054.229:806): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3637 comm="syz.0.70" exe="/root/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f525b324127 code=0x7ffc0000 [ 38.302926][ T3647] serio: Serial port ptm0 [ 38.584206][ T3697] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(3) [ 38.590846][ T3697] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 38.599069][ T3697] vhci_hcd vhci_hcd.0: Device attached [ 38.614564][ T3698] vhci_hcd: cannot find a urb of seqnum 0 max seqnum 0 [ 38.622009][ T3694] vhci_hcd: stop threads [ 38.626355][ T3694] vhci_hcd: release socket [ 38.630816][ T3694] vhci_hcd: disconnect device [ 39.551606][ T3735] loop4: detected capacity change from 0 to 512 [ 39.567454][ T3735] journal_path: Non-blockdev passed as './bus' [ 39.573807][ T3735] EXT4-fs: error: could not find journal device path [ 39.672582][ T3742] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 39.679178][ T3742] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 39.686936][ T3742] vhci_hcd vhci_hcd.0: Device attached [ 39.714445][ T3745] loop0: detected capacity change from 0 to 2048 [ 39.721521][ T3746] usbip_core: unknown command [ 39.726364][ T3746] vhci_hcd: unknown pdu 0 [ 39.730915][ T3746] usbip_core: unknown command [ 39.736449][ T3654] vhci_hcd: stop threads [ 39.740907][ T3654] vhci_hcd: release socket [ 39.745588][ T3654] vhci_hcd: disconnect device [ 39.773204][ T3752] serio: Serial port ptm0 [ 39.782461][ T3745] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 39.841035][ T3745] ext4 filesystem being mounted at /26/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.860715][ T3757] loop1: detected capacity change from 0 to 2048 [ 39.896708][ T3757] loop1: p1 < > p4 [ 39.902872][ T3757] loop1: p4 size 8388608 extends beyond EOD, truncated [ 39.924466][ T3757] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 39.958674][ T3757] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 40.011760][ T3693] EXT4-fs error (device loop0): ext4_validate_block_bitmap:441: comm kworker/u8:55: bg 0: block 345: padding at end of block bitmap is not set [ 40.030455][ T3000] loop1: p1 < > p4 [ 40.035127][ T3000] loop1: p4 size 8388608 extends beyond EOD, truncated [ 40.043998][ T3693] EXT4-fs (loop0): Delayed block allocation failed for inode 15 at logical offset 16 with max blocks 1383 with error 117 [ 40.047165][ T3764] sd 0:0:1:0: device reset [ 40.056868][ T3693] EXT4-fs (loop0): This should not happen!! Data will be lost [ 40.056868][ T3693] [ 40.117763][ T3300] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.411438][ T3781] loop4: detected capacity change from 0 to 2048 [ 40.438913][ T3781] loop4: p1 < > p4 [ 40.443415][ T3781] loop4: p4 size 8388608 extends beyond EOD, truncated [ 40.494902][ T3000] loop4: p1 < > p4 [ 40.505196][ T3000] loop4: p4 size 8388608 extends beyond EOD, truncated [ 40.560049][ T3491] udevd[3491]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 40.563597][ T3290] udevd[3290]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 40.614918][ T3793] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 40.621543][ T3793] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 40.629495][ T3793] vhci_hcd vhci_hcd.0: Device attached [ 40.669281][ T3794] usbip_core: unknown command [ 40.674010][ T3794] vhci_hcd: unknown pdu 0 [ 40.678391][ T3794] usbip_core: unknown command [ 40.697054][ T3797] loop3: detected capacity change from 0 to 512 [ 40.719784][ T3797] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 40.729919][ T3731] vhci_hcd: stop threads [ 40.734185][ T3731] vhci_hcd: release socket [ 40.738793][ T3731] vhci_hcd: disconnect device [ 40.754439][ T3797] EXT4-fs (loop3): 1 truncate cleaned up [ 40.764130][ T3797] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 40.794748][ T3797] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 40.821995][ T3364] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 40.832236][ T3364] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 40.865615][ T3759] syz.2.93 (3759) used greatest stack depth: 10736 bytes left [ 40.939562][ T3816] loop2: detected capacity change from 0 to 2048 [ 40.976953][ T3816] loop2: p1 < > p4 [ 40.981574][ T3816] loop2: p4 size 8388608 extends beyond EOD, truncated [ 41.028192][ T3000] loop2: p1 < > p4 [ 41.034836][ T3000] loop2: p4 size 8388608 extends beyond EOD, truncated [ 41.069173][ T3290] udevd[3290]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 41.080860][ T3491] udevd[3491]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 41.117147][ T3807] netlink: 'syz.4.111': attribute type 10 has an invalid length. [ 41.127857][ T3807] lo: entered promiscuous mode [ 41.141403][ T3807] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 41.191745][ T3302] ================================================================== [ 41.199893][ T3302] BUG: KCSAN: data-race in shmem_getattr / shmem_recalc_inode [ 41.207428][ T3302] [ 41.210032][ T3302] read-write to 0xffff888117cc5468 of 8 bytes by task 3824 on cpu 1: [ 41.218135][ T3302] shmem_recalc_inode+0x36/0x1b0 [ 41.223105][ T3302] shmem_get_folio_gfp+0x7ce/0xd90 [ 41.228254][ T3302] shmem_write_begin+0xa2/0x180 [ 41.233113][ T3302] generic_perform_write+0x187/0x4a0 [ 41.238410][ T3302] shmem_file_write_iter+0xc2/0xe0 [ 41.243621][ T3302] __kernel_write_iter+0x247/0x4c0 [ 41.248763][ T3302] dump_user_range+0x3c0/0x560 [ 41.253541][ T3302] elf_core_dump+0x1d17/0x1ea0 [ 41.258332][ T3302] do_coredump+0x17fe/0x1f40 [ 41.262968][ T3302] get_signal+0xd4f/0x1000 [ 41.267564][ T3302] arch_do_signal_or_restart+0x95/0x4b0 [ 41.273131][ T3302] irqentry_exit_to_user_mode+0xa7/0x120 [ 41.278793][ T3302] irqentry_exit+0x12/0x50 [ 41.283235][ T3302] asm_exc_page_fault+0x26/0x30 [ 41.288189][ T3302] [ 41.290611][ T3302] read to 0xffff888117cc5468 of 8 bytes by task 3302 on cpu 0: [ 41.298154][ T3302] shmem_getattr+0x42/0x200 [ 41.302665][ T3302] vfs_getattr+0x172/0x1b0 [ 41.307130][ T3302] vfs_statx+0x12d/0x320 [ 41.311397][ T3302] vfs_fstatat+0xe4/0x130 [ 41.315780][ T3302] __se_sys_newfstatat+0x58/0x260 [ 41.320819][ T3302] __x64_sys_newfstatat+0x55/0x70 [ 41.325922][ T3302] x64_sys_call+0x236d/0x2dc0 [ 41.330612][ T3302] do_syscall_64+0xc9/0x1c0 [ 41.335163][ T3302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 41.341091][ T3302] [ 41.343413][ T3302] value changed: 0x0000000000000199 -> 0x000000000000019e [ 41.350523][ T3302] [ 41.352860][ T3302] Reported by Kernel Concurrency Sanitizer on: [ 41.359041][ T3302] CPU: 0 UID: 0 PID: 3302 Comm: syz-executor Not tainted 6.14.0-rc7-syzkaller-00202-g183601b78a9b #0 [ 41.369895][ T3302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 41.379965][ T3302] ================================================================== [ 41.422955][ T3826] serio: Serial port ptm0