last executing test programs: 3.322434808s ago: executing program 2 (id=113): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x200, 0xfffffffd}}, 0x10) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000140)={0x42, 0xf5}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x31) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 3.29276803s ago: executing program 2 (id=114): r0 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_enter(r0, 0x47f9, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r5, 0x0, 0x25a5, 0x4) write$binfmt_script(r4, &(0x7f0000000180)={'#! ', './file0'}, 0xb) 3.156555398s ago: executing program 2 (id=118): socket$can_raw(0x1d, 0x3, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="5800000000090101000000000000000000000000100004800800014000000000010002000c000280050001000000000014000280080001000000000008000200ac1414000800054000000000090001"], 0x58}}, 0x0) syz_clone3(&(0x7f0000000880)={0x40000100, &(0x7f0000000600), &(0x7f0000000640), &(0x7f0000000680), {0x26}, &(0x7f00000006c0)=""/229, 0xe5, &(0x7f00000007c0)=""/99, &(0x7f0000000840)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5}, 0x58) chdir(&(0x7f00000001c0)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x17) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3.042833394s ago: executing program 1 (id=120): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) creat(&(0x7f0000000200)='./file1\x00', 0x1) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") setgroups(0x40000000000000dd, &(0x7f0000000400)=[0xee00]) 2.76282745s ago: executing program 2 (id=127): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x652c0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={0x0, 0x9}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2, @perf_config_ext={0xffffffff, 0xfd}, 0x0, 0x0, 0x1, 0x0, 0x2, 0xff, 0xffff, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xfff8000000000001, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x9400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, @perf_config_ext={0x9, 0x7}, 0x100, 0xa88, 0x8406, 0x5, 0x0, 0x3c, 0xffff, 0x0, 0x0, 0x0, 0x46}, 0x0, 0xffbfffffffffffff, 0xffffffffffffffff, 0x1) syz_read_part_table(0x1057, &(0x7f0000001080)="$eJzsz82JwkAABeA3+5MNe0oJu6Vkr+vVk01YQsBaImhjViEjxiDoXUT4vsvjMW8GJjxVmWOYomb7fXP4fje/9v/jukmGn99s+rekTUqbpO8y/k01q/NsUbLrm5Tu82u+eBhrrZe3PrLcP/Z3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPAaTgEAAP//LuQOEw==") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 2.743365982s ago: executing program 1 (id=128): ioctl$FAT_IOCTL_SET_ATTRIBUTES(0xffffffffffffffff, 0x40047211, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c06, 0xffffffffffffffff) set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x1, 0x0, @multicast1, @broadcast}, @echo_reply={0xe0}}}}}, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x2, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000020100000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000011000000bf09000000000000550901000074f696e500000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) 2.445834378s ago: executing program 4 (id=134): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffffffd}]}) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020001, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = dup2(r0, r1) close_range(r3, 0xffffffffffffffff, 0x0) 2.373596943s ago: executing program 4 (id=136): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc093, 0x2, @perf_config_ext={0x100000001, 0xdd5}, 0x0, 0x0, 0x10000, 0x2, 0x2, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x4000000}, 0x50) perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8946, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x40000, 0x0, r1, 0xfff}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x15, 0x1c, &(0x7f0000000100)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x1a84c3, 0x0, 0x0, 0x0, 0x80000000}, {{0x18, 0x1, 0x1, 0x0, r2}, {}, {0x7, 0x0, 0xb, 0x6}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x6, 0x1, 0xa, 0x9, 0x8}, {0x7, 0x0, 0x0, 0x8}, {0x7, 0x1, 0xb, 0x4, 0x8}, {}, {0x7, 0x0, 0xc}, {0x18, 0x6, 0x2, 0x0, r1}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.56571994s ago: executing program 1 (id=144): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000200)={'#! ', './file0'}, 0xb) mmap$IORING_OFF_SQ_RING(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x100000c, 0x12, r1, 0x0) perf_event_open(&(0x7f0000000400)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x82, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.410063819s ago: executing program 1 (id=146): r0 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x53a1bd79, 0x7, 0x9, 0x86, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000004000000000000000000001800000004000040000000000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000980)=@newqdisc={0x58, 0x24, 0xd0f, 0x70bd30, 0x0, {0x60, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x3, 0x1, 0x8, 0x1, 0xff, 0x7}, {0x4, 0x0, 0x3, 0xa159, 0x1000, 0xbebc20}, 0x3, 0x4000000, 0x41e}}]}}]}, 0x58}}, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xa00) 1.400967819s ago: executing program 3 (id=147): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11feffffff000000", @ANYRES32=r3, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0x4044000}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000005840)={0x0, 0x5d, &(0x7f00000005c0)={&(0x7f0000001240)=@newqdisc={0x78, 0x24, 0x5820a61ca228651, 0x400, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{}, 0x3548, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x4}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=@newtfilter={0x60, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xd}}, [@filter_kind_options=@f_basic={{0xa}, {0x30, 0x2, [@TCA_BASIC_EMATCHES={0x2c, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x812}}, @TCA_EMATCH_TREE_LIST={0x20, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x1, 0x0, 0x5}}}]}]}]}}]}, 0x60}}, 0x40000) 1.269929287s ago: executing program 1 (id=148): syz_usb_connect$hid(0x6, 0x36, 0x0, 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) 1.259877727s ago: executing program 3 (id=149): fsopen(&(0x7f00000002c0)='gfs2\x00', 0x1) r0 = creat(&(0x7f0000000080)='./file0\x00', 0xecf86c37d530496d) write$binfmt_elf32(r0, &(0x7f00000002c0)=ANY=[], 0x78) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x7, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x1, 0x1}}, 0x40) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x20, 0x10012, r1, 0x0) 1.170306522s ago: executing program 2 (id=150): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x4, 0x400, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc097, 0x2, @perf_config_ext={0x288}, 0xa216, 0x6, 0x11000, 0x4, 0x9484, 0x2001, 0x400, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000000c0)='!()\x00') socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet6_sctp(0xa, 0x5, 0x84) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000016c0)={0x0, 0x0, &(0x7f0000001680)={&(0x7f0000000040)=@dellink={0x34, 0x11, 0x1, 0x70bd26, 0x5dfdbff, {0x0, 0x0, 0x0, 0x0, 0x42008, 0x40000}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'veth1_vlan\x00'}]}, 0x34}, 0x1, 0x200000000000000, 0x0, 0x240040c4}, 0x0) 1.078176178s ago: executing program 4 (id=151): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="0b00000008000000010001000900000001"], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendto$inet6(r0, &(0x7f0000000180)="1a", 0x1, 0xdaaa3e12b603577d, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.014756552s ago: executing program 3 (id=153): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000040)="24000000180003041dfffd946f610500020100000005fe060c10880008000f00fff3c00e", 0x24}], 0x1}, 0x4080) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000001400030532bd7000fddbdf25021f00ff", @ANYRES32=r3, @ANYBLOB="080002007f"], 0x34}, 0x1, 0x0, 0x0, 0x4004011}, 0x0) 978.355334ms ago: executing program 0 (id=154): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000e80)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x74, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x48, 0x3, 0x0, 0x1, [{0x44, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x38, 0xb, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000000}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0xc}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) ioctl$FS_IOC_GETFSUUID(r0, 0x80111500, &(0x7f0000000080)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x42, 0x1fe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) pwrite64(r2, &(0x7f0000000180)='2', 0x1, 0xfecc) fallocate(r1, 0x10, 0x7, 0x10001) 955.860725ms ago: executing program 4 (id=155): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000003000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r2 = io_uring_setup(0x115c, &(0x7f0000000440)={0x0, 0x8270, 0x40, 0x3, 0x117}) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000000640)=[{0x0}], 0x178) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="6a0ac4ff02"], 0x0}, 0x94) io_uring_register$IORING_REGISTER_FILES(r2, 0x1e, &(0x7f0000000000)=[r2], 0x1) 940.580986ms ago: executing program 0 (id=156): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x0, 0x1, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 659.801342ms ago: executing program 2 (id=157): r0 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) listen(r0, 0x0) r1 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r1, &(0x7f0000000080)={&(0x7f0000000100)=@name, 0x10, 0x0}, 0x0) accept4(r0, &(0x7f0000000140)=@in={0x2, 0x0, @initdev}, &(0x7f0000000000)=0x80, 0x800) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f00000000c0)=@req3={0x80000000, 0x0, 0x2}, 0x1c) sendmsg$tipc(r1, &(0x7f0000000640)={&(0x7f0000000380), 0x10, 0x0}, 0x0) 654.156872ms ago: executing program 1 (id=158): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x1, 0x7fc00100}]}) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000002c0)={0x0}) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0x103cfa, 0x0, 0x3, 0x69}, &(0x7f0000000300)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r2, 0x47f6, 0x0, 0x2, 0x0, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, &(0x7f00000001c0)={r1}) 634.391353ms ago: executing program 3 (id=159): socket$inet_udp(0x2, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f00000001c0)='./file0\x00', 0x800714, &(0x7f0000000500), 0xf7, 0x485, &(0x7f0000001040)="$eJzs3M9rHFUcAPDvTJL+bhNrrba2Gq1i8UfSpFV78KCi4EFB0EM9xiSttdtGmgi2BI0i9SgF7+JR8C/w5kXUgwheFTxKoWgQmnqKzK9mu9mkSZpkbfbzgc2+t/Nm3/vOzNt9My+zAbSt3uxPErEjIn6LiO4ie3OB3uJpZnpy+Pr05HASs7Nv/JXk5a5NTw5XRav1tpeZw2lE+mkSzyfz6x2/cPHMUK02er7M90+cfa9//MLFp06fHTo1emr03ODx48eODjz7zODTqxJnFte1/R+OHdj3yluXXxs+cfntH7/JmrX3YLG8Po5but4koCZ6s63292yucdmjy2j7nWBnXTrpbGFDWJaOiMh2V1fe/7ujI+Z2Xne8/ElLGwesqey7afPCi6dmgQ0siVa3AGiN6os+O/+tHus09PhfuPpCxKYyPTM9OTxzI/7OSMvXu9aw/t6IODH175fZI5Z7HQIAYAXysc2TzcZ/aezNn4u5jl3lHEpPRNwVEbsj4u6I2BMR90TkZe+NiPuKlWe7l1h/b0N+/vgnvdK0zaskG/89Vzf2m6mLv3zq6ShzO/P4u5KTp2ujR8ptcji6Nmf5gUXq+O6lXz9faFn9+C97ZPVXY8GyAVc6Gy7QjQxNDK3WRrj6ccT+zmbxJzdmArIjYF9E7F/eW++qEqcf//rAQoVuHf8iVmGeafariMeK/T8VDfFXksXnJ/u3RG30SH91VMz30y+XXl+o/tuKfxVk+3/bzcd/Q4nuf5JivrYrarXR8+PLr+PS758teE6z0uN/U/JmPmf98zvFax8MTUycH4jYlLya56tzuvz1wbl1q3xVPov/8KHm/X93uU4W//0RkR3EByPigYh4sGz7QxHxcEQcWiT+H1585N1F4k8iiZbu/5Gmn383jv+epH6+fgWJjjPff7vQjPnS9v+xmMo/awv5598tLLWBt7n5AAAA4I6QRsSOSNK+It27I9K0r6/4H/49sS2tjY1PPHFy7P1zI8U9Aj3RlVZXurrrrocOJFPlOxb5wfJacbX8aHnd+IuOrXm+b3isNtLi2KHdbb+5/0fV/zN/drS6dcCac78WtK/G/p+2qB3A+lvK979zAdiYmvT/ra1oB7D+nP9D+2rW/z9qyBv/w8Y0v///0eQn64CNyPgf2pf+D+1L/4e2dDv39a88Ud0ssPL32bLkO/zbJVH94sVa1rU15l6JtOUht1Ei6zHrW+ncb6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADcyf4LAAD///ss5ts=") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x28011, r0, 0x0) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xb7}, [@ldst={0x6, 0x2}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x58) 596.921136ms ago: executing program 0 (id=160): unshare(0x22020600) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f00000005c0)='\"', 0x1, 0x4fed0) 542.021459ms ago: executing program 0 (id=161): mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r0 = open$dir(&(0x7f0000000100)='./file0\x00', 0x149800, 0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000001c0)={0x10000004}) io_setup(0x1, &(0x7f0000000b80)=0x0) io_submit(r2, 0x1, &(0x7f0000001d00)=[&(0x7f0000001a80)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) r3 = open(&(0x7f0000000000)='./file0\x00', 0x82, 0x8) write$P9_RXATTRWALK(r3, &(0x7f0000000200)={0xf, 0x1f, 0x2, 0x4d406712}, 0xf) 451.938194ms ago: executing program 0 (id=162): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r0}, 0x8) close(r1) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400000005"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r1, r3, 0x4, r4}, 0x10) 429.156075ms ago: executing program 0 (id=163): r0 = getpid() perf_event_open(&(0x7f0000001100)={0x5, 0x80, 0x9, 0x8, 0xb, 0xfb, 0x0, 0x3c, 0xc002, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x18842, 0x0, 0x7fffffff, 0x2, 0x3cd, 0x3, 0x7, 0x0, 0x0, 0x0, 0x6}, r0, 0x0, 0xffffffffffffffff, 0x2) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setlease(r1, 0x400, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x4}]}) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x400) close_range(r2, 0xffffffffffffffff, 0x0) 397.971037ms ago: executing program 3 (id=164): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close_range(r0, r0, 0x2) mknod(0x0, 0x4000, 0x7fff0000) io_setup(0x4, &(0x7f0000000240)=0x0) r2 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x8102) writev(r2, &(0x7f0000001500)=[{&(0x7f0000000000)="47ad3d32240000006bdb74ecb9f7c342cc2c008d3ec3c2d2d5bbf6a4e41419ec3dc11a4f85980084665ea561e52d97fbe9e83aa0", 0x34}], 0x1) io_submit(r1, 0x1, &(0x7f0000000380)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x1, r0, 0x0}]) 293.874493ms ago: executing program 3 (id=165): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x3000046, &(0x7f00000004c0)={[{@delalloc}, {@data_err_abort}, {@barrier_val={'barrier', 0x3d, 0x2}}, {@usrquota}, {@data_err_ignore}, {@nobarrier}, {@oldalloc}, {@grpquota}, {@noload}, {@user_xattr}, {@bh}, {@dioread_nolock}]}, 0x1, 0x553, &(0x7f0000001080)="$eJzs3d9rW1UcAPDvTdv91nUwhopIYQ9O5tK19ccEH+aj6HCg7zO0d2U0WUaTjrUO3B7ciy8yBBEH4ru++zj8B/wrBjoYMoo++BK56U2XrUmbddnSmc8Hbjkn9ybnfnPv9/TcnBsSwNCayP4UIl6OiG+SiIMRkeTrRiNfObG23er9q7PZkkSj8elfSXO7rN56rdbz9ueVlyLit68ijhc2tltbXlkolcvpYl6frFcuTdaWV05cqJTm0/n04vTMzKm3Z6bfe/edvsX6xtl/vv/k9oenvj66+t0vdw/dTOJ0HMjXtcfxBK61VyZiIn9PxuL0IxtO9aGxnSQZ9A6wLSN5no9F1gccjJE864H/vy8jogEMqUT+w5BqjQNa1/Z9ug5+btz7YO0CaGP8o2ufjcSe5rXRvtXkoSuj7Hp3vA/tZ238+uetm9kS/fscAmBL165HxMnR0Y39X5L3f9t3sodtHm1D/wfPzu1s/PNmp/FPYX38Ex3GP/s75O52bJ3/hbt9aKarbPz3fsfx7/qk1fhIXnuhOeYbS85fKKdZ3/ZiRByLsd1ZfbP5nFOrdxrd1rWP/7Ila781Fsz34+7o7oefM1eql54k5nb3rke80nH8m6wf/6TD8c/ej7M9tnEkvfVat3Vbx/90NX6KeL3j8X8wo5VsPj852TwfJltnxUZ/3zjye7f2Bx1/dvz3bR7/eNI+X1t7/DZ+3PNv2m3dQ/FH7+f/ruSzZnlX/tiVUr2+OBWxK/l44+PTD57bqre2z+I/dnTz/q/T+b83Ij7vMf4bh39+taf4B3T85x7r+D9+4c5HX/zQrf3e+r+3mqVj+SO99H+97uCTvHcAAAAAAACw0xQi4kAkheJ6uVAoFtfu7zgc+wrlaq1+/Hx16eJcNL8rOx5jhdZM98G2+yGm8vthW/XpR+ozEXEoIr4d2dusF2er5blBBw8AAAAAAAAAAAAAAAAAAAA7xP4u3//P/DEy6L0Dnjo/+Q3Da8v878cvPQE7kv//MLzkPwwv+Q/DS/7D8JL/MLzkPwwv+Q/DS/4DAAAAAAAAAAAAAAAAAAAAAAAAAABAX509cyZbGqv3r85m9bnLy0sL1csn5tLaQrGyNFucrS5eKs5Xq/PltDhbrWz1euVq9dLUdCxdmayntfpkbXnlXKW6dLF+7kKlNJ+eS8eeSVQAAAAAAAAAAAAAAAAAAADwfKktryyUyuV0UUFhW4XRnbEbCn0uDLpnAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAH/gsAAP//6AY3sQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1840, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x0) write$bt_hci(r2, &(0x7f0000000bc0)={0x1, @remote_name_req_cancel={{0x41a, 0x6}}}, 0xa) sendfile(r2, r0, 0x0, 0x40001) sendfile(r2, r1, 0x0, 0x7ffff000) 50.937897ms ago: executing program 4 (id=166): syz_io_uring_submit(0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x2, 0xf4261, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x147b7e, 0x0, @perf_config_ext={0x1, 0xf60e}, 0x9092, 0x0, 0x43a1bd76, 0x2, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x200b}, 0x0, 0x4000000000, 0xffffffffffffffff, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x5, &(0x7f0000001d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000c3707bf4000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) uname(&(0x7f00000000c0)=""/107) 0s ago: executing program 4 (id=167): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x20008080, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000600)={0x100000000, 0x0, 0x0, 0x0, {0x11}, 0x0, 0x0, 0x0, 0x0}, 0x58) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001240)={0xffffffffffffffff, 0xffffffffffffffff}) sendto(r1, &(0x7f0000000240)="368c413f888b1fb9667728860744c52794ae410f353306fac5db108a", 0xfffffffffffffcf8, 0x4000804, 0x0, 0x0) fcntl$setstatus(r1, 0x4, 0x2000) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.147' (ED25519) to the list of known hosts. [ 33.831054][ T28] audit: type=1400 audit(1770864796.059:62): avc: denied { mounton } for pid=3299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.854135][ T28] audit: type=1400 audit(1770864796.079:63): avc: denied { mount } for pid=3299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.856400][ T3299] cgroup: Unknown subsys name 'net' [ 33.882021][ T28] audit: type=1400 audit(1770864796.119:64): avc: denied { unmount } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 34.005094][ T3299] cgroup: Unknown subsys name 'cpuset' [ 34.011251][ T3299] cgroup: Unknown subsys name 'rlimit' [ 34.106541][ T28] audit: type=1400 audit(1770864796.339:65): avc: denied { setattr } for pid=3299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 34.131245][ T28] audit: type=1400 audit(1770864796.339:66): avc: denied { create } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.153097][ T28] audit: type=1400 audit(1770864796.339:67): avc: denied { write } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.179843][ T3302] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 34.188611][ T28] audit: type=1400 audit(1770864796.339:68): avc: denied { read } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 34.209046][ T28] audit: type=1400 audit(1770864796.349:69): avc: denied { mounton } for pid=3299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 34.233861][ T28] audit: type=1400 audit(1770864796.349:70): avc: denied { mount } for pid=3299 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 34.234727][ T3299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 34.257935][ T28] audit: type=1400 audit(1770864796.369:71): avc: denied { read } for pid=3038 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 35.398882][ T3311] chnl_net:caif_netlink_parms(): no params data found [ 35.429366][ T3317] chnl_net:caif_netlink_parms(): no params data found [ 35.466985][ T3312] chnl_net:caif_netlink_parms(): no params data found [ 35.541683][ T3317] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.548806][ T3317] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.555986][ T3317] bridge_slave_0: entered allmulticast mode [ 35.562351][ T3317] bridge_slave_0: entered promiscuous mode [ 35.569190][ T3317] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.576274][ T3317] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.583373][ T3317] bridge_slave_1: entered allmulticast mode [ 35.589903][ T3317] bridge_slave_1: entered promiscuous mode [ 35.613074][ T3311] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.620292][ T3311] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.627555][ T3311] bridge_slave_0: entered allmulticast mode [ 35.633952][ T3311] bridge_slave_0: entered promiscuous mode [ 35.652304][ T3312] bridge0: port 1(bridge_slave_0) entered blocking state [ 35.659756][ T3312] bridge0: port 1(bridge_slave_0) entered disabled state [ 35.666972][ T3312] bridge_slave_0: entered allmulticast mode [ 35.673441][ T3312] bridge_slave_0: entered promiscuous mode [ 35.680663][ T3312] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.688066][ T3312] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.695337][ T3312] bridge_slave_1: entered allmulticast mode [ 35.701880][ T3312] bridge_slave_1: entered promiscuous mode [ 35.708469][ T3311] bridge0: port 2(bridge_slave_1) entered blocking state [ 35.715683][ T3311] bridge0: port 2(bridge_slave_1) entered disabled state [ 35.722855][ T3311] bridge_slave_1: entered allmulticast mode [ 35.729431][ T3311] bridge_slave_1: entered promiscuous mode [ 35.737373][ T3317] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.766184][ T3317] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.782499][ T3314] chnl_net:caif_netlink_parms(): no params data found [ 35.792531][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.809349][ T3311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 35.824508][ T3311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.837721][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 35.857168][ T3317] team0: Port device team_slave_0 added [ 35.878951][ T3311] team0: Port device team_slave_0 added [ 35.885469][ T3317] team0: Port device team_slave_1 added [ 35.898478][ T3311] team0: Port device team_slave_1 added [ 35.930263][ T3312] team0: Port device team_slave_0 added [ 35.943119][ T3317] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 35.950181][ T3317] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 35.976212][ T3317] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 35.992039][ T3312] team0: Port device team_slave_1 added [ 35.997893][ T3316] chnl_net:caif_netlink_parms(): no params data found [ 36.010997][ T3317] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.018204][ T3317] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.044179][ T3317] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.055322][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.062312][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.088439][ T3311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.103915][ T3311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.111142][ T3311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.137150][ T3311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.171626][ T3314] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.178890][ T3314] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.186100][ T3314] bridge_slave_0: entered allmulticast mode [ 36.192432][ T3314] bridge_slave_0: entered promiscuous mode [ 36.199184][ T3314] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.206288][ T3314] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.213437][ T3314] bridge_slave_1: entered allmulticast mode [ 36.219995][ T3314] bridge_slave_1: entered promiscuous mode [ 36.227429][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.234505][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.260552][ T3312] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.271700][ T3312] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.278711][ T3312] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.305082][ T3312] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.342806][ T3314] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.365475][ T3314] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.383241][ T3317] hsr_slave_0: entered promiscuous mode [ 36.389397][ T3317] hsr_slave_1: entered promiscuous mode [ 36.397524][ T3311] hsr_slave_0: entered promiscuous mode [ 36.403613][ T3311] hsr_slave_1: entered promiscuous mode [ 36.409691][ T3311] debugfs: 'hsr0' already exists in 'hsr' [ 36.415479][ T3311] Cannot create hsr debugfs directory [ 36.456437][ T3312] hsr_slave_0: entered promiscuous mode [ 36.462515][ T3312] hsr_slave_1: entered promiscuous mode [ 36.468868][ T3312] debugfs: 'hsr0' already exists in 'hsr' [ 36.474754][ T3312] Cannot create hsr debugfs directory [ 36.485580][ T3316] bridge0: port 1(bridge_slave_0) entered blocking state [ 36.492690][ T3316] bridge0: port 1(bridge_slave_0) entered disabled state [ 36.500275][ T3316] bridge_slave_0: entered allmulticast mode [ 36.506772][ T3316] bridge_slave_0: entered promiscuous mode [ 36.513911][ T3314] team0: Port device team_slave_0 added [ 36.532866][ T3316] bridge0: port 2(bridge_slave_1) entered blocking state [ 36.540066][ T3316] bridge0: port 2(bridge_slave_1) entered disabled state [ 36.547616][ T3316] bridge_slave_1: entered allmulticast mode [ 36.554243][ T3316] bridge_slave_1: entered promiscuous mode [ 36.566574][ T3314] team0: Port device team_slave_1 added [ 36.610491][ T3316] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 36.619791][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.627101][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.653242][ T3314] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.677431][ T3316] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 36.686786][ T3314] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.693775][ T3314] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.719822][ T3314] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 36.778737][ T3316] team0: Port device team_slave_0 added [ 36.785480][ T3316] team0: Port device team_slave_1 added [ 36.813388][ T3314] hsr_slave_0: entered promiscuous mode [ 36.819479][ T3314] hsr_slave_1: entered promiscuous mode [ 36.825365][ T3314] debugfs: 'hsr0' already exists in 'hsr' [ 36.831111][ T3314] Cannot create hsr debugfs directory [ 36.860859][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 36.868031][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.893999][ T3316] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 36.905363][ T3316] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 36.912483][ T3316] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 36.938545][ T3316] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 37.006832][ T3317] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 37.018064][ T3317] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 37.029012][ T3316] hsr_slave_0: entered promiscuous mode [ 37.035073][ T3316] hsr_slave_1: entered promiscuous mode [ 37.041041][ T3316] debugfs: 'hsr0' already exists in 'hsr' [ 37.046906][ T3316] Cannot create hsr debugfs directory [ 37.057072][ T3317] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 37.076902][ T3317] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 37.134624][ T3312] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 37.154605][ T3312] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 37.169497][ T3312] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 37.181983][ T3312] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 37.211508][ T3311] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 37.220692][ T3311] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 37.230196][ T3311] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 37.239135][ T3311] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 37.289124][ T3314] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 37.298568][ T3314] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 37.311414][ T3317] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.320047][ T3314] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 37.331855][ T3314] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 37.368806][ T3316] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 37.384803][ T3316] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 37.393379][ T3316] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 37.402661][ T3316] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 37.414947][ T3317] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.428292][ T3311] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.440127][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.447236][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.457064][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.464140][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.489402][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.500438][ T3311] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.518275][ T3312] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.549090][ T1636] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.556270][ T1636] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.567337][ T1636] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.574452][ T1636] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.583359][ T1636] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.590515][ T1636] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.599619][ T1636] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.606714][ T1636] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.623281][ T3317] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 37.633781][ T3317] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.667001][ T3311] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 37.677815][ T3311] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.691135][ T3314] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.733078][ T3316] 8021q: adding VLAN 0 to HW filter on device bond0 [ 37.741559][ T3314] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.755522][ T3316] 8021q: adding VLAN 0 to HW filter on device team0 [ 37.767576][ T3312] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 37.788482][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.795609][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.817409][ T3311] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.826299][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 37.833442][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 37.843084][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.850177][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.870504][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 37.877626][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 37.890265][ T3317] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 37.977585][ T3312] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.041052][ T3316] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.070904][ T3314] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 38.147408][ T3317] veth0_vlan: entered promiscuous mode [ 38.158211][ T3312] veth0_vlan: entered promiscuous mode [ 38.178953][ T3311] veth0_vlan: entered promiscuous mode [ 38.191845][ T3317] veth1_vlan: entered promiscuous mode [ 38.200945][ T3312] veth1_vlan: entered promiscuous mode [ 38.220088][ T3311] veth1_vlan: entered promiscuous mode [ 38.234930][ T3316] veth0_vlan: entered promiscuous mode [ 38.254780][ T3311] veth0_macvtap: entered promiscuous mode [ 38.262044][ T3314] veth0_vlan: entered promiscuous mode [ 38.271736][ T3311] veth1_macvtap: entered promiscuous mode [ 38.281196][ T3314] veth1_vlan: entered promiscuous mode [ 38.288893][ T3316] veth1_vlan: entered promiscuous mode [ 38.300361][ T3317] veth0_macvtap: entered promiscuous mode [ 38.312462][ T3317] veth1_macvtap: entered promiscuous mode [ 38.319468][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.331439][ T3312] veth0_macvtap: entered promiscuous mode [ 38.339246][ T3312] veth1_macvtap: entered promiscuous mode [ 38.350423][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.366354][ T3311] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.376747][ T3314] veth0_macvtap: entered promiscuous mode [ 38.389166][ T30] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.398595][ T3317] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.408139][ T3314] veth1_macvtap: entered promiscuous mode [ 38.417752][ T50] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.426754][ T50] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.446801][ T50] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.455830][ T50] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.466342][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.481442][ T50] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.490672][ T50] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.501528][ T3316] veth0_macvtap: entered promiscuous mode [ 38.510947][ T3312] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.518807][ T50] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.537831][ T30] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.549442][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.558302][ T3316] veth1_macvtap: entered promiscuous mode [ 38.577247][ T3317] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 38.580897][ T30] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.601083][ T30] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.616775][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 38.633795][ T30] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.662542][ T3314] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.676044][ T3316] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 38.689644][ T3479] loop3: detected capacity change from 0 to 8192 [ 38.700274][ T3479] ======================================================= [ 38.700274][ T3479] WARNING: The mand mount option has been deprecated and [ 38.700274][ T3479] and is ignored by this kernel. Remove the mand [ 38.700274][ T3479] option from the mount to silence this warning. [ 38.700274][ T3479] ======================================================= [ 38.750327][ T30] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.759542][ T30] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.820649][ T30] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.837861][ T30] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.854779][ T28] kauditd_printk_skb: 27 callbacks suppressed [ 38.854797][ T28] audit: type=1400 audit(1770864801.089:99): avc: denied { create } for pid=3482 comm="syz.4.5" anonclass=[io_uring] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 38.888338][ T30] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.915310][ T30] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.944514][ T28] audit: type=1400 audit(1770864801.169:100): avc: denied { create } for pid=3483 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 38.971848][ T30] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 38.988449][ T28] audit: type=1400 audit(1770864801.169:101): avc: denied { bind } for pid=3483 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 38.991265][ T30] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.094058][ T28] audit: type=1400 audit(1770864801.169:102): avc: denied { write } for pid=3483 comm="syz.2.3" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 39.117379][ T28] audit: type=1400 audit(1770864801.219:103): avc: denied { create } for pid=3490 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.139938][ T28] audit: type=1400 audit(1770864801.249:104): avc: denied { bind } for pid=3490 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.159401][ T28] audit: type=1400 audit(1770864801.249:105): avc: denied { listen } for pid=3490 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.225676][ T3503] io-wq is not configured for unbound workers [ 39.262153][ T28] audit: type=1400 audit(1770864801.249:106): avc: denied { create } for pid=3490 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.290073][ T3509] loop1: detected capacity change from 0 to 512 [ 39.337857][ T3509] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 39.348764][ T28] audit: type=1400 audit(1770864801.249:107): avc: denied { connect } for pid=3490 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.386599][ T3509] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 39.396807][ T28] audit: type=1400 audit(1770864801.249:108): avc: denied { write } for pid=3490 comm="syz.0.1" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 39.481725][ C0] hrtimer: interrupt took 58177 ns [ 39.563514][ T3316] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 39.642968][ T3525] netlink: 4 bytes leftover after parsing attributes in process `syz.1.17'. [ 39.662981][ T3527] netlink: 'syz.4.18': attribute type 39 has an invalid length. [ 39.928366][ T3536] netlink: 'syz.3.22': attribute type 10 has an invalid length. [ 39.980772][ T3536] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 40.016963][ T3536] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 40.103180][ T3556] netlink: 'syz.0.31': attribute type 10 has an invalid length. [ 40.119017][ T3556] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 40.145173][ T3560] loop2: detected capacity change from 0 to 512 [ 40.158473][ T3560] EXT4-fs: Invalid want_extra_isize 64870 [ 40.219462][ T3566] netlink: 4 bytes leftover after parsing attributes in process `syz.3.36'. [ 40.234147][ T3566] netlink: 12 bytes leftover after parsing attributes in process `syz.3.36'. [ 40.426184][ T3587] loop3: detected capacity change from 0 to 128 [ 40.503585][ T3592] syz.3.44: attempt to access beyond end of device [ 40.503585][ T3592] loop3: rw=2049, sector=145, nr_sectors = 8 limit=128 [ 40.531587][ T3592] syz.3.44: attempt to access beyond end of device [ 40.531587][ T3592] loop3: rw=2049, sector=161, nr_sectors = 8 limit=128 [ 40.545537][ T3592] syz.3.44: attempt to access beyond end of device [ 40.545537][ T3592] loop3: rw=2049, sector=177, nr_sectors = 8 limit=128 [ 40.579887][ T3592] syz.3.44: attempt to access beyond end of device [ 40.579887][ T3592] loop3: rw=2049, sector=193, nr_sectors = 8 limit=128 [ 40.609102][ T3592] syz.3.44: attempt to access beyond end of device [ 40.609102][ T3592] loop3: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 40.652082][ T3592] syz.3.44: attempt to access beyond end of device [ 40.652082][ T3592] loop3: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 40.692305][ T3592] syz.3.44: attempt to access beyond end of device [ 40.692305][ T3592] loop3: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 40.747328][ T3592] syz.3.44: attempt to access beyond end of device [ 40.747328][ T3592] loop3: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 40.768240][ T3592] syz.3.44: attempt to access beyond end of device [ 40.768240][ T3592] loop3: rw=2049, sector=273, nr_sectors = 8 limit=128 [ 40.784125][ T3592] syz.3.44: attempt to access beyond end of device [ 40.784125][ T3592] loop3: rw=2049, sector=289, nr_sectors = 8 limit=128 [ 41.293526][ T3645] loop1: detected capacity change from 0 to 2048 [ 41.305092][ T3646] netlink: 12 bytes leftover after parsing attributes in process `syz.0.69'. [ 41.367067][ T3301] loop1: p1 < > p4 [ 41.372066][ T3301] loop1: p4 size 722688 extends beyond EOD, truncated [ 41.388519][ T3645] loop1: p1 < > p4 [ 41.393087][ T3645] loop1: p4 size 722688 extends beyond EOD, truncated [ 41.546824][ T3660] tipc: Failed to remove unknown binding: 66,1,1/0:2778781239/2778781241 [ 41.606359][ T3662] syzkaller0: entered allmulticast mode [ 41.618914][ T3662] syzkaller0: entered promiscuous mode [ 41.643180][ T3662] syzkaller0 (unregistering): left promiscuous mode [ 41.656547][ T3662] syzkaller0 (unregistering): left allmulticast mode [ 41.788820][ T3654] loop0: detected capacity change from 0 to 32768 [ 41.816059][ T3670] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 41.878583][ T3675] netlink: 'syz.0.80': attribute type 2 has an invalid length. [ 41.897918][ T3675] netlink: 'syz.0.80': attribute type 1 has an invalid length. [ 41.912790][ T3673] netlink: 'syz.3.79': attribute type 1 has an invalid length. [ 42.059499][ T3688] netlink: 4 bytes leftover after parsing attributes in process `syz.3.86'. [ 42.343810][ T3717] SELinux: failed to load policy [ 42.555741][ T3732] loop2: detected capacity change from 0 to 512 [ 42.772536][ T3747] loop2: detected capacity change from 0 to 512 [ 42.805126][ T3747] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 42.818473][ T3747] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended [ 42.837651][ T3747] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 42.846788][ T3747] EXT4-fs (loop2): warning: mounting unchecked fs, running e2fsck is recommended [ 42.856607][ T3747] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=c002e01d, mo2=0006] [ 42.867139][ T3747] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.896924][ T3312] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.918096][ T3751] netlink: 63503 bytes leftover after parsing attributes in process `syz.2.111'. [ 43.032098][ T3761] netlink: 12 bytes leftover after parsing attributes in process `syz.1.116'. [ 43.083697][ T3764] lo speed is unknown, defaulting to 1000 [ 43.089965][ T3764] lo speed is unknown, defaulting to 1000 [ 43.096096][ T3764] lo speed is unknown, defaulting to 1000 [ 43.102204][ T3764] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 43.124077][ T3764] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 43.144971][ T3764] lo speed is unknown, defaulting to 1000 [ 43.168774][ T3764] lo speed is unknown, defaulting to 1000 [ 43.176930][ T3767] netlink: 'syz.2.118': attribute type 1 has an invalid length. [ 43.179241][ T3764] lo speed is unknown, defaulting to 1000 [ 43.190791][ T3764] lo speed is unknown, defaulting to 1000 [ 43.196722][ T3767] netlink: 'syz.2.118': attribute type 2 has an invalid length. [ 43.204950][ T3764] lo speed is unknown, defaulting to 1000 [ 43.210883][ T3767] netlink: 4 bytes leftover after parsing attributes in process `syz.2.118'. [ 43.262597][ T3767] lo speed is unknown, defaulting to 1000 [ 43.355604][ T3774] loop1: detected capacity change from 0 to 128 [ 43.448374][ T3774] EXT4-fs (loop1): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 43.468509][ T3774] ext4 filesystem being mounted at /28/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 43.552423][ T3316] EXT4-fs (loop1): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 43.638851][ T3796] loop0: detected capacity change from 0 to 512 [ 43.657269][ T3796] EXT4-fs (loop0): invalid inodes per group: 0 [ 43.657269][ T3796] [ 44.079670][ T3815] netlink: 12 bytes leftover after parsing attributes in process `syz.3.138'. [ 44.747928][ T3834] uprobe: syz.1.144:3834 failed to unregister, leaking uprobe [ 44.758738][ T28] kauditd_printk_skb: 105 callbacks suppressed [ 44.758756][ T28] audit: type=1400 audit(1770864806.989:214): avc: denied { create } for pid=3832 comm="syz.3.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 44.804434][ T28] audit: type=1400 audit(1770864807.039:215): avc: denied { connect } for pid=3832 comm="syz.3.145" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 44.834379][ T28] audit: type=1400 audit(1770864807.059:216): avc: denied { ioctl } for pid=3832 comm="syz.3.145" path="socket:[5953]" dev="sockfs" ino=5953 ioctlcmd=0x7452 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 44.893538][ T3838] netlink: 4 bytes leftover after parsing attributes in process `syz.3.147'. [ 44.914966][ T3839] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 44.923457][ T3838] netlink: 12 bytes leftover after parsing attributes in process `syz.3.147'. [ 44.935520][ T3839] sch_tbf: burst 22 is lower than device lo mtu (65550) ! [ 44.942727][ T3839] Zero length message leads to an empty skb [ 45.047121][ T28] audit: type=1400 audit(1770864807.279:217): avc: denied { execute } for pid=3840 comm="syz.1.148" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=5041 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 45.093891][ T28] audit: type=1400 audit(1770864807.309:218): avc: denied { map } for pid=3840 comm="syz.1.148" path="socket:[5042]" dev="sockfs" ino=5042 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 45.123970][ T28] audit: type=1400 audit(1770864807.309:219): avc: denied { read } for pid=3840 comm="syz.1.148" path="socket:[5042]" dev="sockfs" ino=5042 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 45.189744][ T28] audit: type=1400 audit(1770864807.309:220): avc: denied { create } for pid=3840 comm="syz.1.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 45.221500][ T28] audit: type=1400 audit(1770864807.309:221): avc: denied { setopt } for pid=3840 comm="syz.1.148" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 45.242084][ T28] audit: type=1400 audit(1770864807.409:222): avc: denied { create } for pid=3845 comm="syz.2.150" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 45.280827][ T28] audit: type=1400 audit(1770864807.509:223): avc: denied { write } for pid=3847 comm="syz.4.151" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 45.358976][ T3852] lo speed is unknown, defaulting to 1000 [ 45.547612][ T3852] netlink: 20 bytes leftover after parsing attributes in process `syz.3.153'. [ 45.674358][ T3868] loop3: detected capacity change from 0 to 512 [ 45.695219][ T3868] EXT4-fs error (device loop3): ext4_orphan_get:1391: inode #15: comm syz.3.159: inode has both inline data and extents flags [ 45.725851][ T3868] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 45.725991][ T3868] EXT4-fs error (device loop3): ext4_orphan_get:1396: comm syz.3.159: couldn't read orphan inode 15 (err -117) [ 45.754702][ T3868] loop3: lost filesystem error report for type 5 error -117 [ 45.755668][ T3868] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.890082][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 46.003841][ T3886] loop3: detected capacity change from 0 to 1024 [ 46.010780][ T3886] EXT4-fs: Ignoring removed oldalloc option [ 46.017874][ T3886] EXT4-fs: Ignoring removed bh option [ 46.035939][ T3886] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 46.413558][ T3886] ================================================================== [ 46.421697][ T3886] BUG: KCSAN: data-race in copy_folio_from_iter_atomic / copy_folio_from_iter_atomic [ 46.431175][ T3886] [ 46.433522][ T3886] read to 0xffff8881056c2c00 of 1024 bytes by task 317 on cpu 1: [ 46.441264][ T3886] copy_folio_from_iter_atomic+0x75f/0x1170 [ 46.447191][ T3886] generic_perform_write+0x2c1/0x490 [ 46.452487][ T3886] shmem_file_write_iter+0xc5/0xf0 [ 46.457615][ T3886] lo_rw_aio+0x67d/0x730 [ 46.461887][ T3886] loop_process_work+0x56c/0xac0 [ 46.466881][ T3886] loop_workfn+0x31/0x40 [ 46.471166][ T3886] process_scheduled_works+0x4cd/0x9d0 [ 46.476680][ T3886] worker_thread+0x581/0x770 [ 46.481311][ T3886] kthread+0x22a/0x280 [ 46.485420][ T3886] ret_from_fork+0x150/0x360 [ 46.490039][ T3886] ret_from_fork_asm+0x1a/0x30 [ 46.494838][ T3886] [ 46.497171][ T3886] write to 0xffff8881056c2cd6 of 20 bytes by task 3886 on cpu 0: [ 46.504893][ T3886] copy_folio_from_iter_atomic+0x75f/0x1170 [ 46.510841][ T3886] generic_perform_write+0x2c1/0x490 [ 46.516150][ T3886] ext4_buffered_write_iter+0x1ee/0x3c0 [ 46.521727][ T3886] ext4_file_write_iter+0x380/0xf70 [ 46.526950][ T3886] iter_file_splice_write+0x6bc/0xa80 [ 46.532349][ T3886] direct_splice_actor+0x156/0x2a0 [ 46.537499][ T3886] splice_direct_to_actor+0x311/0x670 [ 46.542908][ T3886] do_splice_direct+0x119/0x1a0 [ 46.547794][ T3886] do_sendfile+0x382/0x650 [ 46.552248][ T3886] __x64_sys_sendfile64+0x105/0x150 [ 46.557512][ T3886] x64_sys_call+0x2dc4/0x3020 [ 46.562219][ T3886] do_syscall_64+0x12c/0x370 [ 46.566842][ T3886] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 46.572766][ T3886] [ 46.575102][ T3886] Reported by Kernel Concurrency Sanitizer on: [ 46.581290][ T3886] CPU: 0 UID: 0 PID: 3886 Comm: syz.3.165 Not tainted syzkaller #0 PREEMPT(full) [ 46.590504][ T3886] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 46.600574][ T3886] ================================================================== [ 46.799355][ T3890] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4215: comm syz.3.165: Allocating blocks 1-17 which overlap fs metadata [ 46.813262][ T3886] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:4215: comm syz.3.165: Allocating blocks 1-17 which overlap fs metadata [ 46.895266][ T3317] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.