last executing test programs: 1.016105714s ago: executing program 4 (id=9): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x40, 0x5, 0x7fff7ffc}]}) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2401, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0x10000, 0x6, 0xc, 0x1000000, 0x7, 0xe, 0x5, 0x1, 0x8000009654, 0x1, 0x7fffffff, 0x0, 0x10, 0xb, 0xffff, 0x200cc0, 0x1, 0x5, 0x0, 0xfffffffffffffffc, 0x0, 0x809, 0x0, 0x5, 0x6, 0x9}) 976.389915ms ago: executing program 0 (id=1): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x801, 0x70bd2c, 0xffffffff, {0x0, 0x0, 0x0, 0x0, 0x1feff, 0x1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r1, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) 947.592006ms ago: executing program 4 (id=10): write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000080)=ANY=[@ANYBLOB="1303000055"], 0xfe33) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x2000002, 0x3a, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 818.308709ms ago: executing program 4 (id=12): r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x18b) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x16) flock(r1, 0x1780f9c373410de4) flock(r0, 0x2) flock(r2, 0x598a3f5062355775) 800.586ms ago: executing program 4 (id=14): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x42, 0x0, 0x1, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file1\x00', 0x101546, 0x0) fsetxattr(r0, &(0x7f0000000400)=@known='trusted.overlay.metacopy\x00', 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f0000000240)='./file0/file1\x00', 0x0, 0x0, 0x0, 0x0) 759.44979ms ago: executing program 2 (id=16): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f00000001c0), 0x12) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006b01a400000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xb5}, 0x48) 759.053821ms ago: executing program 4 (id=17): syz_open_dev$tty1(0xc, 0x4, 0x1) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') unshare(0x22020600) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x28040, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_HYPERV_EVENTFD(r2, 0x4018aebd, &(0x7f0000000240)={0x2, r0}) 738.592151ms ago: executing program 2 (id=18): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000280)='./file1\x00', 0x0, &(0x7f0000001400)={[{@grpid}, {@mblk_io_submit}, {@nodioread_nolock}, {@test_dummy_encryption}, {@inode_readahead_blks}, {@nodelalloc}, {@minixdf}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x40}}]}, 0x1, 0xbaf, &(0x7f00000025c0)="$eJzs3M1rXFUbAPDn3ny2zftO+vIi1k0jIi2o07SSYotgKxU3LgTdCg3ppIRMP0giNWkWE/0HRF0LbgS1KF3YdTcKbt1o3VpcCEVioyCikTsfSWxmkrSd5Ibk94Mz95w5d+Z5nrlM7j0wNwHsWgPZQxpxICLOJhGF+vNpRHRXe70Rldp+C/OzI7/Pz44ksbj42i9JJBFxd352pPFeSX27rz7ojYhvX0zif++sjjs5PTM+XC6XJurjI1MXLh+ZnJ55ZuzC8PnS+dLFo8efGzo2dHzwxFDbav3jx1M3fnv85Z8qf37617Vf3/84iVPRV59bWUe7DMTA0meyUmdEDLc7WE466vWsrDPpXOdF6SYnBQBAS+mKa7hHohAdsXzxVoivvss1OQAAAKAtFjsiFgEAAIAdLrH+BwAAgB2u8TuAu/OzI42W7y8Sttad0xHRX6t/od5qM51RqW57oysi9t5NYuVtrUntZQ9tICJu/3Dii6zFJt2HvJbKXEQ82uz4J9X6+6t3ca+uP42IwTbEH7hnvN3qf7q7df2n2hA/7/oB2J1unq6dyFaf/9Kl659ocv7rbHLuehB5n/8a138Lq67/luvvaHH99+oGY1z95MMrreay+p+/8dLnjZbFz7YPVdR9uDMX8Vhns/qTpfqTFvWf3WCMwt9XSq3m8q5/8aOIQ9G8/oZk7f9PdGR0rFwarD02jTH3zdBnreLnXX92/Pe2qH+94395gzHeOHPmequ59etPf+5OXq/2uuvPvDU8NTVxNKI7eWX188fqN7S30Nin8R5Z/YefWPv736z+LESl/jlka4G5+jYbv31PzBeuXf1yrfqztV+ex//cAx7/dzcY48mv3zvcam7l+jdrWfzbSW0tDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANaUT0RZIWl/ppWixG7IuI/8fetHxpcuqp0UtvXjyXzUX0R1c6OlYuDUZEoTZOsvHRan95fOye8bMRsT8iPijsqY6LI5fK5/IuHgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCX7IqIvkrQYEWlELBTStFjMOysAAACg7frzTgAAAADYdNb/AAAAsPNZ/wMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDJ9h+8eSuJiMrJPdWW6a7PdeWaGbDZ0rwTAHLTkXcCQG46804AyM19rvFdLsAOlKwz39typqftuQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwfR06cPNWEhGVk3uqLdNdn+tq+oqDW5gdsJnSvBMActOx1mTn1uUBbD1fcdi9mq/xgd0kWWe+d3mfyr9nejYtJwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC2n75qS9JiRKTVfpoWixH/iYj+6EpGx8qlwYj4b0R8X+jqycY9eScNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA201Oz4wPl8ulCR0dnXw7yfZIo9bJ+y8TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5mJyeGR8ul0sTk3lnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAORtcnpmfLhcLk1soHP9fnZe0cm7RgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8vNPAAAA///5ZQ4Q") syz_mount_image$vfat(&(0x7f0000000180), &(0x7f00000000c0)='./bus\x00', 0x1800018, 0x0, 0x1, 0x0, &(0x7f00000001c0)) chdir(&(0x7f0000000140)='./bus\x00') mkdir(&(0x7f00000001c0)='./bus\x00', 0xcb1306addc857445) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents(r0, &(0x7f0000000700)=""/48, 0x30) 707.952692ms ago: executing program 4 (id=19): ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000300)={0x52, 0x0, 0x8, {0x0, 0x1}, {0x74, 0x2}, @const={0x0, {0x0, 0x3400}}}) r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x822b01) socket$inet_tcp(0x2, 0x1, 0x0) pselect6(0x40, &(0x7f00000004c0)={0x3, 0x4, 0x1, 0x8000000000000000, 0x10000000004, 0x80000000, 0x200, 0x1ff}, 0x0, &(0x7f0000000480)={0x18, 0xfffffffffffffffd, 0x1, 0x2, 0x0, 0x9, 0x200403, 0x80000001}, 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000100), 0x3fc000000000000, 0x2000) write$char_usb(r0, &(0x7f0000000040)="e2", 0xff0f) 537.531256ms ago: executing program 2 (id=22): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./config\x00', &(0x7f00000000c0)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./config/usb_gadget/g1\x00', 0x1ff) mkdir(&(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdir(&(0x7f0000000500)='./config/usb_gadget/g1/functions/ncm.usb0\x00', 0x1ff) symlink(&(0x7f0000000600)='./config/usb_gadget/g1/functions/ncm.usb0\x00', &(0x7f0000000700)='./config/usb_gadget/g1/configs/c.1/ncm.usb0\x00') 526.553276ms ago: executing program 0 (id=24): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="12000000040000000400000008"], 0x48) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000100), 0x405, r1}, 0x38) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000800000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x18, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387db05abc8996f5bec", 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 521.898716ms ago: executing program 3 (id=25): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) pivot_root(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='./cgroup\x00') ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r2}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r2}) 500.174127ms ago: executing program 0 (id=26): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x200c8) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000840)=ANY=[@ANYBLOB="1c000000030303"], 0x1c}}, 0x0) 488.401108ms ago: executing program 3 (id=27): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[], 0x150}, 0x1, 0x0, 0x0, 0x2000c094}, 0x4040080) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="7c000000100001040064ffffff00000000000000", @ANYRES32=r2, @ANYBLOB="31000000bf3f9f8008000a00", @ANYRES32=0x0, @ANYBLOB="54001280110001006272696467655f736c617665000000003c00058008002200", @ANYBLOB="08000300400000000500200001000000050001000300000008002500"], 0x7c}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x2000000) 441.334458ms ago: executing program 0 (id=29): syz_mount_image$exfat(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', 0x20010080, &(0x7f0000000080)=ANY=[@ANYRES64=0x0, @ANYRES64, @ANYRES64, @ANYRESHEX, @ANYRES32, @ANYRES32, @ANYRES8, @ANYRES8, @ANYRESOCT, @ANYRES64], 0x1, 0x14e6, &(0x7f0000002a80)="$eJzs3Au4jdX2MPAx5pwvm6SV5LKZY46XlVwmSZJLklySJEmS3BKSJElCYpNbEpKQe5J7SG4hud9vuSfJkSRJSEgyv0enc5zz73xP/++cvs/3fXv8nmc+e479rjHXmGusvdf7rmfv9W2HQVXqVa1Yh5nhP4J//ZIGACkA0BcArgGACABKZiuZ7dLxTBrT/rM7EX+uh6Ze6QrElST9T9+k/+mb9D99k/6nb9L/9E36n75J/9M36b8Q6dnWabmvlZF+h7z/n57J63/6Jv1P36T/6Zv0P32T/qdv0v//D5h/P1X6n75J/9M36b8Q6dmVfv/5/52R8bdH7ErX8eeOK/z0E0IIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgiRTpwLlxkA+Nv8StclhBBCCCGEEEKIP0/IeKUrEEIIIYQQQgghxP9+CAo0GIggA2SEFMgEmeEqyAJXQ1a4BhJwLWSD6yA7XA85ICfkgtyQCnkgL1ggcMAQQz7ID0m4AQrAjVAQCkFhKAIeikIxuAmKw81QAm6BknArlILboDSUgbJQDm6H8nAHVIA7oSLcBZWgMlSBqnA3VIN7oDrcCzXgPqgJ90MteABqw4NQBx6CuvAw1INHoD48Cg2gITSCxtDk38p/EbrAS9AVukEadIce8DL0hF7QG/pAX3gF+sGr0B9egwEwEAbB6zAY3oAh8CYMhWEwHN6CETASRsFoGANjYRy8DePhHZgA78JEmASTYQpMhWkwHd6DGTATZsH7MBs+gDkwF+bBfFgAH8JCWASL4SNYAh/DUlgGy2EFrIRVsBrWwFpYB+thA2yETbAZtsBW+AS2wXbYATthF+yGPfAp7IXPYB98Dvvhi//F/LP/Jb8jAgIqVGjQYAbMgCmYgpkxM2bBLJgVs2ICE5gNs/39yZILc2EqpmJezIuEhIyM+TAfJjGJBbAAFsSCWBgLo0ePxbAYFsebsQSWwJJYEkthKSyNZbAMlsNyWB7LYwWsgBWxIlbCSlgFq+DdeDfeg9WxOtbAGlgTa2ItrIW1sTbWwTpYF+tiPayH9bE+NsAG2AgbYRNsgk2xKTbDZtgCW2BLbImtsBW2xtbYBttgW2yL7bAdtsf22AE7YEfshJ3wRXwRX8KXsBtWUt2xB/bAntgTe2Mf7IOvYD98FV/F13AADsRB+Dq+jm/gEDyDQ3EYDsfhWF6NxFE4GlmNxXE4DsfjeJyAE3AiTsJJOAWn4jScjtNxBs7Emfg+zsYP8AOci3NxPi7ABbgQF+FiXIxL8CwuxWW4HFfgSlyFK3ENrsU1uB434HrchJtwC27BT/AT3I7bcSfuxN24Gz/FT/Ez/AwH4H7cjwfwAB7Eg3gID+FhPIxH8AgexaN4DI/hcTyOJ/AknsKTeBpP4xk8i+fwHJ7H83gBn0/9uu7uQusGgLrEKKMyqAwqRaWozCqzyqKyqKwqq0qohMqmsqnsKrvKoXKoXCqXSlWpKq/Kq0iRYhWrfCqfSqqkKqAKqIIKVGFVWHnlVTFVTBVXxVUJVUKVVLeqUuo2VVqVUc19OVVOlVctfAV1p6qoKqpKqrKqoqqqqqqaqqaqq+qqhqqhaqqaqpZ6QNVW3bE3PqQudaaeGoj11SBsoBqqRqqxegMfU03VEGymmqsW6gk1DIdiK9XUt1ZPqzZqFLZVz6rR+Jxqr8ZiB/WC6qg6qc7qRdVFNfNdVTc1EburHmoK9lS9VG/VR83AyupSx6qo19QANVANUq+r+fiGGqLeVEPVMDVcvaVGqJFqlBqtxqixapx6W41X76gJ6l01UU1Sk9UUNVVNU9PVe2qGmqlmqffVbPWBmqPmqnlqvlqgPlQL1SIF8JFaoj5WS9UytVytUCvVKrVarVFr1Tq1Xm1QG9UmtVltUVvVJ2qb2q52qJ1ql9qt9qhP1V71mdqnPlf71RfqgPqLOqi+VIfUV+qw+lodUd+oo+pbdUx9p46r79UJdVKdUj+o0+pHdQbxrz/F6md1Qf2iLqqgQKNWWmujI51BZ9QpOpPOrK/SWfTVOqu+Rif0tTqbvk5n19frHDqnzqVz61SdR+fVVpN2mnWs8+n8Oqlv0AX0jbqgLqQL6yLa66K6mL5JF9c36xL6Fl1S36pL6dt0aV1Gl9Xl9O26vL5DV9B36or6Ll1JV9ZVdFV9t66m79HV9b26hr5P19T361r6AV1bP6jr6Id0Xf2wrqcf0fX1o7qBbqgb6ca6iX5MN9WP62a6uW6hn9At9ZO6lX5Kt9ZP6zb6Gd1WP6vb6ed0e/287qBf0B11J91Z/6Iv6qC76m46TXfXPfTLuqfupXvrPrqvfkX306/q/vo1PUAP1IP063qwfkMP0W/qoXqYHq7f0iP0SD1Kj9Zj9Fg9Tr+tx+t39AT9rp6oJ+nJeoqeqqfp3r+tNOu/kf/Ov8jv/+u9b9Fb9Sd6m96ud+idepferffoPXqv3qv36X16v96vD+gD+qA+qA/pQ/qwPqyP6CP6qD6qj+lj+rg+rk/ok/on/YM+rX/UZ/RZfVb/pM/r8/rCb48BGDTKaGNMZDKYjCbFZDKZzVUmi7naZDXXmIS51mQz15ns5nqTw+Q0uUxuk2rymLzGGjLOsIlNPpPfJM0NpoC50RQ0hUxhU8R4U9QUMzf9x/l/VF8T08Q0NU1NM9PMtDAtTEvT0rQyrUxr09q0MW1MW9PWtDPtTHvT3nQwHUxH09F0Np1NF9PFdDVdTZpJMz3My6an6WV6mz6mr3nF9DP9TH/T3wwwA8wgM8gMNoPNEDPEDDVDzXAz3IwwI8woM8qMMWPMODPOjDfjzQQzwUw0E81kM9lMNVPNdDPdzDAzzCwzy8w2s80cM8fMM/PMArPALDQLzWKz2CwxS8xSs8wsMyvMCrPKrDJrzBqzzqwzG8wGs8lsMkvNVrPVbDPbzA6zw+wyu8wes8fsNXvNPrPP7Df7zQFzwBw0B80hc8gcNofNEXPEHDVHzTFzzBw3x80Jc8KcMqfMaXPanDFnzDlzzpw3580Fc8FcNBcvnfZFKlKRiUyUIcoQpUQpUeYoc5QlyhJljbJGiSgRZYuyRdmj66McUc4oV5Q7So3yRHkjG1HkIo7iKF+UP0pGN0QFohujglGhqHBUJPJR0ahYdFNUPLo5KhHdEpWMbo1KRbdFpaMyUdmoXHR7VD66I6oQ3RlVjO6KKkWVoypR1ejuqFp0T1Q9ujeqEd0X1Yzuj2pFD0S1owejOtFDUd3o4ahe9EhUP3o0ahA1jBpFjaMmf+r6IZzJ+bjvarvZNNvd9rAv2562l+1t+9i+9hXbz75q+9vX7AA70A6yr9vB9g07xL5ph9phdrh9y46wI+0oO9qOsWPtOPu2HW/fsRPsu3ainWQn2yl2qp1mp9v37Aw7086y79vZ9gM7x8618+x8u8B+aBfaRXax/cgusR/bpXaZXW5X2JV2lV1t19i1dp1dbzfYjXaT3Wy32K32E7vNbrc77E67y+62e+yndq/9zO6zn9v99gt7wP7FKvjSHrJf2cP2a3vEfmOP2m/tMfudPW6/tyfsSXvK/mBP2x/tGXvWnrM/2fP2Z3vB/mIv2nDp5P7SyzsZMpSBMlAKpVBmykxZKAtlpayUoARlo2yUnbJTDspBuSgXpVIq5aW8dAkTUz7KR0lKUgEqQAWpIBWmwuTJUzEqRsWpOJWgElSSSlIpKkWlqTSVpbJ0O91Od9AddCfdSXfRXVSZKlNVqkrVqBpVp+pUg2pQTapJtagW1abaVIfqUF2qS/WoHtWn+tSAGlAjakRNqAk1pabUjJpRC2pBLakltaJW1JpaUxtqQ22pLbWjdtSe2lMH6kAdqSN1ps7UhbpQV+pKaZRGPagH9aSe1Jt6U1/qS/2oH/Wn/jSABtAgGkSDaTANoSE0lIbRcHqLRtBIGkWjaQyNpXE0jsbTeJpAE2giTaTJNJmm0lSaTtNpBs2gWTSLZtNsmkNzaB7NowW0gBbSQlpMi2kJLaGltJSW03JaSStpNa2mtbSW1tN62kgbaTNtpq20lbbRNtpBO2gX7aI9tIf20l7aR/toP+2nA3SADtJBOkSH6DAdpiN0hI7SUTpGx+g4HacTdIJO0Sk6TafpDJ2hc3SOztPPdIF+oYsUKMVlcpndVS6Lu9pldde4/xrncrldqsvj8jrrcric/xSTc66gK+QKuyLOu6KumLvpd3FpV8aVdeXc7a68u8NV+F1czd3jqrt7XQ13n6vq7v6nuKa739Vyj7ja7lFXxzV0dV1jV8894uq7R10D19A1co1dS/eka+Wecq3d066Ne+Z38UK3yK1169x6t8HtdZ+5c+4nd9R96867n11X1831da+4fu5V19+95ga4gb+Lh7u33Ag30o1yo90YN/Z38WQ3xU1109x0956b4Wb+Ll7gPnSz3WI3x81189z8X+NLNS12H7kl7mO31C1zy90Kt9Ktcqvdmr/XusJtcpvdFrfHfeq2ue1uh9vpdrndv8aX9rHPfe72uy/cEfeNO+i+dIfcMXfYff1rfGl/x9x37rj73p1wJ90p94M77X50Z9zZX/d/ae8/uF/cRRccMLJizYYjzsAZOYUzcWa+irPw1ZyVr+EEX8vZ+DrOztdzDs7JuTg3p3IezsuWiR0zx5yP83OSb+ACfCMX5EJcmIuw56JcjG/i4nwzl+BbuCTfyqX4Ni7NZbgsl+PbuTzfwRX4Tq7Id3ElrsxVuCrfzdX4Hq7O93INvo9r8v1cix/g2vwg1+GHuC4/zPX4Ea7Pj3IDbsiNuDE34ce4KT/Ozbg5t+AnuCU/ya34KW7NT3Mbfobb8rPcjp/j9vw8d+AXuCN34s78Infhl7grd+M07s49+GXuyb24N/fhvvwK9+NXuT+/xgN4IA/i13kwv8FD+E0eysN4OL/FI3gkj+LRPIbH8jh+m8fzOzyB3+WJPIkn8xSeytN4Or/HM3gmz+L3eTZ/wHN4LgPM5wX8IS/kRbyYP+Il/DEv5WW8nFfwSl7Fq3kNr+V1vJ438EbexJt5C2/lT3gbb+cdvJN38W7ew5/yXv6M9/HnvJ+/4AP8Fz7IX/Ih/ooP89d8hL/ho/wtH+Pv+Dh/zyf4JJ/iH/g0/8hn+Cyf45/4PP/MF/gXvsiBIcZYxTo2cRRniDPGKXGmOHN8VZwlvjrOGl8TJ+Jr42zxdXH2+Po4R5wzzhXnjlPjPHHe2MYUu5jjOM4X54+T8Q1xgfjGuGBcKC4cF4l9XDQuFt8UF49vjkvEt8Ql41vjUvFtcem4TPzIfeXi2+Py8R1xhfjOuGJ8V1wprhxXiavGd8fV4nvi6vG9cY34vrhEfH9cK34grh0/GNeJH4rrxg/H9eJH4vrxo3GDuGHcKG4cN4kfi5vGj8fN4uZxi/iJuGX8ZNwqfipuHT8dt4mf+cPjaXH3uEf8cvxyHMK9el5yfnJB8sPkwuSi5OLkR8klyY+TS5PLksuTK5Irk6uSq5NrkmuT65LrkxuSG5ObkpuTW5IhVM0IHr3y2hsf+Qw+o0/xmXxmf5XP4q/2Wf01PuGv9dn8dT67v97n8Dl9Lp/bp/o8Pq+3nrzz7GOfz+f3SX+DL+Bv9AV9IV/YF/HeF/XFfGPfxDfxTf3jvplv7lv4J/wT/kn/pH/KP+Wf9m38M76tf9a388/59v55/7x/wXf0nXxn/6Lv4l/yXX03n+bTfA/fw/f0PX1v39v39X19P9/P9/f9/QA/wA/yg/xgP9gP8UP8UD/UD/fD/Qg/wo/yo/wYP8aP8+P8eD/eT/AT/EQ/0U/2k/1UP9VP99P9DD/Dz/Kz/OyCs/0cP8fP8/P8Ar/AL/QL/WK/2C/xS/xSv9Qv98v9Sr/Sr/ar/Vq/1q/36/1Gv9Fv9pv9Vr/Vb/Pb/A6/w+/yu/wev8fv9Xv9Pr/P7/f7/QF/wB/0B/0h/5U/7L/2R/w3/qj/1h/z3/nj/nt/wp/0p/wP/rT/0Z/xZ/05/5M/73/2F/wv/qIPflzi7cT4xDuJCYl3ExMTkxKTE1MSUxPTEtMT7yVmJGYmZiXeT8xOfJCYk5ibmJeYn1iQ+DCxMLEosTjxUWJJ4uPE0sSyxPLEisTKxKpECHm2xSFfyB+S4YZQINwYCoZCoXAoEnwoGoqFm0LxcHMoEW4JJcOtoVS4LZQOZULZ8GhoEBqGRqFxaBIeC03D46FZaB5ahCdCy/BkaBWeCq3D06FNeCa0Dc+GduG50D48HzqEF0LH0Cl0Di+GLuGl0DV0C2mhe+gRXg49Q6/QO/QJfcMroV94NfQPr4UBYWAYFF4Pg8MbYUh4MwwNw8Lw8FYYEUaGUWF0GBPGhnHh7TA+vBMmhHfDxDApTA5TwtQwLUwP74UZYWaYFd4Ps8MHYU6YG+aF+WFB+DAsDIvC4vBRWBI+DkvDsrA8rAgrw6qwOqwJa8O6sD5sCBvDprA5bAlbwydhW9gedoSdYVfYHfaET8Pe8FnYFz4P+8MX4UD4SzgYvgyHwlfhcPg6HAnfhKPh23AsfBeOh+/DiXAynAo/hNPhx3AmnA3nwk/hfPg5XAi/hIvyP2tCCCGEEP8tff/gePd/8T3127gkDQCu3p778D8e1wCwMcdf571UassEADzdrcNDfxuVKqWlpf1226UaovxzASBxOT8DXI6XQQt4ElpD80y//qnC7/RSnc7zH6yfvBUg8z/kpMDl+O/rw83/cv+91MjZf7j+XICC+S/nXCr1b/Hl9Uv8T9bP2fQP1s/05TiAZv+QkwUux5fXLwaPwzPQ+p9uKYQQQgghhBBC/FUvVbbdH13fXro+TzWXczLC5fjy9WfxK1K/EEIIIYQQQggh/thznTo/9Vjr1s3byeT/xsluaZNMrszkCv9iEkIIIYQQQvzpLp/0X+lKhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEKI9Ov/xMeJXek9CiGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEFfa/wgAAP//1Wwqbg==") mprotect(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x0) creat(&(0x7f0000000100)='./bus\x00', 0x44) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000140)='./bus\x00', 0x0, 0x301400, 0x0) r0 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x47) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x78c00}], 0x1, 0x7a00, 0x0, 0x3) 426.661559ms ago: executing program 3 (id=30): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) io_uring_setup(0x666, &(0x7f00000002c0)={0x0, 0x284f, 0x40, 0xfffffffe, 0x235}) ppoll(&(0x7f0000000080)=[{0xffffffffffffffff, 0x2000}], 0x1, 0x0, 0x0, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x200000b, 0x204031, 0xffffffffffffffff, 0xffffd000) 410.246959ms ago: executing program 2 (id=31): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet_opts(r0, 0x0, 0xd, &(0x7f00000008c0)=';', 0x1) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x632a, 0x4) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000000)=0xb2, 0x4) sendmmsg$inet6(r0, &(0x7f0000000e00)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000700)=[{{0x0, 0x0, 0x0}, 0xcd}], 0x1, 0x2003, 0x0) 399.33383ms ago: executing program 2 (id=32): syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f00000001c0)='./file1\x00', 0x8000, &(0x7f0000000040)=ANY=[], 0x1, 0x14fe, &(0x7f0000002a80)="$eJzs3AuYjlXXOPC99t43Y5r0NMlh2GuvmycNtkmSHBJySJIkSXJKSJokSUgMOSUNSchxkhyGkBymMWmcz4eckyavNEkSEhL2/9J78L5v7/f1ff/e/993fbN+17Wv2WvuZ61n3bPmmue+n+ua57ueo+q1qF+7GRGJPwT+/CVFCBEjhBgmhLhOCBEIISrFV4q/fLyAgpQ/9iTs3+vh9KvdAbuaeP55G88/b+P55208/7yN55+38fzzNp5/3sbzZywv2z6n2PW88u7i9//zMn79/18kt/zkrzaWv7HXfyOF55+38fzzNp5/3sbzz9t4/nkbz/9/v1r/yTGef97G82csL9sOWoj/Ae9D87o662r//jHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYyxvO+Su0EOKv+6vdF2OMMcYYY4wxxv59fP6r3QFjjDHGGGOMMcb+3wMhhRJaBCKfyC9iRAERK64RceJaUVBcJyLiehEvbhCFxI2isCgiiopiIkEUFyWEESisIBGKkqKUiIqbRGlxs0gUZURZUU44UV4kiVtEBXGrqChuE5XE7aKyuENUEVVFNVFd3ClqiLtETVFL1BZ3izqirqgn6ot7RANxr2go7hONxP2isXhANBEPiqbiIdFMPCyai0dEC/GoaCkeE61Ea9FGtBXt/q/yXxJ9xcuin+gvUsQAMVC8IgaJwWKIGCqGiVfFcPGaGCFeF6lipBgl3hCjxZtijHhLjBXjxHjxtpggJopJYrKYIqaKNPGOmCbeFdPFe2KGmClmidkiXcwRc8X7Yp6YLxaID8RC8aFYJBaLJWKpyBAfiUyxTGSJj8Vy8YnIFivESrFKrBZrxFqxTqwXG8RGsUlsFlvEVrFNbBefih1ip9gldos9Yq/YJz4T+8Xn4oD4QuSIL/+b+Wf/Kb8XCBAgQYIGDfkgH8RADMRCLMRBHBSEghCBCMRDPBSCQlAYCkNRKAoJkAAloAQgIBAQlISSEIUolIbSkAiJUBbKggMHSZAEFeBWqAgVoRJUgspQGapAVagK1aE61IAaUBNqQm2oDXWgDtSDenAP3AP3QkNoCI2gETSGxtAEmkBTaArNoBk0h+bQAlpAS2gJraAVtIE20A7aQXtoDx2gA3SCTtAZOkMX6ALJkAxdoSt0g27QHbpDD+gBPaEn9ILe0BtegpfgZXgZ+kMdOQAGwkAYBINgCAyFofAqDIfX4DV4HVJhJIyCN+ANeBPGwBkYC+NgPIyHGnIiTILJQHIqpEEaTINpMB2mwwyYCTNhNqTDHJgLc2EezIf58AEshA/hQ1gMi2EpZEAGZMIyyIIsWA5nIRtWwEpYBathDayGdbAe1sFG2AQbYQtsgW2wDT6FT2En7ITdsBv2wl74DD6Dz+FzSIUcyIGDcBAOwSE4DIchF3LhCByBo3AUjsExOA7H4QSchFNwEk7DaTgDZ+EcnIPzcB4uwAsJ3zTfW2ZDqpCXaallPplPxsgYGStjZZyMkwVlQRmRERkv42UhWUgWloVlUVlUJsgEWUKWkChRkgxlSVlSRmVUlpalZaJMlGVlWemkk0kySVaQFWRFWVFWkrfLyvIOWUVWlR1ddVld1pCdXE1ZS9aWtWUdWVfWk/VlfdlANpANZUPZSDaSjWVj2UQ+KJvKATAEHpaXJ9NCjoSWchS0kq1lG9lWvgmPy/ZyDHSQHWUn+aQcB2Ohi2zvkuUzsqucBN3kc3IyPC97yKnQU74oe8neso98SfaVHVw/2V/OgAFyoJwNg+RgOUQOlfOgrrw8sXrydZkqR8pR8g25FN6UY+RbcqwcJ8fLt+UEOVFOkpPlFDlVpsl35DT5rpwu35Mz5Ew5S86W6XKOnCvfl/PkfLlAfiAXyg/lIrlYLpFLZYb8SGbKZTJLfiyXy09ktlwhV8pVcrVcI9fKdXK93CA3yk1ys9wit8ptcrv8VO6QO+UuuVvukXvlPvmZ3C8/lwfkFzJHfikPyj/JQ/IreVh+LXPlN/KI/FYeld/JY/J7eVz+IE/Ik/KU/FGelj/JM/KsPCd/luflL/KCvCgvSS+FAiWVUloFKp/Kr2JUARWrrlFx6lpVUF2nIup6Fa9uUIXUjaqwKqKKqmIqQRVXJZRRqKwiFaqSqpSKqptUaXWzSlRlVFlVTjlVXiWpW1QFdauqqG5TldTtqrK6Q1VRVVU1VV3dqWqou1RNVUvVVnerOqquqqfqq3tUA3WvaqjuU43U/aqxekA1UQ+qpuoh1Uw9rJqrR1QL9ahqqR5TrVRr1Ua1Ve3U46q9ekJ1UB1VJ/Wk6qyeUl3U0ypZPaO6qmdVN/Wc6q6eVz3UC6qnelH1Ur1VH3VRXVJe9VP9VYoaoAaqV9QgNVgNUUPVMPWqGq5eUyPU6ypVjVSj1BtqtHpTjVFvqbFqnBqv3lYT1EQ1SU1WU9RUlabeUdPUu2q6ek/NUDPVLDVbpas5ashfKi34L+S/+y/yR/z67NvUdvWp2qF2ql1qt9qj9qp9ap/ar/arA+qAylE56qA6qA6pQ+qwOqxyVa46oo6oo+qoOqaOqePquDqhTqqf1Y/qtPpJnVFn1Vn1szqvzqsLf/kZCA1aaqW1DnQ+nV/H6AI6Vl+j4/S1uqC+Tkf09Tpe36AL6Rt1YV1EF9XFdIIurktoo1FbTTrUJXUpHdU36dL6Zp2oy+iyupx2urxO0rf84fzf66+dbqfb6/a6g+6gO+lOurPurLvoLjpZJ+uuuqvuprvp7rq77qF76J66p+6le+k+uo/uq/vqfrqfTtEpeqB+RQ/Sg/UQPVQP06/q4Xq4HqFH6FSdqkfpUXq0Hq3H6DF6rB6rx+vxeoKeoCfpSXqKnqLTdJqepqfp6Xq6nqFn6Fl6lk7X6Xqunqvn6Xl6gV6gF+qFepFepJfoJTpDZ+hMnamzdJZerpfrbL1Cr9Cr9Cq9Rq/R6/Q6vUFv0Jv0Jr1Fb9HZervernfoHXqX3qX36D16n96n9+v9+oA+oHN0jj6oD+pD+pA+rA/rXJ2rj+gj+qg+qo/pY/q4Pq5P6BP6lD6lT+vT+ow+o8/pc/q8Pq8v6Av6kr50+bIvkIEMdKCDfEG+ICaICWKD2CAuiAsKBgWDSBAJ4oP4oFBwY1A4KBIUDYoFCUHxoERgAgxsQEEYlAxKBdHgpqB0cHOQGJQJygblAheUD5KCW4IKwa1BxeC2oFJwe1A5uCOoUkAE1YLqwZ1BjeCuoGZQK6gd3B3UCeoG9YL6wT1Bg+DeoGFwX9AouD9oHDwQNAkeDJoGDwXNgoeD5sEjQYvg0aBl8FjQKmgdtAnaBu3+uX5Q9Q/U9/5MkSdcP9PfpJgBZqB5xQwyg80QM9QMM6+a4eY1M8K8blLNSDPKvGFGmzfNGPOWGWvGmfHmbTPBTDSTzGQzxUw1aeYdM828a6ab98wMM9PMMrNNuplj5pr3zTwz3ywwH5iF5kOzyCw2S8xSk2E+MplmmckyH5vl5hOTbVaYlWaVWW3WmLVmnVlvNpiNZpPZbLaYrWab2W4+NTvMTrPL7DZ7zF6zz3xm9pvPzQHzhckxX5qD5k/mkPnKHDZfm1zzjTlivjVHzXfmmPneHDc/mBPmpDllfjSnzU/mjDlrzpmfzXnzi7lgLppLxl++uL/88o4aNebDfBiDMRiLsRiHcVgQC2IEIxiP8VgIC2FhLIxFsSgmYAKWwBJ4GSFhSSyJUYxiaSyNiZiIZbEsOnSYhElYAStgRayIlbASVsbKWAWrYDWshnfinXgX3oW1sBbejXdjXayL9bE+NsAG2BAbYiNshI2xMTbBJtgUm2IzbIbNsTm2wBbYEltiK2yFbbANtsN22B7bYwfsgJ2wE3bGztgFu2AyJmNX7IrdsBt2x+7YA3tgT+yJvbAX9sE+2Bf7Yj/shymYggNxIA7CQTgEh+AwHIbDcTiOwBGYiqk4CkfhaByNY3AMjsVxOB7fxgk4ESfhZJyCUzEN03AaTsPpOB1n4AychbMwHdNxLs7FeTgPF+ACXIgLcREuwiW4BDMwAzMxE7MwC5fjcszGbFyJK3E1rsa1uBbX43rciBtxM27GrbgVt+N23IE7cBfuwj24B/fhPtyP+/EAHsAczMGDeBAP4SE8jIcxF3PxCB7Bo3gUj+ExPI7H8QSewFN4Ck/jaTyDZ/AcnsPz+AtewIt4CT3GWCli7TU2zl5rC9rrbIwtYP8+LmqL2QRb3Jawxha2Rf4hRmttoi1jy9py1tnyNsne8pu4iq1qq9nq9k5bw95la/4mbmDvtQ3tfbaRvd/Wt/f8Q9zYPmCb2EdtU/uYbWZb2+a2rW1hH7Ut7WO2lW1t29i2trN9ynaxT9tk+4ztap/9TZxpl9n1doPdaDfZ/fZze87+bI/a7+x5+4vtZ/vbYfZVO9y+ZkfY122qHfmbeLx9206wE+0kO9lOsVN/E8+ys226nWPn2vftPDv/N3GG/cgutFl2kV1sl9ilv8aXe8qyH9vl9hObbVfYlXaVXW3X2LV23d96XWW32K12m91nP7M77E67y+62e+zeX+PL53HAfmFz7Jf2iP3WHrJf2cP2mM213/waXz6/Y/Z7e9z+YE/Yk/aU/dGetj/ZM/bsr+d/+dx/tBftJeutICBJijQFlI/yUwwVoFi6huLoWipI11GErqd4uoEK0Y1UmIpQUSpGCVScSpAhJEtEIZWkUhSlm6g03UyJVIbKUjlyVJ6S6BaqQLdSRbqNKtHtVJnuoCpUlapRdbqTatBdVJNqUW26m+pQXapH9ekeakD3UkO6jxrR/dSYHqAm9CA1pYeoGT1MzekRakGPUkt6jFpRa2pDbakdPU7t6QnqQB2pEz1Jnekp6kJPUzI9Q13pWepGz1F3ep560AvUk16kXtSb+tBL1Jdepn7Un1JoAA2kV2gQDaYhNJSG0as0nF6jEfQ6pdJIGkVv0Gh6k8bQWzSWxtF4epsm0ESaRJNpCk2lNHqHptG7NJ3eoxk0k2bRbEqnOTSX3qd5NJ8W0Ae0kD6kRbSYltBSyqCPKJOWURZ9TMvpE8qmFbSSVtFqWkNraR2tpw20kTbRZtpCW2kbbadPaQftpF20m/bQXtpHn9F++pwO0BeUQ1/SQfoTHaKv6DB9Tbn0DR2hb+kofUfH6Hs6Tj/QCTpJp+hHOk0/0Rk6S+foZzpPv9AFukiXyJMIIZShCnUYhPnC/GFMWCCMDa8J48Jrw4LhdWEkvD6MD28IC4U3hoXDImHRsFiYEBYPS4QmxNCGFIZhybBUGA1vCkuHN4eJYZmwbFgudGH5MCm8JawQ3hpWDG8LK4W3h5XDO8IqYdXw0furh3eGNcK7wpphrbB2eHdYJ6wb1gvrh/eEDcJ7w4bhfWGj8P6wYvhA2CR8MGwaPhQ2Cx8Om4ePhC3CR8OW4WNhq7B12CZsG7YLHw/bh0+EHcKOYafwybBz+FTYJXw6TA6fCbuGz/7u8ZRwQDgwfCV8JfT+PrUkujSaEf0omhldFs2KfhxdHv0kmh1dEV0ZXRVdHV0TXRtdF10f3RDdGN0U3RzdEt0a3Rb1vn5+4cBJp5x2gcvn8rsYV8DFumtcnLvWFXTXuYi73sW7G1whd6Mr7Iq4oq6YS3DFXQlnHDrryIWupCvlou4mV9rd7BJdGVfWlXPOlXdJrq1r59q59u4J18F1dJ3ck+5J95R7yj3tnnbPuK7uWdfNPee6u+ddD/eCe8G96Hq53q6Pe8n1dS+7fq6/S3EpbqAb6Aa5QW6IG+KGuWFuuBvuRrgRLtWlulFulBvtRrsxbowb68a68W68m+AmuElukpviprg0l+amuWluupvuZrgZbpab5dJdupvr5rp5bp5b4Ba4hYkL3SK3yC1xS1yGy3CZLtNluSy33C132S7brXQr3Wq32q11a916t95tdBvdZrfZbXVb3Xa33e1wO9wut8vtcXvcPrfP7Xf73QF3wOW4HHfQHXSH3CF32H3tct037oj71h1137lj7nt33P3gTriT7pT70Z12P7kz7qw75352590v7oK76C4579Ii70SmRd6NTI+8F5kRmRmZFZkdSY/MicyNvB+ZF5kfWRD5ILIw8mFkUWRxZElkaSQj8lEkM7IskhX5OLI88kkkO7IisjKyKrI6sibiffEdoS/pS/mov8mX9jf7RF/Gl/XlvPPlfZK/xVfwt/qK/jZfyd/uK/s7fBVf1Vfzj/lWvrVv49v6dv5x394/4Tv4jr6Tf9J39k/5Lv5pn+yf8V39s76bf85398/7Hv4F39O/6Hv53r6Pf8n39S/7fr6/T/ED/ED/ih/kB/shfqgf5l/1w/1rfoR/3af6kX6Uf8OP9m/6Mf4tP9aP8+P9236Cn+gn+cl+ip/q0/w7fpp/10/37/kZfqaf5Wf7dD/Hz/Xv+3l+vl/gP/AL/Yd+kV/sl/ilPsN/5DP9Mp/lP/bL/Sc+26/wK/0qv9qv8Wv9Or/eb/Ab/Sa/2W/xW/02v91/6nf4nX6X3+33+L1+n//M7/ef+wP+C5/jv/QH/Z/8If+VP+y/9rn+G3/Ef+uP+u/8Mf+9P+5/8Cf8SX/K/+hP+5/8GX/Wn/M/+/P+F3/BX/SX+H/WGGOMMcb+S9TvHB/wL74n/7IuGyiEuHZnsdx/rrm58J/3g2VC54gQ4pn+PR/+66pTJyUl5S+PzVYiKLVYCBG5kp9PXIlXiE7iKZEsOooK/7K/wbL3efqd+tHbhYj9W+dCxIi/xn9f/9b/oP7jT47PrByei/9P6i8WIrHUlZwC4kp8pX7F/6B+kfa/03+Br9KE6PB3OXHiSnylfpJ4Qjwrkv/hkYwxxhhjjDHG2J8NltW6/9798+X78wR9JSe/uBL/3v05Y4wxxhhjjDHGrr7ne/d5+vHk5I7decMb3vDmb5ur/ZeJMcYYY4wx9u925aL/anfCGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4zlXf8/Pk7sap8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdrX9nwAAAP//JhA6YA==") mkdir(&(0x7f00000000c0)='./bus\x00', 0x11e) mount$incfs(&(0x7f0000000100)='./bus\x00', &(0x7f0000000800)='./bus\x00', &(0x7f0000000000), 0xc002, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x7, 0x3, &(0x7f0000000000)=@framed={{0x5d, 0xa, 0xa, 0x0, 0x0, 0x79, 0x10, 0x18}}, 0x0}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) 393.923099ms ago: executing program 0 (id=33): syz_usb_connect(0x5, 0x36, &(0x7f0000000200)=ANY=[@ANYBLOB="1201000092ecc620ac0500773aeb010203010902240001"], 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000008c0), r0) sendmsg$IEEE802154_DISASSOCIATE_REQ(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002c"], 0x44}, 0x1, 0x0, 0x0, 0x20008800}, 0x0) 356.772751ms ago: executing program 1 (id=34): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='huge=always']) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r0, 0x0, 0x2000006, 0x10003) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r0, 0x4000) 328.382352ms ago: executing program 3 (id=35): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) write$binfmt_aout(r1, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000180)={0x0, 0x0, 0xfffffff9, 0x6, 0x16, "0062007d8200f7ffffff00"}) syz_open_pts(r1, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 323.871412ms ago: executing program 2 (id=36): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1a1301, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000080)={0x70003, 0x0, {[0xf7ffffffffffffff, 0x1fa, 0xffffffffffffffff, 0xfffff7ffefffff15, 0x3, 0x8, 0x80, 0xa1]}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 260.935803ms ago: executing program 0 (id=37): r0 = gettid() timer_create(0x7, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) keyctl$reject(0x13, 0x0, 0x2, 0x202, 0x0) 260.645943ms ago: executing program 32 (id=37): r0 = gettid() timer_create(0x7, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000000)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) keyctl$reject(0x13, 0x0, 0x2, 0x202, 0x0) 179.407105ms ago: executing program 1 (id=38): bpf$ENABLE_STATS(0x20, 0x0, 0x0) setns(0xc9, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e23, 0x3, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, 0x1c) write(r0, 0x0, 0x0) 154.835706ms ago: executing program 1 (id=39): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) ioctl$EXT4_IOC_GETFSUUID(r2, 0x40047459, 0x0) 149.773496ms ago: executing program 3 (id=40): openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESHEX=r0]) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) getgroups(0x0, 0x0) lstat(&(0x7f0000002600)='./file0\x00', 0x0) 110.877497ms ago: executing program 3 (id=41): pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r0, 0x407, 0x0) write$FUSE_INIT(r0, &(0x7f0000000200)={0x50, 0xfffffffffffffff5, 0x0, {0x7, 0x28, 0x2, 0xffffffffa2048000, 0x0, 0x40, 0xc, 0x0, 0x0, 0x0, 0x10, 0x8}}, 0x50) vmsplice(r0, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) fcntl$setpipe(r0, 0x407, 0x2000000) ioctl$sock_inet_udp_SIOCINQ(r0, 0x541b, 0x0) 88.805017ms ago: executing program 1 (id=42): r0 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) r2 = socket(0x200000000000011, 0x2, 0x0) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @random="518440db9de1"}, 0x14) syz_emit_ethernet(0x2a, &(0x7f0000006340)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1f}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x8}}}}}, 0x0) 50.635338ms ago: executing program 1 (id=43): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000500), 0x14b040, 0x0) ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0xfffffff3) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) mmap(&(0x7f0000701000/0x1000)=nil, 0x1000, 0x0, 0x12, r0, 0x0) pread64(r0, &(0x7f0000000640)=""/138, 0x8a, 0x1) 0s ago: executing program 1 (id=44): syz_open_dev$ttys(0xc, 0x2, 0x0) unshare(0x6020400) r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x5, &(0x7f0000000040)=0xfffffff9, 0x4) syz_emit_ethernet(0x4e, &(0x7f00000001c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900182b01fe800000000000000000000000000025fe8000000000000000000000000000aaff"], 0x0) recvmmsg(r0, &(0x7f00000005c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=""/32, 0x20}, 0x4}], 0x1, 0x10042, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.217' (ED25519) to the list of known hosts. [ 19.040801][ T30] audit: type=1400 audit(1786028401.419:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.041930][ T277] cgroup: Unknown subsys name 'net' [ 19.063480][ T30] audit: type=1400 audit(1786028401.419:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.090880][ T30] audit: type=1400 audit(1786028401.449:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.091070][ T277] cgroup: Unknown subsys name 'devices' [ 19.230222][ T277] cgroup: Unknown subsys name 'hugetlb' [ 19.235834][ T277] cgroup: Unknown subsys name 'rlimit' [ 19.353756][ T30] audit: type=1400 audit(1786028401.729:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.377297][ T30] audit: type=1400 audit(1786028401.729:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.402123][ T30] audit: type=1400 audit(1786028401.729:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.408045][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 19.434129][ T30] audit: type=1400 audit(1786028401.809:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.459731][ T30] audit: type=1400 audit(1786028401.809:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.494551][ T30] audit: type=1400 audit(1786028401.869:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.495094][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.520737][ T30] audit: type=1400 audit(1786028401.869:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.170923][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.178163][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.185676][ T286] device bridge_slave_0 entered promiscuous mode [ 20.193606][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.201567][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.209225][ T286] device bridge_slave_1 entered promiscuous mode [ 20.240763][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.247819][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.255403][ T285] device bridge_slave_0 entered promiscuous mode [ 20.265187][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.272291][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.279783][ T285] device bridge_slave_1 entered promiscuous mode [ 20.373910][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.381006][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.388504][ T287] device bridge_slave_0 entered promiscuous mode [ 20.395416][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.402559][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.410053][ T287] device bridge_slave_1 entered promiscuous mode [ 20.444388][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.451493][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.458966][ T288] device bridge_slave_0 entered promiscuous mode [ 20.479956][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.487030][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.494839][ T288] device bridge_slave_1 entered promiscuous mode [ 20.513139][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.520539][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.528058][ T289] device bridge_slave_0 entered promiscuous mode [ 20.536501][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.543727][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.551446][ T289] device bridge_slave_1 entered promiscuous mode [ 20.633651][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.640894][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.648288][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.655320][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.722900][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.730009][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.737978][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.745050][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.755827][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.763316][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.771843][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.779166][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.786930][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 20.794955][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.820769][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 20.829850][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.839924][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.847309][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.860278][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 20.869499][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.879006][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.886074][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.893484][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 20.909708][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.919415][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.949660][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.973075][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 20.981952][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.990235][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.997252][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.005101][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.014246][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.021869][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.029920][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.038577][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.046551][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.054550][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.062955][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.069992][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.086952][ T286] device veth0_vlan entered promiscuous mode [ 21.097977][ T285] device veth0_vlan entered promiscuous mode [ 21.104460][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.112300][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.120937][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.129409][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.137431][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.145254][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.152851][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.160456][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.168026][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.177165][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.185357][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.192832][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.201225][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.208311][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.215744][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.223880][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.247197][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 21.255761][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.264199][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.271423][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.279744][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.288063][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.297166][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.304230][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.311672][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.319713][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.329087][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.337288][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.345429][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 21.353821][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.362142][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.369186][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.376679][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.385080][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.393381][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.403453][ T286] device veth1_macvtap entered promiscuous mode [ 21.419887][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.427641][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.435862][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.444044][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.453044][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.461456][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.469624][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.477497][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.485442][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.493670][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.501251][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.510276][ T289] device veth0_vlan entered promiscuous mode [ 21.521475][ T285] device veth1_macvtap entered promiscuous mode [ 21.530389][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.538597][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.546707][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.554452][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.562952][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.571543][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.580167][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.590557][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.598918][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.620624][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.629105][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.637397][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.645592][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.654181][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.662921][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.671662][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.679964][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.688205][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.696640][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.708791][ T289] device veth1_macvtap entered promiscuous mode [ 21.718552][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.726315][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.734886][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.756494][ T285] request_module fs-gadgetfs succeeded, but still no fs? [ 21.757029][ T288] device veth0_vlan entered promiscuous mode [ 21.772031][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.780068][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.788305][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.796541][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.806307][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.813926][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.821446][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.832340][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.860173][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.878417][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.896068][ T288] device veth1_macvtap entered promiscuous mode [ 21.922021][ T287] device veth0_vlan entered promiscuous mode [ 21.932411][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.940175][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.949660][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.958042][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.966471][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.975250][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.983716][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.992268][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 22.000483][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 22.016149][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 22.025323][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 22.054522][ T287] device veth1_macvtap entered promiscuous mode [ 22.087828][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 22.095726][ T326] loop2: detected capacity change from 0 to 1024 [ 22.102892][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 22.112170][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 22.155986][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.169884][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.219939][ T326] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 22.252608][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 22.265235][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 22.291677][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 22.301009][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 22.309306][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 22.317480][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 22.326341][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 22.335057][ T318] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 22.397176][ T345] overlayfs: metacopy with no lower data found - abort lookup (/file1) [ 22.399905][ T347] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.463546][ T356] loop2: detected capacity change from 0 to 4096 [ 22.503749][ T356] EXT4-fs (loop2): Ignoring removed mblk_io_submit option [ 22.505616][ T362] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=3835797286 (7671594572 ns) > initial count (4918772610 ns). Using initial count to start timer. [ 22.530524][ T356] EXT4-fs (loop2): Test dummy encryption mode enabled [ 22.537361][ T362] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=2527804186 (323558935808 ns) > initial count (117850194176 ns). Using initial count to start timer. [ 22.579090][ T356] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpid,mblk_io_submit,nodioread_nolock,test_dummy_encryption,inode_readahead_blks=0x0000000000000000,nodelalloc,minixdf,debug_want_extra_isize=0x0000000000000040,,errors=continue. Quota mode: writeback. [ 22.624975][ T356] fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" [ 22.656960][ T371] syz.3.23 (371) used greatest stack depth: 21024 bytes left [ 22.694060][ T377] netlink: 8 bytes leftover after parsing attributes in process `syz.0.26'. [ 22.707292][ T379] netlink: 48 bytes leftover after parsing attributes in process `syz.3.27'. [ 22.716442][ T379] netlink: 48 bytes leftover after parsing attributes in process `syz.3.27'. [ 22.733105][ T383] loop1: detected capacity change from 0 to 128 [ 22.741007][ T379] Zero length message leads to an empty skb [ 22.748582][ T385] loop0: detected capacity change from 0 to 256 [ 22.755588][ T381] using random self ethernet address [ 22.761138][ T381] using random host ethernet address [ 22.789047][ T391] loop2: detected capacity change from 0 to 256 [ 22.826814][ T391] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 22.846990][ T391] incfs_lookup_dentry err:-75 [ 23.136349][ T405] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.155669][ T405] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.163965][ T405] device bridge_slave_0 entered promiscuous mode [ 23.173542][ T405] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.185905][ T405] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.195279][ T405] device bridge_slave_1 entered promiscuous mode [ 23.232631][ T410] ================================================================== [ 23.240726][ T410] BUG: KASAN: use-after-free in pppol2tp_sock_to_session+0x1a0/0x1b0 [ 23.248824][ T410] Read of size 4 at addr ffff88812ac08c00 by task syz.1.39/410 [ 23.257159][ T410] [ 23.259519][ T410] CPU: 0 PID: 410 Comm: syz.1.39 Not tainted syzkaller #0 [ 23.259538][ T405] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.266628][ T410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.266654][ T410] Call Trace: [ 23.266659][ T410] [ 23.266665][ T410] __dump_stack+0x21/0x30 [ 23.273723][ T405] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.283816][ T410] dump_stack_lvl+0x110/0x170 [ 23.283834][ T410] ? show_regs_print_info+0x20/0x20 [ 23.283848][ T410] ? load_image+0x3f0/0x3f0 [ 23.287242][ T405] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.290135][ T410] ? __local_bh_enable_ip+0x58/0x80 [ 23.290157][ T410] print_address_description+0x7f/0x2c0 [ 23.294463][ T405] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.301648][ T410] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 23.301670][ T410] kasan_report+0x10f/0x150 [ 23.351340][ T410] ? pppol2tp_sock_to_session+0x1a0/0x1b0 [ 23.357073][ T410] __asan_report_load4_noabort+0x14/0x20 [ 23.362696][ T410] pppol2tp_sock_to_session+0x1a0/0x1b0 [ 23.368332][ T410] pppol2tp_release+0x150/0x2b0 [ 23.373395][ T410] sock_close+0xb8/0x200 [ 23.377664][ T410] ? sock_mmap+0xa0/0xa0 [ 23.382512][ T410] __fput+0x22b/0x900 [ 23.386537][ T410] ____fput+0x15/0x20 [ 23.390599][ T410] task_work_run+0x127/0x190 [ 23.395189][ T410] do_exit+0xb70/0x29a0 [ 23.399423][ T410] ? __se_sys_clock_nanosleep+0x30b/0x3a0 [ 23.405170][ T410] ? put_task_struct+0x90/0x90 [ 23.410130][ T410] ? __kasan_check_write+0x14/0x20 [ 23.415373][ T410] __x64_sys_exit+0x40/0x40 [ 23.420038][ T410] x64_sys_call+0x44/0x9a0 [ 23.424444][ T410] do_syscall_64+0x4c/0xa0 [ 23.428971][ T410] ? clear_bhb_loop+0x50/0xa0 [ 23.433642][ T410] ? clear_bhb_loop+0x50/0xa0 [ 23.438315][ T410] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.444309][ T410] RIP: 0033:0x7ff75e1090d9 [ 23.448709][ T410] Code: Unable to access opcode bytes at RIP 0x7ff75e1090af. [ 23.456056][ T410] RSP: 002b:00007ff75cb61ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 23.464468][ T410] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ff75e1090d9 [ 23.472427][ T410] RDX: 00007ff75cb629c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 23.480392][ T410] RBP: 00007ff75e1a0024 R08: 0000000000000000 R09: 0000000000000058 [ 23.488443][ T410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 23.496400][ T410] R13: 00007ff75e391038 R14: 00007ff75e390fa0 R15: 00007ffec499a9b8 [ 23.504381][ T410] [ 23.507397][ T410] [ 23.509700][ T410] Allocated by task 408: [ 23.513922][ T410] __kasan_kmalloc+0xd4/0x100 [ 23.518587][ T410] __kmalloc+0x13d/0x2c0 [ 23.522815][ T410] l2tp_session_create+0x39/0xb60 [ 23.528109][ T410] pppol2tp_connect+0xbf5/0x1640 [ 23.533049][ T410] __sys_connect+0x3cb/0x450 [ 23.537622][ T410] __x64_sys_connect+0x7a/0x90 [ 23.542368][ T410] x64_sys_call+0x7c/0x9a0 [ 23.546771][ T410] do_syscall_64+0x4c/0xa0 [ 23.551167][ T410] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 23.557485][ T410] [ 23.559890][ T410] Freed by task 318: [ 23.563821][ T410] kasan_set_track+0x4a/0x70 [ 23.568557][ T410] kasan_set_free_info+0x23/0x40 [ 23.573491][ T410] ____kasan_slab_free+0x125/0x160 [ 23.578582][ T410] __kasan_slab_free+0x11/0x20 [ 23.583341][ T410] slab_free_freelist_hook+0xc2/0x190 [ 23.588694][ T410] kfree+0xc4/0x270 [ 23.592483][ T410] l2tp_session_put+0xaf/0x1a0 [ 23.597229][ T410] l2tp_session_delete+0x3a9/0x4a0 [ 23.602324][ T410] l2tp_tunnel_del_work+0x180/0x3d0 [ 23.607507][ T410] process_one_work+0x6c8/0xbb0 [ 23.612435][ T410] worker_thread+0xaa0/0x1250 [ 23.617103][ T410] kthread+0x3f5/0x4f0 [ 23.621246][ T410] ret_from_fork+0x1f/0x30 [ 23.625647][ T410] [ 23.627957][ T410] The buggy address belongs to the object at ffff88812ac08c00 [ 23.627957][ T410] which belongs to the cache kmalloc-512 of size 512 [ 23.641991][ T410] The buggy address is located 0 bytes inside of [ 23.641991][ T410] 512-byte region [ffff88812ac08c00, ffff88812ac08e00) [ 23.655103][ T410] The buggy address belongs to the page: [ 23.660754][ T410] page:ffffea0004ab0200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12ac08 [ 23.670979][ T410] head:ffffea0004ab0200 order:2 compound_mapcount:0 compound_pincount:0 [ 23.679283][ T410] flags: 0x4000000000010200(slab|head|zone=1) [ 23.685340][ T410] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100042f00 [ 23.693910][ T410] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 23.702474][ T410] page dumped because: kasan: bad access detected [ 23.708864][ T410] page_owner tracks the page as allocated [ 23.714573][ T410] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 405, ts 23055274818, free_ts 22998688041 [ 23.734959][ T410] post_alloc_hook+0x192/0x1b0 [ 23.739721][ T410] prep_new_page+0x1c/0x110 [ 23.744228][ T410] get_page_from_freelist+0x2c3a/0x2cd0 [ 23.749758][ T410] __alloc_pages+0x1a2/0x460 [ 23.754332][ T410] new_slab+0xa0/0x4d0 [ 23.758385][ T410] ___slab_alloc+0x3ac/0x840 [ 23.762967][ T410] __slab_alloc+0x49/0x90 [ 23.767469][ T410] __kmalloc+0x16a/0x2c0 [ 23.771712][ T410] __register_sysctl_table+0xa35/0x1240 [ 23.777260][ T410] register_net_sysctl+0x21d/0x230 [ 23.782400][ T410] lowpan_frags_init_net+0x22d/0x300 [ 23.787686][ T410] ops_init+0x2c0/0x470 [ 23.791827][ T410] setup_net+0x331/0xa30 [ 23.796053][ T410] copy_net_ns+0x355/0x5c0 [ 23.800471][ T410] create_new_namespaces+0x3a8/0x660 [ 23.805770][ T410] unshare_nsproxy_namespaces+0x120/0x170 [ 23.811593][ T410] page last free stack trace: [ 23.816391][ T410] __free_pages_ok+0xa13/0xae0 [ 23.821328][ T410] free_compound_page+0x89/0xa0 [ 23.826193][ T410] free_transhuge_page+0x250/0x270 [ 23.831406][ T410] release_pages+0x42c/0x12c0 [ 23.836155][ T410] __pagevec_release+0x71/0xe0 [ 23.840901][ T410] shmem_undo_range+0x564/0x13b0 [ 23.845823][ T410] shmem_evict_inode+0x1dc/0x970 [ 23.850757][ T410] evict+0x4b6/0x8b0 [ 23.854672][ T410] iput+0x651/0x7e0 [ 23.858671][ T410] dentry_unlink_inode+0x338/0x3e0 [ 23.863792][ T410] __dentry_kill+0x45b/0x660 [ 23.868368][ T410] shrink_dentry_list+0x38e/0x500 [ 23.873378][ T410] shrink_dcache_parent+0xa9/0x270 [ 23.878486][ T410] do_one_tree+0x27/0xe0 [ 23.882718][ T410] shrink_dcache_for_umount+0x6a/0x110 [ 23.888194][ T410] generic_shutdown_super+0x66/0x330 [ 23.893476][ T410] [ 23.895784][ T410] Memory state around the buggy address: [ 23.901391][ T410] ffff88812ac08b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.909436][ T410] ffff88812ac08b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 23.917506][ T410] >ffff88812ac08c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.925547][ T410] ^ SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 23.929595][ T410] ffff88812ac08c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.937669][ T410] ffff88812ac08d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 23.945749][ T410] ================================================================== [ 23.953812][ T410] Disabling lock debugging due to kernel taint [ 24.012224][ T318] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.026031][ T318] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.070178][ T410] ------------[ cut here ]------------ [ 24.076900][ T410] WARNING: CPU: 1 PID: 410 at net/l2tp/l2tp_ppp.c:156 pppol2tp_sock_to_session+0x167/0x1b0 [ 24.118423][ T410] Modules linked in: [ 24.122349][ T410] CPU: 1 PID: 410 Comm: syz.1.39 Tainted: G B syzkaller #0 [ 24.130940][ T410] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.141792][ T410] RIP: 0010:pppol2tp_sock_to_session+0x167/0x1b0 [ 24.148150][ T410] Code: 5d c3 e8 9c 83 0b fd be 02 00 00 00 eb 0a e8 90 83 0b fd be 01 00 00 00 4c 89 f7 e8 33 02 f2 fd e9 0f ff ff ff e8 79 83 0b fd <0f> 0b 48 89 df e8 ef 00 00 00 eb bd e8 68 83 0b fd 4c 89 f7 be 03 [ 24.168422][ T410] RSP: 0018:ffffc90000977bf0 EFLAGS: 00010293 [ 24.174541][ T410] RAX: ffffffff845e3367 RBX: ffff8881126d2000 RCX: ffff88811263cf00 [ 24.182887][ T410] RDX: 0000000000000000 RSI: 000000000fea7340 RDI: 000000000c04eb7d [ 24.191086][ T410] RBP: ffffc90000977c10 R08: 0000000000000003 R09: 0000000000000004 [ 24.199149][ T410] R10: dffffc0000000000 R11: fffffbfff0e18e4c R12: dffffc0000000000 [ 24.207358][ T410] R13: dffffc0000000000 R14: 000000000fea7340 R15: ffff88812ac08c00 [ 24.215391][ T410] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 24.224389][ T410] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 24.231110][ T410] CR2: 00005568ba8b1b50 CR3: 000000010d633000 CR4: 00000000003526a0 [ 24.231495][ T8] device bridge_slave_1 left promiscuous mode [ 24.239330][ T410] DR0: f7ffffffffffffff DR1: 00000000000001fa DR2: ffffffffffffffff [ 24.245667][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.253430][ T410] DR3: fffff7ffefffff15 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 24.268476][ T410] Call Trace: [ 24.268667][ T8] device bridge_slave_0 left promiscuous mode [ 24.271751][ T410] [ 24.271758][ T410] pppol2tp_release+0x150/0x2b0 [ 24.277864][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.280909][ T410] sock_close+0xb8/0x200 [ 24.296910][ T410] ? sock_mmap+0xa0/0xa0 [ 24.301270][ T410] __fput+0x22b/0x900 [ 24.301537][ T8] device veth1_macvtap left promiscuous mode [ 24.305269][ T410] ____fput+0x15/0x20 [ 24.311533][ T8] device veth0_vlan left promiscuous mode [ 24.315287][ T410] task_work_run+0x127/0x190 [ 24.325842][ T410] do_exit+0xb70/0x29a0 [ 24.330111][ T410] ? __se_sys_clock_nanosleep+0x30b/0x3a0 [ 24.335976][ T410] ? put_task_struct+0x90/0x90 [ 24.340825][ T410] ? __kasan_check_write+0x14/0x20 [ 24.345945][ T410] __x64_sys_exit+0x40/0x40 [ 24.350568][ T410] x64_sys_call+0x44/0x9a0 [ 24.355003][ T410] do_syscall_64+0x4c/0xa0 [ 24.359627][ T410] ? clear_bhb_loop+0x50/0xa0 [ 24.364354][ T410] ? clear_bhb_loop+0x50/0xa0 [ 24.369127][ T410] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 24.375024][ T410] RIP: 0033:0x7ff75e1090d9 [ 24.379777][ T410] Code: Unable to access opcode bytes at RIP 0x7ff75e1090af. [ 24.387348][ T410] RSP: 002b:00007ff75cb61ef8 EFLAGS: 00000246 ORIG_RAX: 000000000000003c [ 24.395878][ T410] RAX: ffffffffffffffda RBX: 0000000000000058 RCX: 00007ff75e1090d9 [ 24.403906][ T410] RDX: 00007ff75cb629c8 RSI: 0000000000000000 RDI: 0000000000000000 [ 24.412112][ T410] RBP: 00007ff75e1a0024 R08: 0000000000000000 R09: 0000000000000058 [ 24.420742][ T410] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.428803][ T410] R13: 00007ff75e391038 R14: 00007ff75e390fa0 R15: 00007ffec499a9b8 [ 24.437288][ T410] [ 24.440546][ T410] ---[ end trace 175076140aaf3ad3 ]--- [ 25.639163][ T8] device bridge_slave_1 left promiscuous mode [ 25.645280][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.652820][ T8] device bridge_slave_0 left promiscuous mode [ 25.659657][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.667553][ T8] device bridge_slave_1 left promiscuous mode [ 25.673792][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.681504][ T8] device bridge_slave_0 left promiscuous mode [ 25.687728][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.696438][ T8] device bridge_slave_1 left promiscuous mode [ 25.702597][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.710184][ T8] device bridge_slave_0 left promiscuous mode [ 25.716304][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.724245][ T8] device bridge_slave_1 left promiscuous mode [ 25.730404][ T8] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.738037][ T8] device bridge_slave_0 left promiscuous mode [ 25.744297][ T8] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.752444][ T8] device veth1_macvtap left promiscuous mode [ 25.758871][ T8] device veth0_vlan left promiscuous mode [ 25.764900][ T8] device veth1_macvtap left promiscuous mode [ 25.770951][ T8] device veth0_vlan left promiscuous mode [ 25.776984][ T8] device veth1_macvtap left promiscuous mode [ 25.783073][ T8] device veth0_vlan left promiscuous mode