last executing test programs: 3m43.65143531s ago: executing program 4 (id=5): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000940)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@private2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x24}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000b00)=@migrate={0xa0, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@local, @in6=@loopback, 0xfffe, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in=@rand_addr=0x64010102, @in6=@mcast1, @in=@loopback, @in=@broadcast, 0x6c, 0x1, 0x0, 0xff84, 0xa, 0xa}]}]}, 0xa0}, 0x1, 0x0, 0x0, 0x800}, 0x4000000) 3m43.531779593s ago: executing program 4 (id=17): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000440)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_mptcp(0xa, 0x1, 0x106) sendmsg$NFT_BATCH(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a20000000000a010400000000000000000500000a0900010073797a30000000005c000000030a010400000000000000000500000a0900010073797a30000000000900030073797a30000000002800048008000140000000000800024000000001140003006e657464657673696d3000000000000008000a400000000260000000060a01fc74f64900000000000500000a0900010073797a30000000000900020073797a300000000034000480300001800e000100696d6d6564696174650000001c0002800800014000000000100002800c000280080001800000000114000000110001"], 0x104}}, 0x0) 3m43.510449544s ago: executing program 4 (id=18): close(0xffffffffffffffff) ioctl$XFS_IOC_FSCOUNTS(0xffffffffffffffff, 0x80205871, &(0x7f0000000000)) socket(0x1d, 0x2, 0x1) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_type(r0, 0x0, 0x2, 0x0) openat$cgroup_procs(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r1, &(0x7f0000001040)={0x27, 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) listen(r1, 0xf5f) accept(r1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) socketpair(0x1, 0x20000000000001, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) 3m42.597166467s ago: executing program 4 (id=26): r0 = perf_event_open(&(0x7f00000006c0)={0x2, 0x80, 0x2f, 0x1, 0x0, 0x0, 0x0, 0xd, 0xb41bd, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x66, 0x2, @perf_config_ext={0x7, 0x100}, 0x204, 0x4, 0x43a1bd76, 0x8, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x4000000000, 0xffffffffffffffff, 0x9) r1 = socket$inet6_icmp(0xa, 0x2, 0x3a) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x5, 0x5, &(0x7f0000000640)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) syz_mount_image$ext4(&(0x7f00000001c0)='ext2\x00', &(0x7f0000000480)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x1000000, &(0x7f0000000740), 0xfe, 0x2a4, &(0x7f0000000a80)="$eJzs3bFrJFUcB/DfzO4mxjuOUxsrEUREA+EsBMFGGw8O5BARQQ9O5LRRLkJM2qyVjYW9SiqbIFYaBRuxCTb+AVFTxMYmWBgUTDGyO7Oy2Ww2s+7srGQ/H9jZN5s3eW/Jft9MmJl9AcytqxHxbEQ0ImI5IloRkfRXeDh/XC1Wt5Z2b0dk2Uu/J916+Xqut92liGhHxNMRzd7PNnZeO/hz7/pjH663Hv1s59Wlut5fv8OD/ReOPr35wVc3ntxIi9cuF8/976NKyZDXmknE/dNo7H8iaZasuDjljnCOL37q5P6BiHikm/9WpEVkP1pb+L4VT3wyfLuFo3r7CUxDlrU6+8B2BsydtHsMnKQrEZGX03RlJT+G/7mRxDura+8tv7W6fvfOrEcq4FxfHmfZ6BpJO/+/d//5bxa/vjSQ/98aef5LeaqKDgN16+T/5Re3f+mUjxqz7g1Qg297hU7+l1/ffDzkHy6UMifX5B8umrInXuUf5tlY+U/r6RMwplHZHXF9lf0/zC/5h/lVNv/tGvsEVKTVKwxP8OT7/7+KKwj/exeBul3pLh3/w/wayH9xyUBxt2q5g/7rb955e3odBKp2q1fozz8AMF+yxRnfgAzMzKzHHwAAAAAAAAAAAAAAAAAA4LStpd3bvUddbf7wccThc/m0Rf3t59MWNIppR+7pLu/9Izkxu1Ey1mxHw92acPtJfV7x3dc3R8z3MMyVX6ttv/xfZKG7/PGhqtvPvX9y9czp8DbvRrQ7la81m6c//0nZaW/O/P33nbNh641yDVQlGVh/5pV62x90vD3b9m/sRXzXGX+uDRv/0niw+zx8/Lnc/xXL8e9Heizv/j1J7wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKjTPwEAAP//d/F4Hg==") syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181d011, 0x0, 0x40, 0x0, &(0x7f0000000140)) r3 = socket(0x10, 0x80003, 0x0) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r4 = socket$inet6(0xa, 0x5, 0x0) r5 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) r6 = syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000180)='./file0\x00', 0x200000, &(0x7f0000000080)=ANY=[@ANYRES8=r5, @ANYRES32, @ANYRESOCT], 0x1, 0x392, &(0x7f0000001000)="$eJzs3T1vW2UUAOATt/mExBkQEiDEq24sVhL+QCPUSohIoFCj0gFxS5xixY0j2wpyhaADEiv/gL1iZENC/IEMsLOxZWHsUNXIX6mdul+kyaXq80jRPfZ7jvO+tnx1FuscXv3x5s52s7SdtaJwMUUhIgp3I5Z7Ud/U4FroxTMx6na8W7z619uffHbtw/WNjUubKV1ev/LeWkpp6Z3fvv7m5wu/t1759JelX2fjYPnzw3/W/j54/eCNw/tXvqo2U7WZduutlKXr9Xoru16rpK1qc6eU0se1StaspOpus9IYW9+u1ff22inb3Vpc2GtUms2U7bbTTqWdWvXUarRTdiOr7qZSqZQWF4InKd/Z3MzW+/HcY/IuntWGOAWNxnrW/Q7PPrRSvpPLhgCAXJ20/595qv7/WmGk/5+LR/b/06H/fy6mny5ttP//zy/C/1y3/58ZfH/H6f8BAAAAAAAAAAAAAOBFcLfTKXY6neLw2hn+SHjwOOftccoe+vyP/eW9P07XyA/35iJqP+yX98v9a399fTuqUYtKrEQx7nVvC0P9+PIHG5dWUs9yLN78rld/4Y+I8rnx+tUoxvLk+tV+fTqqj+51OhZG69fii3htcv3axPqZWPlppL4Uxfjzy6hHLbZ6t7cH9d+upvT+RxvH6md7eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8HEpp6K3oz73fL0fMx/5gfn/pQcLy+Hz8fv3RfP2VKMa9yfP5VybO5z8fb57P9+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNRs39rJarVK46yC4cz/3jMzw+DRVVP99NvHluZjPHn2Sa9zwqDwTFXzg0NOWLrf6XR6wY3vn/tW5872ozxJMB0Rj8npDN7Ak/+vVyNi9Jlz4zmzEXGqJ13qBoX83/BnDvK4GwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEC+joZ+dx9M5b0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8tJs39rJarVK4xSDvM8IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwIvk3AAD//8s8Cyw=") r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r7, 0x402, 0x30) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0xa880, 0x85) lseek(r8, 0x104, 0x1) getdents64(r8, 0x0, 0x4f) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000001100)=0x3fa, 0x4) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x33, 0x0, 0x0) syz_clone(0x88206100, 0x0, 0x0, 0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="200100001200"], 0x120}}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000780)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000000340)="19b2cd4762e742cdd9f9b3f448cd381401e60dbf6cc1bd935ce9a639e34841aa0bd259b51d80a3292e03bfc33dc1a2d55f1b49a1dcb5967f97209c14f5579c168d6b0e76a7cc0e62b4cb02b9a19695f19ec47b0d843660236cf159c5cb4b6a66dec0312db47f0a2aa661c67489c6face4f8cf47d28ba71003d2fcc4188f96546d111e9939548e662f4c78e974871c4923290f82e1403e86f1ab2e0535e54a8a5118472744a45aea6c49494de3ce65f59823dccbaef5417d3af20df05a1d2a4b25e937b8d2e33fc63f270a5673a8a2dd49ee5110303091cf890b6d39ce88583c80a93816e9f3c8fc6f15c8533dce30baf3d1fea4fa5de784571dca03f5b", 0xfd, r6}, 0x68) close_range(r3, 0xffffffffffffffff, 0x0) fsopen(0x0, 0x0) 3m42.023657191s ago: executing program 4 (id=28): socket$nl_generic(0x10, 0x3, 0x10) epoll_create1(0x0) openat$nci(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f000005ffe4)={0xa, 0x4e22, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) r0 = socket(0x40000000015, 0x5, 0x0) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) pipe(&(0x7f0000000180)) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0xa) bind$inet(r0, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r0, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000280), 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x1d, &(0x7f0000000080)=0xfa, 0x4) sendmsg$NFT_BATCH(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) 3m41.125076874s ago: executing program 4 (id=50): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000640), 0x0, 0x0, 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000800)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000780)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x1b59, 0xc, 0x0, @gue={{0x1, 0x0, 0x3, 0x2, 0x100, @void}}}}}}}, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f00000007c0)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000840)='highspeed', 0x6) 3m41.124959365s ago: executing program 32 (id=50): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000640), 0x0, 0x0, 0x0, 0x0) bind$bt_l2cap(0xffffffffffffffff, &(0x7f0000000800)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000780)={@multicast, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x1b59, 0xc, 0x0, @gue={{0x1, 0x0, 0x3, 0x2, 0x100, @void}}}}}}}, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r1, &(0x7f00000007c0)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000840)='highspeed', 0x6) 1.772359815s ago: executing program 5 (id=3771): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, 0x0, 0x800) 1.620124979s ago: executing program 5 (id=3775): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000080)={0x3, 0x6}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000001600)=[{0x28, 0x20, 0x0, 0xfffff034}, {0x50, 0x1, 0x7, 0x80000000}, {0x6, 0x80, 0xfd, 0x3}]}, 0x10) r0 = socket(0xa, 0x5, 0x0) sendmsg$inet_sctp(r0, &(0x7f0000000000)={&(0x7f0000000040)=@in6={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, '\x00', 0x2c}, 0x7}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000140)="e6", 0x1}], 0x1, 0x0, 0x0, 0x8890}, 0x24000052) 1.503850531s ago: executing program 5 (id=3776): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x50, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r1}, &(0x7f00000003c0), &(0x7f0000000400)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc92b18236457ee3c8", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.459014583s ago: executing program 5 (id=3777): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f00000010c0)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) listen(r0, 0x1) sendmsg(r0, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000000000001000000000000000100100000e"], 0x28}, 0x0) recvmmsg(r0, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}, 0x20200000}, {{0x0, 0x0, &(0x7f0000001200)=[{0x0}, {0x0}], 0x2}}], 0x2, 0x2, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000002540)={&(0x7f0000002580)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x24, &(0x7f0000002600)=[{&(0x7f0000002640), 0x1000}], 0x1, &(0x7f0000002680)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0) 1.358753995s ago: executing program 5 (id=3782): r0 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000080)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x2, 0x30, 0x0, 0x0, 0x2, 0x6, 0x0, @private=0xa010100, @dev}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, {[@exp_fastopen={0x1d, 0x6, 0xf989, "a75a"}]}}}}}}}, 0x0) write$selinux_access(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a7570647077645f657865635f742073797374656d5f753a73797374656d5f723afaffffffffffffff3a73302030"], 0x56) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', 0x404, &(0x7f0000000180)=ANY=[@ANYRES16=0x0, @ANYRES8, @ANYRES8=0x0], 0x1, 0x122e, &(0x7f0000001a40)="$eJzs3MFrHFUcB/BftqlZU5tErdX2oA+9eBqaHDwJEiQFyYJSG6EVhCmZ6JJxN2SWwIoYe/Lq0b9BPHpTxH8gV/8Cb7mIpxzEEXZSk60NmlqyRT+fy/zIb76Z99hl4S3v7f7rX368uVFlG/kgWlNT0dqKSAcpUrTinhdXm+ut26vLnc7KjZSuL99cfC2lNPfSD+9/+s3LPw4uvPft3Hczsbfwwf4vSz/vXd67sv/7zY+6VepWqdcfpDzd6fcH+Z2ySOvdajNL6Z2yyKsidXtVsT3W3yj7W1vDlPfWL85ubRdVlfLeMG0WwzTop8H2MOUf5t1eyrIsXZwNTnT+729Z+/qgrr+PqOvz8UTUdV0/GbMxFU/FxZiLzyPi6Xgmno1L8Vxcjufjhbgyuusshg8AAAAAAAAAAAAAAAAAAAD/Hwej0/zj5/8vHJ7/n48F5/8BAAAAAAAAAAAAAAAAAADgDLx76/bqcqezciOldkT5xc7azlpzbfrLG9GNMoq4FvPxW4xO/zea+vpbnZVraeRcROwe5nd31s6N5xdHPydwmJ8e9e7lF5t8irvlsfxMzDb5dkQUsRTzcenY89tH+aUH5tvx6ivHnp/FfL0b0Y8y1kfPPsp/tpjSm2937stfHd0HAAAA/wVZ+tPC+Pq3Wb9n2Un9Jn+K7wfuW19Px9Xpyc6diGr4yWZelsX2eNH+y18mVsw8HsM4TdH6N/GZOLHVGmt99VPEpGf6WBTtw/fyo/iHU5OfzkMUdx/J3MeLCX8wcSaOXvRJjwQAAAAAAAAAAIDT+Cf7AX+Nh95FOB0P2Fn2xmSmCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/MEOHAsAAAAACPO3TqNjAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAoQIAAP//uXHE5A==") perf_event_open(&(0x7f0000002c80)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x2, @perf_config_ext={0x4, 0xe}, 0x0, 0x7, 0x11000, 0x5, 0x8, 0x90000011, 0xffff, 0x0, 0x0, 0x0, 0xc0}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x9) r1 = openat(0xffffffffffffff9c, &(0x7f0000002d00)='./file1\x00', 0x42, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000002d40)='./file1\x00', 0x103a42, 0x32) ftruncate(r2, 0x6000000) fallocate(r1, 0x0, 0xa20, 0x8000c64) openat$ptmx(0xffffffffffffff9c, 0x0, 0x60081, 0x0) syz_usb_connect(0x3, 0x3d, 0x0, 0x0) arch_prctl$ARCH_SET_GS(0x1001, 0xffffffffffffffff) r3 = io_uring_setup(0x1684, &(0x7f0000000780)={0x0, 0x3a2b, 0x8, 0x2, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000800)=[{&(0x7f0000000a40)=""/4095, 0x440000}], 0x100000000000011a) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) 1.1781171s ago: executing program 2 (id=3787): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="300000000000000029000000040000008402", @ANYRES64=r0, @ANYRES8=r0], 0x30}, 0x800) 1.128410151s ago: executing program 2 (id=3789): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x8) 1.063620373s ago: executing program 2 (id=3790): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="30000000000000002900000004000000840230", @ANYRES64=r0, @ANYRES8=r0], 0x30}, 0x800) 1.061557583s ago: executing program 2 (id=3792): perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0x65, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc094, 0x6, @perf_config_ext={0x3ff, 0x7}, 0x100004, 0x0, 0x10004, 0x3, 0x2, 0x7, 0x1000, 0x0, 0x0, 0x0, 0x100000001}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x1) syz_init_net_socket$x25(0x9, 0x5, 0x0) lseek(0xffffffffffffffff, 0x0, 0x1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6000) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e23, 0xffff, @local, 0x3}]}, &(0x7f00000000c0)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000100)={0x1, [0x0]}, &(0x7f0000000140)=0x8) getsockopt$inet_sctp6_SCTP_INTERLEAVING_SUPPORTED(r1, 0x84, 0x7d, &(0x7f0000000180)={r2, 0xac}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000440)={r3}, &(0x7f0000000500)=0x8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x9f, 0x11, 0x3, 0x1088, 0x9c4}, 0x1}}, @TCA_MPLS_PROTO={0x6, 0x4, 0x17}]}, {0x4, 0x4}, {0xc, 0x7, {0x0, 0x600}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}}, 0x10) 498.358557ms ago: executing program 0 (id=3802): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x50, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r1}, &(0x7f00000003c0), &(0x7f0000000400)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc92b18236457ee3c8", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 497.587267ms ago: executing program 0 (id=3804): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000009c0), 0x40180, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000a00)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a40), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000a80)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000b40)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x1, 0x4, 0x2, 0x1000, 0x7, 0xfffffff9}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x4040840) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000c40)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x8170b922, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0x8}, {0x5, 0xb}, {0xfff2, 0xffe0}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x1}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8001}, 0xb32019a74e55d2de) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000cc0)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000d00)="05", 0x1, 0x20000005, &(0x7f0000000d40)={0x11, 0x7, r5, 0x1, 0x0, 0x6, @remote}, 0x14) 460.389888ms ago: executing program 1 (id=3805): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000010000008e000000c9e7000001000000", @ANYRES32, @ANYBLOB="000000000000000000e9ffffff00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd28, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x100, 0x0, 0x1, 0x5, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x1) r1 = syz_open_dev$usbmon(&(0x7f0000000100), 0x8008, 0x1c1300) mmap(&(0x7f00006c2000/0x1000)=nil, 0x1000, 0x5, 0x13, r1, 0x1e67e000) ioctl$MON_IOCT_RING_SIZE(r1, 0x9204, 0x49cdee) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0xa, &(0x7f0000000280), 0x4) r3 = epoll_create(0x80000000) epoll_pwait(r3, &(0x7f00000002c0)=[{}], 0x1, 0xa2e4, &(0x7f0000000300)={[0x101]}, 0x8) r4 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000400)={'bridge_slave_1\x00'}) syz_emit_ethernet(0x56, 0x0, 0x0) syz_io_uring_complete(0x0, r4) setns(0xc9, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x41, &(0x7f00000004c0)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000900000003000000"], 0x58) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000680)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(r8, 0x4, 0x800) connect$inet6(r8, &(0x7f0000000c00)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 459.904628ms ago: executing program 3 (id=3806): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl0\x00', 0x0}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000100)=@file={0x1}, 0x6e) listen(r1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000200)=@hci, 0x56, &(0x7f0000000280)}, 0x1f00) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0xb6df4c32c1d5c814}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan1\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0xa0380, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000440)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000580)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@gettclass={0x24, 0x2a, 0x129, 0x70bd26, 0xfffffff8, {0x0, 0x0, 0x0, r5, {0xffe0, 0xd}, {}, {0x8, 0x14}}}, 0x24}}, 0x40004) recvmmsg(r6, &(0x7f0000000880)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000a00)=""/162, 0xa2}, {&(0x7f0000000ac0)=""/70, 0x46}, {&(0x7f0000000b40)=""/62, 0x3e}, {&(0x7f0000000b80)=""/194, 0xc2}, {&(0x7f0000000c80)=""/159, 0x9f}, {&(0x7f0000000d40)=""/169, 0xa9}, {&(0x7f0000000e00)=""/4103, 0x1007}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/4096, 0x1000}], 0x9}, 0x3}, {{&(0x7f0000003e40)=@pptp, 0x80, &(0x7f00000041c0)=[{&(0x7f0000003f00)=""/208, 0xd0}, {&(0x7f0000004000)=""/75, 0x4b}, {&(0x7f0000004100)=""/160, 0xa0}], 0x3, &(0x7f0000004080)=""/115, 0x73}, 0x32f2683b}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000042c0)=""/149, 0x95}, 0x7ff}], 0x3, 0x40010022, 0x0) 421.809219ms ago: executing program 0 (id=3807): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000940)="63eced8e46dc92b18236457ee3c8", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 373.27348ms ago: executing program 0 (id=3808): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f00000010c0)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) listen(r0, 0x1) sendmsg(r0, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000000000001000000000000000100100000e"], 0x28}, 0x0) recvmmsg(r0, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}, 0x20200000}, {{0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000001540)=""/4096, 0x1000}], 0x1}}], 0x2, 0x2, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000002540)={&(0x7f0000002580)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x24, &(0x7f0000002600)=[{&(0x7f0000002640), 0x1000}], 0x1, &(0x7f0000002680)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0) 371.43214ms ago: executing program 1 (id=3809): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, 0x0, 0x0, 0x0) 351.658071ms ago: executing program 1 (id=3810): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x163042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000180)=0x2) ioctl$PPPIOCSPASS(r0, 0x40107447, &(0x7f00000001c0)={0x0, &(0x7f0000000200)}) ioctl$PPPIOCSDEBUG(r0, 0x40047440, &(0x7f0000000240)=0xa4cb) write$ppp(r0, &(0x7f0000000280)="0002", 0x2) 339.302111ms ago: executing program 3 (id=3811): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000005c0)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000600)={'syzkaller1\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000016c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000001700)={0x0, 0x0, &(0x7f0000001740)={&(0x7f0000001780)=@newtfilter={0x80, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0xb, 0x3}, {0xffff, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4c, 0x2, [@TCA_MATCHALL_ACT={0x48, 0x2, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x8, 0xfff, 0x10000000, 0x7, 0xccb}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x80}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) write$tun(r0, &(0x7f00000006c0)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x6, 0x4, 0x3, 0x1b, 0x7fb, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}, {[@generic={0x7, 0x3, "aa"}]}}, {0x4e24, 0x4e20, 0x7e3, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde45"}}}}, 0x809) 316.190002ms ago: executing program 0 (id=3812): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x8) 270.309733ms ago: executing program 0 (id=3813): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x29, 0x24, &(0x7f00000008c0), 0x4) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x1c, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}]}, 0x1c}}, 0x40040) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$nci(r0, &(0x7f0000000280)=@NCI_OP_NFCEE_DISCOVER_NTF={0x2, 0x1, 0x3, 0x0, 0x5, {0x1, 0x9, "189bcc"}}, 0x8) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000700), r4) write$nci(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="500404"], 0x7) write$nci(r0, &(0x7f0000000340)=@NCI_OP_RF_DISCOVER_MAP_RSP={0x1, 0x0, 0x2, 0x0, 0x1}, 0x4) sendmsg$NFC_CMD_START_POLL(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x24, r3, 0x1, 0x123, 0x234, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r1}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0xfffffff9}]}, 0x24}}, 0x0) 269.908383ms ago: executing program 1 (id=3814): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x14, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x50, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000004c0)={{r1}, &(0x7f00000003c0), &(0x7f0000000400)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc92b18236457ee3c8", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 269.792453ms ago: executing program 1 (id=3815): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000140)={&(0x7f0000000180)={0xa, 0x4e20, 0x7c, @mcast2, 0x9}, 0x1c, 0x0, 0x0, 0x0, 0x30}, 0x800) 250.119013ms ago: executing program 3 (id=3816): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="30000000000000002900000004000000840230", @ANYRES64=r0, @ANYRES8=r0], 0x30}, 0x800) 249.799293ms ago: executing program 1 (id=3817): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000680)={&(0x7f0000000740)=@hci, 0x80, &(0x7f00000007c0)=[{&(0x7f0000000800)=""/248, 0x200105d0}], 0x1, 0x0, 0x300}, 0x1f00) sendmsg$tipc(r1, &(0x7f0000000900)={0x0, 0xfffffff5, &(0x7f0000000940)=[{&(0x7f0000000980)="a2", 0xfffffdef}], 0x1}, 0x0) sendmsg$tipc(r1, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)=[{0x0}, {&(0x7f0000000a40)}], 0x2, 0x0, 0x0, 0xc0090}, 0x4000000) 249.421493ms ago: executing program 3 (id=3818): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], 0x0, 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000005c0)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000940)="63eced8e46dc92b18236457ee3c8", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 198.958665ms ago: executing program 3 (id=3819): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x8001}, {0xffff, 0xffff}, {0xb, 0x2}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x40, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0x8001}, {0x3, 0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x1, 0x8001}}]}}]}, 0x40}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r5, &(0x7f0000000380)='\x00', 0x1, 0x0, &(0x7f00000003c0)={0x11, 0x300, r4, 0x1, 0x0, 0x6, @local}, 0x14) 196.813665ms ago: executing program 2 (id=3820): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="05000000010000008e000000c9e7000001000000", @ANYRES32, @ANYBLOB="000000000000000000e9ffffff00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1e, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffd28, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xa, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x100, 0x0, 0x1, 0x5, 0x0, 0x1}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x1) r1 = syz_open_dev$usbmon(&(0x7f0000000100), 0x8008, 0x1c1300) mmap(&(0x7f00006c2000/0x1000)=nil, 0x1000, 0x5, 0x13, r1, 0x1e67e000) ioctl$MON_IOCT_RING_SIZE(r1, 0x9204, 0x49cdee) sendmsg$NFT_BATCH(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r2, 0x0, 0xa, &(0x7f0000000280), 0x4) r3 = epoll_create(0x80000000) epoll_pwait(r3, &(0x7f00000002c0)=[{}], 0x1, 0xa2e4, &(0x7f0000000300)={[0x101]}, 0x8) r4 = mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000400)={'bridge_slave_1\x00'}) syz_emit_ethernet(0x56, 0x0, 0x0) syz_io_uring_complete(0x0, r4) setns(0xc9, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x41, &(0x7f00000004c0)=ANY=[@ANYBLOB="726177000000000000000000000000000000000000000000000000000900000003000000"], 0x58) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000680)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4f8, 0x0, 0xd0, 0x1a0, 0x270, 0x428, 0x0, 0xd0, 0x1a0, 0x358, 0x428, 0x6, 0x0, {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}, {{@ipv6={@empty, @empty, [], [], '\x00', '\x00', {}, {}, 0x6, 0x0, 0x1}, 0x0, 0xa8, 0xe8}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff]}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x558) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$setstatus(r8, 0x4, 0x800) connect$inet6(r8, &(0x7f0000000c00)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 119.842877ms ago: executing program 3 (id=3821): mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000080)={'sit0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f4, &(0x7f00000000c0)={'syztnl0\x00', 0x0}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) bind$unix(r1, &(0x7f0000000100)=@file={0x1}, 0x6e) listen(r1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000200)=@hci, 0x56, &(0x7f0000000280)}, 0x1f00) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x8, 0x0, 0x0, 0x3, 0x0, 0x0, 0xb6df4c32c1d5c814}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000003c0)={'wlan1\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0xa0380, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000440)={'syzkaller0\x00', 0x7101}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000580)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@gettclass={0x24, 0x2a, 0x129, 0x70bd26, 0xfffffff8, {0x0, 0x0, 0x0, r5, {0xffe0, 0xd}, {}, {0x8, 0x14}}}, 0x24}}, 0x40004) recvmmsg(r6, &(0x7f0000000880)=[{{0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000a00)=""/162, 0xa2}, {&(0x7f0000000ac0)=""/70, 0x46}, {&(0x7f0000000b40)=""/62, 0x3e}, {&(0x7f0000000b80)=""/194, 0xc2}, {&(0x7f0000000c80)=""/159, 0x9f}, {&(0x7f0000000d40)=""/169, 0xa9}, {&(0x7f0000000e00)=""/4103, 0x1007}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/4096, 0x1000}], 0x9}, 0x3}, {{&(0x7f0000003e40)=@pptp, 0x80, &(0x7f00000041c0)=[{&(0x7f0000003f00)=""/208, 0xd0}, {&(0x7f0000004000)=""/75, 0x4b}, {&(0x7f0000004100)=""/160, 0xa0}], 0x3, &(0x7f0000004080)=""/115, 0x73}, 0x32f2683b}, {{0x0, 0x0, 0x0, 0x0, &(0x7f00000042c0)=""/149, 0x95}, 0x7ff}], 0x3, 0x40010022, 0x0) 14.17284ms ago: executing program 2 (id=3822): socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$can_raw(0x1d, 0x3, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) socket$inet_icmp(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x2, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008002000800000000800", @ANYRES32=r0, @ANYRES8], 0x5c}, 0x1, 0x0, 0x0, 0x4040800}, 0x40090) 0s ago: executing program 5 (id=3823): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f00000010c0)=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @empty}}, 0x24) listen(r0, 0x1) sendmsg(r0, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=ANY=[@ANYBLOB="1800000000000000100100000100000002000000000000001000000000000000100100000e"], 0x28}, 0x0) recvmmsg(r0, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}, 0x20200000}, {{0x0, 0x0, &(0x7f0000001200)=[{&(0x7f0000001540)=""/4096, 0x1000}], 0x1}}], 0x2, 0x2, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) sendmsg(r1, &(0x7f0000002540)={&(0x7f0000002580)=@rxrpc=@in4={0x21, 0x1234, 0x2, 0x10, {0x2, 0x5678, @loopback}}, 0x24, &(0x7f0000002600)=[{&(0x7f0000002640), 0x1000}], 0x1, &(0x7f0000002680)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0) kernel console output (not intermixed with test programs): ller0> [ 119.477593][ T7968] tipc: Disabling bearer [ 119.551874][ T7977] syzkaller1: entered promiscuous mode [ 119.551896][ T7977] syzkaller1: entered allmulticast mode [ 119.613232][ T7983] pim6reg: entered allmulticast mode [ 119.617344][ T7983] pim6reg: left allmulticast mode [ 122.693090][ T8010] __nla_validate_parse: 12 callbacks suppressed [ 122.693110][ T8010] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1791'. [ 122.730027][ T8015] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1795'. [ 122.784361][ T8020] ip_tables: iptables: counters copy to user failed while replacing table [ 122.920290][ T8037] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1804'. [ 125.849547][ T8048] syzkaller0: entered promiscuous mode [ 125.849574][ T8048] syzkaller0: entered allmulticast mode [ 125.903367][ T8055] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1809'. [ 125.912152][ T8057] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1810'. [ 125.951411][ T29] audit: type=1400 audit(1792704897.406:369): avc: denied { listen } for pid=8062 comm="syz.2.1812" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 126.110843][ T8082] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1820'. [ 126.154097][ T8073] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1817'. [ 126.236806][ T8105] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 126.265177][ T8111] tipc: Started in network mode [ 126.265260][ T8111] tipc: Node identity , cluster identity 4711 [ 126.265275][ T8111] tipc: Failed to obtain node identity [ 126.265283][ T8111] tipc: Enabling of bearer rejected, failed to enable media [ 126.558939][ T8135] ip6gre1: entered allmulticast mode [ 126.562283][ T8135] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1018 sclass=netlink_route_socket pid=8135 comm=syz.1.1842 [ 126.595525][ T8137] tipc: Started in network mode [ 126.595554][ T8137] tipc: Node identity , cluster identity 4711 [ 126.595569][ T8137] tipc: Failed to obtain node identity [ 126.595577][ T8137] tipc: Enabling of bearer rejected, failed to enable media [ 126.727560][ T29] audit: type=1400 audit(1792704898.186:370): avc: denied { create } for pid=8154 comm="syz.3.1852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 126.727864][ T29] audit: type=1400 audit(1792704898.186:371): avc: denied { bind } for pid=8154 comm="syz.3.1852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 126.747106][ T29] audit: type=1400 audit(1792704898.186:372): avc: denied { connect } for pid=8154 comm="syz.3.1852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 126.748974][ T29] audit: type=1400 audit(1792704898.186:373): avc: denied { setopt } for pid=8154 comm="syz.3.1852" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 126.911075][ T8176] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1857'. [ 127.567805][ T51] IPVS: starting estimator thread 0... [ 127.663701][ T8200] IPVS: using max 2400 ests per chain, 120000 per kthread [ 127.922427][ T29] audit: type=1400 audit(1792704899.376:374): avc: denied { create } for pid=8211 comm="syz.0.1872" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 127.923288][ T29] audit: type=1400 audit(1792704899.386:375): avc: denied { module_request } for pid=8211 comm="syz.0.1872" kmod="net-pf-11" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 128.506975][ T29] audit: type=1400 audit(1792704899.966:376): avc: denied { bpf } for pid=8215 comm="syz.1.1873" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 128.507295][ T29] audit: type=1400 audit(1792704899.966:377): avc: denied { perfmon } for pid=8215 comm="syz.1.1873" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 129.822222][ T8164] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 129.960894][ T8250] ieee802154 phy0 wpan0: encryption failed: -22 [ 130.001483][ T8259] lo speed is unknown, defaulting to 1000 [ 130.001837][ T8259] lo speed is unknown, defaulting to 1000 [ 130.002196][ T8259] lo speed is unknown, defaulting to 1000 [ 130.036661][ T8259] infiniband syz0: set down [ 130.036683][ T8259] infiniband syz0: added lo [ 130.037025][ T3385] lo speed is unknown, defaulting to 1000 [ 130.055650][ T8259] RDS/IB: syz0: added [ 130.055719][ T8259] smc: adding ib device syz0 with port count 1 [ 130.055733][ T8259] smc: ib device syz0 port 1 has no pnetid [ 130.055938][ T8259] lo speed is unknown, defaulting to 1000 [ 130.056581][ T23] lo speed is unknown, defaulting to 1000 [ 130.089597][ T29] audit: type=1400 audit(1792704901.536:378): avc: denied { bind } for pid=8257 comm="syz.2.1892" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 130.096223][ T8259] lo speed is unknown, defaulting to 1000 [ 130.130409][ T8259] lo speed is unknown, defaulting to 1000 [ 130.158209][ T8259] lo speed is unknown, defaulting to 1000 [ 130.186862][ T8259] lo speed is unknown, defaulting to 1000 [ 133.003689][ T8260] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 133.110858][ T8319] ip_tables: iptables: counters copy to user failed while replacing table [ 133.114682][ T8321] tipc: Started in network mode [ 133.114694][ T8321] tipc: Node identity , cluster identity 4711 [ 133.114707][ T8321] tipc: Failed to obtain node identity [ 133.114727][ T8321] tipc: Enabling of bearer rejected, failed to enable media [ 133.290385][ T8348] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1921'. [ 133.428890][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 133.428920][ T29] audit: type=1400 audit(1792704904.886:381): avc: denied { connect } for pid=8356 comm="syz.2.1924" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 134.032305][ T8375] syzkaller0: entered promiscuous mode [ 134.032329][ T8375] syzkaller0: entered allmulticast mode [ 136.231471][ T8354] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 136.231502][ T8354] nci: nci_start_poll: failed to set local general bytes [ 136.232342][ T8338] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 136.289500][ T8384] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1931'. [ 136.304720][ T8384] syzkaller1: entered promiscuous mode [ 136.304775][ T8384] syzkaller1: entered allmulticast mode [ 136.437791][ T8403] syzkaller0: left promiscuous mode [ 136.437869][ T8403] syzkaller0: left allmulticast mode [ 136.489804][ T8397] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1937'. [ 136.578325][ T8417] tipc: Enabled bearer , priority 0 [ 136.612004][ T8409] tipc: Resetting bearer [ 136.714029][ T8407] tipc: Resetting bearer [ 136.752059][ T8437] batman_adv: batadv0: Adding interface: syzkaller0 [ 136.752075][ T8437] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 136.756752][ T8437] batman_adv: batadv0: Interface activated: syzkaller0 [ 136.779589][ T8436] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 136.806616][ T8436] batman_adv: batadv0: Removing interface: syzkaller0 [ 136.812524][ T8441] syzkaller0: left promiscuous mode [ 136.812547][ T8441] syzkaller0: left allmulticast mode [ 136.812990][ T8441] tipc: Resetting bearer [ 136.866688][ T8448] netlink: 'syz.5.1954': attribute type 25 has an invalid length. [ 136.928281][ T29] audit: type=1400 audit(1792704908.386:382): avc: denied { create } for pid=8451 comm="syz.2.1956" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 137.045465][ T8479] batman_adv: batadv0: Adding interface: syzkaller0 [ 137.045483][ T8479] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 137.045585][ T8479] batman_adv: batadv0: Interface activated: syzkaller0 [ 137.086795][ T8478] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 137.108245][ T8478] batman_adv: batadv0: Removing interface: syzkaller0 [ 137.113318][ T8487] tipc: Resetting bearer [ 137.184518][ T8496] netlink: 'syz.0.1970': attribute type 25 has an invalid length. [ 137.208777][ T8474] tipc: Resetting bearer [ 137.345069][ T51] tipc: Resetting bearer [ 137.346770][ T51] tipc: Resetting bearer [ 137.622892][ T28] tipc: Node number set to 972363274 [ 137.637910][ T8550] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1989'. [ 137.694018][ T32] IPVS: starting estimator thread 0... [ 137.783961][ T8559] IPVS: using max 2400 ests per chain, 120000 per kthread [ 138.990777][ T8622] No such timeout policy "syz1" [ 141.182590][ T8593] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 141.289982][ T8685] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2035'. [ 141.515857][ T51] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 141.585498][ T8717] tipc: Resetting bearer [ 142.314664][ T8708] tipc: Resetting bearer [ 142.450483][ T8771] batman_adv: batadv0: Adding interface: syzkaller0 [ 142.450499][ T8771] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 142.450538][ T8771] batman_adv: batadv0: Interface activated: syzkaller0 [ 142.514747][ T51] tipc: Resetting bearer [ 143.205074][ T8762] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 143.207317][ T8762] batman_adv: batadv0: Removing interface: syzkaller0 [ 144.460528][ T8704] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 145.501659][ T8831] ieee802154 phy0 wpan0: encryption failed: -22 [ 145.539065][ T8835] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 147.656344][ T8807] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 147.711984][ T8851] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2092'. [ 147.728423][ T8851] syzkaller1: entered promiscuous mode [ 147.728447][ T8851] syzkaller1: entered allmulticast mode [ 147.748260][ T8859] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2095'. [ 147.824838][ T29] audit: type=1400 audit(1792704919.286:383): avc: denied { listen } for pid=8869 comm="syz.1.2100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 147.824901][ T29] audit: type=1400 audit(1792704919.286:384): avc: denied { read } for pid=8869 comm="syz.1.2100" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 147.884756][ T32] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 148.586576][ T8899] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2108'. [ 150.830218][ T8873] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 150.988913][ T8931] batman_adv: batadv0: Adding interface: syzkaller0 [ 150.988934][ T8931] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 150.988967][ T8931] batman_adv: batadv0: Interface activated: syzkaller0 [ 151.150010][ T8930] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 151.152377][ T8930] batman_adv: batadv0: Removing interface: syzkaller0 [ 151.154717][ T8944] ip_tables: iptables: counters copy to user failed while replacing table [ 151.200090][ T32] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 151.271420][ T8951] syzkaller0: entered promiscuous mode [ 151.271437][ T8951] syzkaller0: entered allmulticast mode [ 151.276022][ T8951] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 151.280890][ T8951] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 154.140080][ T8939] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 154.194264][ T8974] netlink: 'syz.1.2141': attribute type 25 has an invalid length. [ 154.257488][ T8985] tipc: Started in network mode [ 154.257523][ T8985] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 154.257677][ T8985] tipc: Enabled bearer , priority 0 [ 154.263472][ T8978] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2142'. [ 154.396733][ T9009] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2152'. [ 155.373537][ T9] tipc: Node number set to 43690 [ 157.318439][ T8996] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 157.358935][ T9040] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2164'. [ 157.397757][ T9048] syzkaller0: entered promiscuous mode [ 157.397781][ T9048] syzkaller0: entered allmulticast mode [ 157.399232][ T9048] sch_tbf: burst 255 is lower than device syzkaller0 mtu (299) ! [ 157.436220][ T9048] sch_tbf: burst 8 is lower than device syzkaller0 mtu (299) ! [ 157.444403][ T9054] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2171'. [ 157.538492][ T9062] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2175'. [ 157.551845][ T9068] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2178'. [ 157.610278][ T9073] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=9073 comm=syz.0.2179 [ 157.612493][ T29] audit: type=1400 audit(1792704929.066:385): avc: denied { read } for pid=9074 comm="syz.2.2182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 157.652535][ T29] audit: type=1400 audit(1792704929.106:386): avc: denied { allowed } for pid=9074 comm="syz.2.2182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 157.675284][ T9088] syzkaller0: entered promiscuous mode [ 157.675308][ T9088] syzkaller0: entered allmulticast mode [ 157.677340][ T9088] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 157.678888][ T9088] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 157.936742][ T29] audit: type=1400 audit(1792704929.396:387): avc: denied { read write } for pid=9085 comm="syz.5.2184" name="uhid" dev="devtmpfs" ino=251 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 157.936784][ T29] audit: type=1400 audit(1792704929.396:388): avc: denied { open } for pid=9085 comm="syz.5.2184" path="/dev/uhid" dev="devtmpfs" ino=251 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 158.004218][ T29] audit: type=1326 audit(1792704929.466:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9085 comm="syz.5.2184" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f219747f559 code=0x7ffc0000 [ 158.004257][ T29] audit: type=1326 audit(1792704929.466:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9085 comm="syz.5.2184" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f219747f559 code=0x7ffc0000 [ 158.004288][ T29] audit: type=1326 audit(1792704929.466:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9085 comm="syz.5.2184" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f219747f559 code=0x7ffc0000 [ 158.004392][ T29] audit: type=1326 audit(1792704929.466:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9085 comm="syz.5.2184" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f219747f559 code=0x7ffc0000 [ 158.004464][ T29] audit: type=1326 audit(1792704929.466:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9085 comm="syz.5.2184" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7f219747f559 code=0x7ffc0000 [ 158.011081][ T29] audit: type=1326 audit(1792704929.466:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9100 comm="syz.5.2184" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7f219743fd8e code=0x7ffc0000 [ 158.077437][ T9099] loop0: detected capacity change from 0 to 512 [ 158.129133][ T9099] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 158.192392][ T9099] EXT4-fs (loop0): orphan cleanup on readonly fs [ 158.200995][ T9099] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm syz.0.2187: bg 0: block 248: padding at end of block bitmap is not set [ 158.201179][ T9099] loop0: lost filesystem error report for type 5 error -117 [ 158.201585][ T9099] EXT4-fs error (device loop0): ext4_acquire_dquot:7079: comm syz.0.2187: Failed to acquire dquot type 1 [ 158.201627][ T9099] loop0: lost filesystem error report for type 5 error -117 [ 158.202756][ C0] EXT4-fs (loop0): error count since last fsck: 2 [ 158.202790][ C0] EXT4-fs (loop0): last error at time 1792704929: ext4_acquire_dquot:7079 [ 158.211595][ T9099] EXT4-fs (loop0): 1 truncate cleaned up [ 158.218023][ T9099] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 158.465614][ T23] logitech-hidpp-device 0005:046D:B012.0001: hidraw0: BLUETOOTH HID v0.00 Device [syz0] on syz1 [ 158.490892][ T9104] EXT4-fs error (device loop0): ext4_lookup:1791: inode #2: comm syz.0.2187: deleted inode referenced: 12 [ 158.491410][ T9104] EXT4-fs error (device loop0): ext4_lookup:1791: inode #2: comm syz.0.2187: deleted inode referenced: 12 [ 158.491784][ T9105] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2188'. [ 158.549685][ T9102] fido_id[9102]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 160.604566][ T9077] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 160.645311][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.659126][ T9113] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2191'. [ 160.757096][ T9116] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2193'. [ 160.866853][ T9141] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2202'. [ 160.959711][ T9150] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2206'. [ 160.980780][ T9152] ip_tables: iptables: counters copy to user failed while replacing table [ 161.004714][ T9152] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2207'. [ 161.028398][ T9152] hsr_slave_0 (unregistering): left promiscuous mode [ 161.110572][ T9163] loop2: detected capacity change from 0 to 8192 [ 161.120518][ T9163] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 163.928820][ T9143] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 164.031091][ T9198] ip_tables: iptables: counters copy to user failed while replacing table [ 164.071064][ T29] kauditd_printk_skb: 228 callbacks suppressed [ 164.071083][ T29] audit: type=1400 audit(1792704935.526:621): avc: denied { create } for pid=9205 comm="syz.0.2228" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 164.101743][ T9204] tipc: Started in network mode [ 164.101759][ T9204] tipc: Node identity , cluster identity 4711 [ 164.101774][ T9204] tipc: Failed to obtain node identity [ 164.101851][ T9204] tipc: Enabling of bearer rejected, failed to enable media [ 164.110237][ T9204] sch_tbf: burst 255 is lower than device syzkaller0 mtu (299) ! [ 164.162276][ T9204] sch_tbf: burst 8 is lower than device syzkaller0 mtu (299) ! [ 164.212216][ T9223] syzkaller0: entered promiscuous mode [ 164.212239][ T9223] syzkaller0: entered allmulticast mode [ 164.225993][ T9223] tipc: Started in network mode [ 164.226026][ T9223] tipc: Node identity , cluster identity 4711 [ 164.226042][ T9223] tipc: Failed to obtain node identity [ 164.226050][ T9223] tipc: Enabling of bearer rejected, failed to enable media [ 164.339459][ T9242] tipc: Enabling of bearer rejected, already enabled [ 164.340760][ T9242] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1500) ! [ 164.430623][ T9253] tipc: Enabled bearer , priority 0 [ 164.533931][ T9261] loop2: detected capacity change from 0 to 512 [ 164.540512][ T9261] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 164.568793][ T9261] EXT4-fs (loop2): orphan cleanup on readonly fs [ 164.578895][ T9261] EXT4-fs error (device loop2): ext4_validate_block_bitmap:445: comm syz.2.2254: bg 0: block 248: padding at end of block bitmap is not set [ 164.578977][ T9261] loop2: lost filesystem error report for type 5 error -117 [ 164.579481][ T9261] Quota error (device loop2): write_blk: dquota write failed [ 164.579518][ T9261] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 164.579632][ T9261] EXT4-fs error (device loop2): ext4_acquire_dquot:7079: comm syz.2.2254: Failed to acquire dquot type 1 [ 164.579697][ T9261] loop2: lost filesystem error report for type 5 error -117 [ 164.581315][ T9261] EXT4-fs (loop2): 1 truncate cleaned up [ 164.588230][ T9261] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 164.664000][ T9275] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2259'. [ 164.682579][ T9281] tipc: Enabling of bearer rejected, already enabled [ 164.688269][ T9281] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1500) ! [ 164.740565][ T9289] loop0: detected capacity change from 0 to 512 [ 164.761000][ T9289] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 164.761239][ T9289] ext4 filesystem being mounted at /440/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 164.795173][ T9296] tipc: Enabling of bearer rejected, already enabled [ 164.824428][ T9297] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2263'. [ 165.015304][ T9261] EXT4-fs error (device loop2): ext4_lookup:1791: inode #2: comm syz.2.2254: deleted inode referenced: 12 [ 165.064397][ T9261] EXT4-fs error (device loop2): ext4_lookup:1791: inode #2: comm syz.2.2254: deleted inode referenced: 12 [ 165.071147][ T29] audit: type=1400 audit(1792704936.516:622): avc: denied { tracepoint } for pid=9305 comm="syz.3.2269" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 165.134281][ T29] audit: type=1400 audit(1792704936.566:623): avc: denied { write } for pid=9287 comm="syz.0.2264" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.138723][ T29] audit: type=1400 audit(1792704936.596:624): avc: denied { write } for pid=9287 comm="syz.0.2264" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.139249][ T29] audit: type=1400 audit(1792704936.596:625): avc: denied { mounton } for pid=9287 comm="syz.0.2264" path="/440/bus/proc" dev="loop0" ino=19 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 165.141114][ T9289] FAULT_INJECTION: forcing a failure. [ 165.141114][ T9289] name failslab, interval 1, probability 0, space 0, times 1 [ 165.141159][ T9289] CPU: 0 UID: 0 PID: 9289 Comm: syz.0.2264 Not tainted syzkaller #0 PREEMPT(lazy) [ 165.141240][ T9289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 165.141253][ T9289] Call Trace: [ 165.141261][ T9289] [ 165.141270][ T9289] __dump_stack+0x1d/0x30 [ 165.141297][ T9289] dump_stack_lvl+0x95/0xd0 [ 165.141321][ T9289] dump_stack+0x15/0x1b [ 165.141387][ T9289] should_fail_ex+0x262/0x280 [ 165.141446][ T9289] ? do_getname+0x2e/0x1c0 [ 165.141554][ T9289] should_failslab+0x8c/0xb0 [ 165.141576][ T9289] kmem_cache_alloc_noprof+0x5e/0x3d0 [ 165.141610][ T9289] ? do_getname+0x2e/0x1c0 [ 165.141687][ T9289] ? should_fail_ex+0xdb/0x280 [ 165.141849][ T9289] do_getname+0x2e/0x1c0 [ 165.141881][ T9289] user_path_at+0x28/0x100 [ 165.141913][ T9289] __se_sys_mount+0x25b/0x2e0 [ 165.141988][ T9289] __x64_sys_mount+0x67/0x80 [ 165.142022][ T9289] x64_sys_call+0xc3b/0x2550 [ 165.142049][ T9289] do_syscall_64+0x112/0x360 [ 165.142084][ T9289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 165.142108][ T9289] RIP: 0033:0x7f2d132ff559 [ 165.142166][ T9289] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 165.142185][ T9289] RSP: 002b:00007f2d11d57028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 165.142209][ T9289] RAX: ffffffffffffffda RBX: 00007f2d13585fa0 RCX: 00007f2d132ff559 [ 165.142239][ T9289] RDX: 0000200000001580 RSI: 0000200000001540 RDI: 0000000000000000 [ 165.142253][ T9289] RBP: 00007f2d13396b20 R08: 0000000000000000 R09: 0000000000000000 [ 165.142268][ T9289] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 165.142282][ T9289] R13: 00007f2d13586038 R14: 00007f2d13585fa0 R15: 00007ffd8c57c708 [ 165.142302][ T9289] [ 165.221946][ T3305] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #16: comm syz-executor: corrupted inode contents [ 165.222002][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.222262][ T3305] EXT4-fs error (device loop0): ext4_dirty_inode:6733: inode #16: comm syz-executor: mark_inode_dirty error [ 165.222323][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.222497][ T3305] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #16: comm syz-executor: corrupted inode contents [ 165.222523][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.222632][ T3305] EXT4-fs error (device loop0): __ext4_ext_dirty:207: inode #16: comm syz-executor: mark_inode_dirty error [ 165.222697][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.222858][ T3305] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #16: comm syz-executor: corrupted inode contents [ 165.222884][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.223024][ T29] audit: type=1400 audit(1792704936.676:626): avc: denied { write } for pid=3305 comm="syz-executor" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.223052][ T29] audit: type=1400 audit(1792704936.676:627): avc: denied { write } for pid=3305 comm="syz-executor" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 165.223076][ T29] audit: type=1400 audit(1792704936.676:628): avc: denied { unlink } for pid=3305 comm="syz-executor" name="file0" dev="loop0" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 165.223172][ T3305] EXT4-fs error (device loop0): __ext4_ext_dirty:207: inode #16: comm syz-executor: mark_inode_dirty error [ 165.223196][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.223350][ T3305] EXT4-fs error (device loop0): ext4_do_update_inode:5801: inode #16: comm syz-executor: corrupted inode contents [ 165.223376][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.223529][ T3305] EXT4-fs error (device loop0): ext4_truncate:4721: inode #16: comm syz-executor: mark_inode_dirty error [ 165.223553][ T3305] loop0: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117 [ 165.223874][ T3305] EXT4-fs error (device loop0): ext4_evict_inode:280: comm syz-executor: couldn't truncate inode 16 (err -117) [ 165.245290][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.389930][ T9313] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2271'. [ 165.411516][ T9322] tipc: Enabling of bearer rejected, already enabled [ 165.414066][ T9322] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1500) ! [ 165.415886][ T9322] tipc: Resetting bearer [ 165.516584][ T9327] tipc: Started in network mode [ 165.516598][ T9327] tipc: Node identity , cluster identity 4711 [ 165.516612][ T9327] tipc: Failed to obtain node identity [ 165.516619][ T9327] tipc: Enabling of bearer rejected, failed to enable media [ 165.659633][ T9338] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2279'. [ 165.813031][ T9340] loop0: detected capacity change from 0 to 512 [ 165.968447][ T9340] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 165.990383][ T9347] tipc: Enabling of bearer rejected, already enabled [ 165.990946][ T9347] sch_tbf: burst 255 is lower than device syzkaller0 mtu (299) ! [ 165.990988][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 165.992448][ T9347] sch_tbf: burst 8 is lower than device syzkaller0 mtu (299) ! [ 166.236483][ T9351] ip_tables: iptables: counters copy to user failed while replacing table [ 166.347103][ T9353] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2286'. [ 167.250446][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.608460][ T9364] ip_tables: iptables: counters copy to user failed while replacing table [ 167.789139][ T9367] tipc: Enabling of bearer rejected, failed to enable media [ 168.036364][ T9391] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2295'. [ 168.067574][ T9393] tipc: Started in network mode [ 168.067589][ T9393] tipc: Node identity , cluster identity 4711 [ 168.067603][ T9393] tipc: Failed to obtain node identity [ 168.067611][ T9393] tipc: Enabling of bearer rejected, failed to enable media [ 168.068185][ T9393] sch_tbf: burst 255 is lower than device syzkaller0 mtu (299) ! [ 168.068786][ T9393] sch_tbf: burst 8 is lower than device syzkaller0 mtu (299) ! [ 168.277723][ T9402] ip_tables: iptables: counters copy to user failed while replacing table [ 168.334420][ T9404] netlink: 208 bytes leftover after parsing attributes in process `syz.5.2301'. [ 168.882544][ T9425] tipc: Enabling of bearer rejected, already enabled [ 168.882828][ T9424] sch_tbf: burst 255 is lower than device syzkaller0 mtu (299) ! [ 168.935201][ T9432] netlink: 'syz.3.2311': attribute type 25 has an invalid length. [ 169.012171][ T9439] ip_tables: iptables: counters copy to user failed while replacing table [ 169.229625][ T29] kauditd_printk_skb: 11 callbacks suppressed [ 169.229645][ T29] audit: type=1400 audit(1792704940.686:640): avc: denied { mount } for pid=9411 comm="syz.5.2305" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 169.231570][ T9460] tipc: Enabling of bearer rejected, already enabled [ 169.232626][ T9460] tbf_change: 1 callbacks suppressed [ 169.232641][ T9460] sch_tbf: burst 255 is lower than device syzkaller0 mtu (299) ! [ 169.296515][ T29] audit: type=1400 audit(1792704940.756:641): avc: denied { search } for pid=9411 comm="syz.5.2305" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 169.297642][ T9460] sch_tbf: burst 8 is lower than device syzkaller0 mtu (299) ! [ 169.318913][ T29] audit: type=1400 audit(1792704940.756:642): avc: denied { read } for pid=9411 comm="syz.5.2305" name="trace_pipe" dev="tracefs" ino=47 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 169.318944][ T29] audit: type=1400 audit(1792704940.766:643): avc: denied { open } for pid=9411 comm="syz.5.2305" path="/404/mnt/trace_pipe" dev="tracefs" ino=47 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 169.374498][ T9469] ip_tables: iptables: counters copy to user failed while replacing table [ 169.398700][ T29] audit: type=1400 audit(1792704940.856:644): avc: denied { unmount } for pid=3684 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 169.480202][ T9479] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2333'. [ 169.544423][ T9489] netlink: 'syz.2.2336': attribute type 25 has an invalid length. [ 169.753209][ T9515] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2345'. [ 172.568885][ T9511] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 172.568909][ T9511] nci: nci_start_poll: failed to set local general bytes [ 172.586884][ T9492] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 172.684227][ T29] audit: type=1400 audit(1792704944.146:645): avc: denied { read write } for pid=9548 comm="syz.0.2357" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 172.684345][ T29] audit: type=1400 audit(1792704944.146:646): avc: denied { open } for pid=9548 comm="syz.0.2357" path="/dev/sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 172.715558][ T29] audit: type=1400 audit(1792704944.176:647): avc: denied { mount } for pid=9548 comm="syz.0.2357" name="/" dev="configfs" ino=1065 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 172.726572][ T29] audit: type=1400 audit(1792704944.186:648): avc: denied { search } for pid=9548 comm="syz.0.2357" name="/" dev="configfs" ino=1065 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 172.726638][ T29] audit: type=1400 audit(1792704944.186:649): avc: denied { search } for pid=9548 comm="syz.0.2357" name="usb_gadget" dev="configfs" ino=2108 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 172.727255][ T9549] capability: warning: `syz.0.2357' uses deprecated v2 capabilities in a way that may be insecure [ 172.759896][ T9549] sg_write: process 981 (syz.0.2357) changed security contexts after opening file descriptor, this is not allowed. [ 175.810346][ T9562] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 175.823830][ T9573] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2362'. [ 178.995648][ T9609] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 179.059198][ T9633] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2388'. [ 182.172638][ T9651] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 182.177223][ T9665] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2403'. [ 182.286514][ T29] kauditd_printk_skb: 26 callbacks suppressed [ 182.286532][ T29] audit: type=1400 audit(1792704953.746:676): avc: denied { read } for pid=9676 comm="syz.3.2405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 182.316343][ T9693] ip_tables: iptables: counters copy to user failed while replacing table [ 182.330047][ T9699] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2413'. [ 182.358539][ T9692] tipc: Resetting bearer [ 182.376630][ T9676] tipc: Resetting bearer [ 182.423108][ T9711] netlink: 'syz.1.2420': attribute type 25 has an invalid length. [ 182.546142][ T9728] ip_tables: iptables: counters copy to user failed while replacing table [ 183.395317][ T405] tipc: Resetting bearer [ 185.429077][ T9713] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 185.499510][ T9766] ip_tables: iptables: counters copy to user failed while replacing table [ 185.564273][ T29] audit: type=1400 audit(1792704957.026:677): avc: denied { write } for pid=9778 comm="syz.0.2445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 188.581429][ T9783] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 188.592519][ T9795] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2450'. [ 188.671637][ T9817] ip_tables: iptables: counters copy to user failed while replacing table [ 191.727549][ T9829] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 191.731002][ T9854] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2468'. [ 191.801709][ T9867] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2473'. [ 191.802052][ T9866] ip_tables: iptables: counters copy to user failed while replacing table [ 191.858565][ T9878] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2476'. [ 191.901278][ T405] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x6d [ 191.908555][ T9882] netlink: 'syz.2.2479': attribute type 25 has an invalid length. [ 192.040543][ T9910] netlink: 68 bytes leftover after parsing attributes in process `syz.1.2488'. [ 192.086283][ T9913] ip_tables: iptables: counters copy to user failed while replacing table [ 192.240056][ T9925] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2493'. [ 194.949687][ T9894] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 194.949946][ T9902] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2485'. [ 195.044818][ T9943] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2500'. [ 195.087088][ T9947] ip_tables: iptables: counters copy to user failed while replacing table [ 195.255151][ T9968] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2510'. [ 195.438307][ T9975] netlink: 'syz.5.2511': attribute type 25 has an invalid length. [ 195.585072][ T9998] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2521'. [ 195.606527][ T9989] ip_tables: iptables: counters copy to user failed while replacing table [ 195.939003][T10015] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2525'. [ 195.998678][T10016] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2524'. [ 196.089567][T10032] ip_tables: iptables: counters copy to user failed while replacing table [ 196.137924][T10042] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2537'. [ 196.341908][T10067] ip_tables: iptables: counters copy to user failed while replacing table [ 196.534799][T10091] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2557'. [ 196.787461][T10113] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2568'. [ 197.000236][T10121] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2570'. [ 197.118987][ T3301] tipc: Resetting bearer [ 197.131176][ T3301] tipc: Disabling bearer [ 197.399831][T10131] rxe_eth0 speed is unknown, defaulting to 1000 [ 197.440850][T10131] lo speed is unknown, defaulting to 1000 [ 197.624922][T10161] tipc: Resetting bearer [ 197.631806][T10159] tipc: Resetting bearer [ 197.670858][T10131] bridge0: port 1(bridge_slave_0) entered blocking state [ 197.670897][T10131] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.671048][T10131] bridge_slave_0: entered allmulticast mode [ 197.671497][T10131] bridge_slave_0: entered promiscuous mode [ 197.700808][T10131] bridge0: port 2(bridge_slave_1) entered blocking state [ 197.700844][T10131] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.700954][T10131] bridge_slave_1: entered allmulticast mode [ 197.701639][T10131] bridge_slave_1: entered promiscuous mode [ 197.741765][T10131] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 197.752811][T10131] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 197.776290][T10131] team0: Port device team_slave_0 added [ 197.777353][T10131] team0: Port device team_slave_1 added [ 197.800583][T10131] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 197.800599][T10131] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 197.800645][T10131] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 197.801369][T10131] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 197.801383][T10131] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 197.801453][T10131] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 197.904232][T10131] hsr_slave_0: entered promiscuous mode [ 197.904777][T10131] hsr_slave_1: entered promiscuous mode [ 197.905048][T10131] debugfs: 'hsr0' already exists in 'hsr' [ 197.905064][T10131] Cannot create hsr debugfs directory [ 198.657046][T10131] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 198.985800][ T353] tipc: Resetting bearer [ 199.098538][T10183] loop3: detected capacity change from 0 to 1024 [ 199.193792][T10183] EXT4-fs: Ignoring removed oldalloc option [ 199.196289][T10183] EXT4-fs: Ignoring removed orlov option [ 199.198808][T10131] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.239264][T10131] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.332197][T10131] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 199.349584][T10201] tipc: Resetting bearer [ 199.369390][T10196] tipc: Resetting bearer [ 199.406707][T10219] ip_tables: iptables: counters copy to user failed while replacing table [ 199.647814][T10183] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 199.734339][ T29] audit: type=1400 audit(1792704971.156:678): avc: denied { setattr } for pid=10179 comm="syz.3.2588" name="file0" dev="loop3" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 199.777356][T10131] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 199.804272][T10131] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 199.812381][ T353] bridge_slave_1: left allmulticast mode [ 199.812419][ T353] bridge_slave_1: left promiscuous mode [ 199.812530][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 199.845198][ T353] bridge_slave_0: left allmulticast mode [ 199.845223][ T353] bridge_slave_0: left promiscuous mode [ 199.845387][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 199.876848][ T3304] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 199.959479][T10241] __nla_validate_parse: 7 callbacks suppressed [ 199.959553][T10241] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2609'. [ 199.981280][ T353] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 199.983270][ T353] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 200.001862][ T353] bond0 (unregistering): Released all slaves [ 200.009374][T10131] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 200.011445][T10131] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 200.015659][T10131] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 200.025856][T10131] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 200.037286][ T405] tipc: Resetting bearer [ 200.045051][T10131] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 200.048511][T10131] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 200.057738][ T353] tipc: Disabling bearer [ 200.067983][ T353] tipc: Left network mode [ 200.126963][T10131] 8021q: adding VLAN 0 to HW filter on device bond0 [ 200.140575][T10131] 8021q: adding VLAN 0 to HW filter on device team0 [ 200.152062][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 200.152102][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 200.155267][T10261] ip_tables: iptables: counters copy to user failed while replacing table [ 200.178539][ T405] bridge0: port 2(bridge_slave_1) entered blocking state [ 200.178579][ T405] bridge0: port 2(bridge_slave_1) entered forwarding state [ 200.222074][ T353] hsr_slave_0: left promiscuous mode [ 200.230173][ T353] hsr_slave_1: left promiscuous mode [ 200.230596][ T353] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 200.230627][ T353] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 200.231347][ T353] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 200.231363][ T353] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 200.285628][ T353] veth1_macvtap: left promiscuous mode [ 200.285659][ T353] veth0_macvtap: left promiscuous mode [ 200.285743][ T353] veth1_vlan: left promiscuous mode [ 200.285781][ T353] veth0_vlan: left promiscuous mode [ 200.287931][T10264] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2615'. [ 200.384046][T10274] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2620'. [ 200.485769][ T353] team0 (unregistering): Port device team_slave_1 removed [ 200.488726][ T353] team0 (unregistering): Port device team_slave_0 removed [ 200.697069][T10302] ip_tables: iptables: counters copy to user failed while replacing table [ 200.877738][T10131] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 200.967052][T10131] veth0_vlan: entered promiscuous mode [ 200.969439][T10131] veth1_vlan: entered promiscuous mode [ 200.982748][T10131] veth0_macvtap: entered promiscuous mode [ 200.984510][T10131] veth1_macvtap: entered promiscuous mode [ 200.989496][T10131] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 200.993538][T10131] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 201.123672][ T353] IPVS: stop unused estimator thread 0... [ 201.152985][ T38] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.153269][ T38] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.158155][ T38] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.158200][ T38] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 201.212527][T10324] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2631'. [ 201.342002][T10345] ip_tables: iptables: counters copy to user failed while replacing table [ 201.452107][T10351] tipc: Resetting bearer [ 201.459283][T10348] tipc: Resetting bearer [ 201.539483][T10361] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2643'. [ 201.733639][T10376] ip_tables: iptables: counters copy to user failed while replacing table [ 201.833148][T10394] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2653'. [ 202.348239][ T32] tipc: Resetting bearer [ 202.379033][ T29] audit: type=1400 audit(1792704973.836:679): avc: denied { create } for pid=10413 comm="syz.2.2666" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 202.432695][T10420] ip_tables: iptables: counters copy to user failed while replacing table [ 202.664692][ T29] audit: type=1400 audit(1792704974.126:680): avc: denied { write } for pid=10442 comm="syz.5.2677" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 202.881728][ T29] audit: type=1400 audit(1792704974.336:681): avc: denied { map } for pid=10449 comm="syz.2.2680" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=29737 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 202.881765][ T29] audit: type=1400 audit(1792704974.336:682): avc: denied { read write } for pid=10449 comm="syz.2.2680" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=29737 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 202.927177][T10448] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2678'. [ 203.013817][T10460] ip_tables: iptables: counters copy to user failed while replacing table [ 203.069166][T10470] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2688'. [ 203.164166][T10472] loop3: detected capacity change from 0 to 8192 [ 203.169121][T10472] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 203.729893][T10505] syzkaller0: entered promiscuous mode [ 203.729911][T10505] syzkaller0: entered allmulticast mode [ 203.751784][T10505] tipc: Enabling of bearer rejected, failed to enable media [ 203.771047][T10511] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2702'. [ 203.812080][T10515] ip_tables: iptables: counters copy to user failed while replacing table [ 204.018167][T10539] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2715'. [ 204.056423][T10544] ip_tables: iptables: counters copy to user failed while replacing table [ 204.094324][ T29] audit: type=1400 audit(1792704975.556:683): avc: denied { create } for pid=10547 comm="syz.1.2719" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 206.690290][T10492] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 206.798794][T10569] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2728'. [ 206.844563][T10569] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2728'. [ 206.860475][T10573] ip_tables: iptables: counters copy to user failed while replacing table [ 206.886932][ T29] audit: type=1400 audit(1792704978.346:684): avc: denied { write } for pid=10576 comm="syz.1.2731" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 209.934249][T10582] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 209.977518][T10616] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2744'. [ 209.983822][T10616] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2744'. [ 209.989122][T10619] ip_tables: iptables: counters copy to user failed while replacing table [ 210.067833][ T29] audit: type=1400 audit(1792704981.526:685): avc: denied { write } for pid=10623 comm="syz.2.2745" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 210.071799][T10632] netlink: 108 bytes leftover after parsing attributes in process `syz.5.2750'. [ 210.124961][T10640] syzkaller0: entered promiscuous mode [ 210.124983][T10640] syzkaller0: entered allmulticast mode [ 210.125567][T10640] tipc: Resetting bearer [ 210.165946][T10642] netlink: 'syz.5.2755': attribute type 25 has an invalid length. [ 210.198262][T10655] ip_tables: iptables: counters copy to user failed while replacing table [ 210.230797][T10663] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2762'. [ 210.230943][T10663] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2762'. [ 210.278787][T10671] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2763'. [ 210.310500][ T29] audit: type=1400 audit(1792704981.766:686): avc: denied { write } for pid=10669 comm="syz.3.2764" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 210.369476][T10681] FAULT_INJECTION: forcing a failure. [ 210.369476][T10681] name failslab, interval 1, probability 0, space 0, times 0 [ 210.369516][T10681] CPU: 0 UID: 0 PID: 10681 Comm: syz.5.2770 Not tainted syzkaller #0 PREEMPT(lazy) [ 210.369542][T10681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 210.369556][T10681] Call Trace: [ 210.369564][T10681] [ 210.369573][T10681] __dump_stack+0x1d/0x30 [ 210.369603][T10681] dump_stack_lvl+0x95/0xd0 [ 210.369631][T10681] dump_stack+0x15/0x1b [ 210.369723][T10681] should_fail_ex+0x262/0x280 [ 210.369764][T10681] ? security_perf_event_alloc+0x48/0x120 [ 210.369862][T10681] should_failslab+0x8c/0xb0 [ 210.369887][T10681] __kmalloc_noprof+0xb6/0x4b0 [ 210.369990][T10681] ? security_perf_event_alloc+0x48/0x120 [ 210.370049][T10681] security_perf_event_alloc+0x48/0x120 [ 210.370083][T10681] perf_event_alloc+0x186a/0x19e0 [ 210.370112][T10681] __se_sys_perf_event_open+0x67d/0x1290 [ 210.370284][T10681] ? do_futex+0x391/0x460 [ 210.370326][T10681] __x64_sys_perf_event_open+0x67/0x80 [ 210.370356][T10681] x64_sys_call+0x1f25/0x2550 [ 210.370385][T10681] do_syscall_64+0x112/0x360 [ 210.370453][T10681] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.370482][T10681] RIP: 0033:0x7f219747f559 [ 210.370499][T10681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.370535][T10681] RSP: 002b:00007f2195ecf028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 210.370561][T10681] RAX: ffffffffffffffda RBX: 00007f2197705fa0 RCX: 00007f219747f559 [ 210.370580][T10681] RDX: dfffffffffffffff RSI: 0000000000000000 RDI: 0000200000000280 [ 210.370597][T10681] RBP: 00007f2197516b20 R08: 0000000000000009 R09: 0000000000000000 [ 210.370614][T10681] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 210.370657][T10681] R13: 00007f2197706038 R14: 00007f2197705fa0 R15: 00007ffeb716c088 [ 210.370676][T10681] [ 210.410693][T10686] netlink: 'syz.2.2771': attribute type 25 has an invalid length. [ 210.411342][T10689] ip_tables: iptables: counters copy to user failed while replacing table [ 210.474801][T10695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2775'. [ 210.478035][T10695] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2775'. [ 210.664309][ T29] audit: type=1400 audit(1792704982.126:687): avc: denied { write } for pid=10710 comm="syz.1.2782" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 210.665137][T10706] tipc: Resetting bearer [ 210.672346][T10702] tipc: Resetting bearer [ 210.694836][T10724] ip_tables: iptables: counters copy to user failed while replacing table [ 210.730361][T10728] FAULT_INJECTION: forcing a failure. [ 210.730361][T10728] name failslab, interval 1, probability 0, space 0, times 0 [ 210.730392][T10728] CPU: 0 UID: 0 PID: 10728 Comm: syz.3.2787 Not tainted syzkaller #0 PREEMPT(lazy) [ 210.730481][T10728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 210.730494][T10728] Call Trace: [ 210.730501][T10728] [ 210.730509][T10728] __dump_stack+0x1d/0x30 [ 210.730534][T10728] dump_stack_lvl+0x95/0xd0 [ 210.730560][T10728] dump_stack+0x15/0x1b [ 210.730585][T10728] should_fail_ex+0x262/0x280 [ 210.730684][T10728] ? tracepoint_add_func+0x201/0x770 [ 210.730712][T10728] should_failslab+0x8c/0xb0 [ 210.730782][T10728] __kmalloc_noprof+0xb6/0x4b0 [ 210.730807][T10728] ? tracepoint_add_func+0x201/0x770 [ 210.730833][T10728] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 210.730917][T10728] tracepoint_add_func+0x201/0x770 [ 210.730948][T10728] ? pcpu_memcg_post_alloc_hook+0x5e/0x190 [ 210.731006][T10728] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 210.731043][T10728] tracepoint_probe_register+0x5b/0x90 [ 210.731075][T10728] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 210.731156][T10728] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 210.731185][T10728] trace_event_reg+0x15c/0x190 [ 210.731209][T10728] perf_trace_event_init+0x331/0x6d0 [ 210.731255][T10728] perf_trace_init+0x15f/0x1d0 [ 210.731293][T10728] perf_tp_event_init+0x68/0xc0 [ 210.731362][T10728] perf_try_init_event+0x24d/0x7b0 [ 210.731410][T10728] ? radix_tree_lookup+0xfa/0x140 [ 210.731453][T10728] perf_event_alloc+0xb13/0x19e0 [ 210.731524][T10728] __se_sys_perf_event_open+0x67d/0x1290 [ 210.731572][T10728] ? do_futex+0x391/0x460 [ 210.731671][T10728] __x64_sys_perf_event_open+0x67/0x80 [ 210.731745][T10728] x64_sys_call+0x1f25/0x2550 [ 210.731774][T10728] do_syscall_64+0x112/0x360 [ 210.731811][T10728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 210.731895][T10728] RIP: 0033:0x7fb2e6d4f559 [ 210.731918][T10728] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 210.731939][T10728] RSP: 002b:00007fb2e57a7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 210.732042][T10728] RAX: ffffffffffffffda RBX: 00007fb2e6fd5fa0 RCX: 00007fb2e6d4f559 [ 210.732058][T10728] RDX: dfffffffffffffff RSI: 0000000000000000 RDI: 0000200000000280 [ 210.732072][T10728] RBP: 00007fb2e6de6b20 R08: 0000000000000009 R09: 0000000000000000 [ 210.732085][T10728] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 210.732099][T10728] R13: 00007fb2e6fd6038 R14: 00007fb2e6fd5fa0 R15: 00007ffcbfa2c598 [ 210.732119][T10728] [ 211.049912][ T51] tipc: Resetting bearer [ 211.075117][T10778] ip_tables: iptables: counters copy to user failed while replacing table [ 211.143355][ T29] audit: type=1400 audit(1792704982.606:688): avc: denied { write } for pid=10779 comm="syz.2.2806" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 211.144328][T10788] FAULT_INJECTION: forcing a failure. [ 211.144328][T10788] name failslab, interval 1, probability 0, space 0, times 0 [ 211.144359][T10788] CPU: 0 UID: 0 PID: 10788 Comm: syz.3.2808 Not tainted syzkaller #0 PREEMPT(lazy) [ 211.144399][T10788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 211.144414][T10788] Call Trace: [ 211.144421][T10788] [ 211.144431][T10788] __dump_stack+0x1d/0x30 [ 211.144463][T10788] dump_stack_lvl+0x95/0xd0 [ 211.144569][T10788] dump_stack+0x15/0x1b [ 211.144590][T10788] should_fail_ex+0x262/0x280 [ 211.144623][T10788] ? tracepoint_add_func+0x201/0x770 [ 211.144655][T10788] should_failslab+0x8c/0xb0 [ 211.144685][T10788] __kmalloc_noprof+0xb6/0x4b0 [ 211.144709][T10788] ? tracepoint_add_func+0x201/0x770 [ 211.144769][T10788] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 211.144797][T10788] tracepoint_add_func+0x201/0x770 [ 211.144828][T10788] ? pcpu_memcg_post_alloc_hook+0x5e/0x190 [ 211.144909][T10788] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 211.144936][T10788] tracepoint_probe_register+0x5b/0x90 [ 211.144962][T10788] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 211.144988][T10788] ? __pfx_perf_trace_sched_switch+0x10/0x10 [ 211.145047][T10788] trace_event_reg+0x15c/0x190 [ 211.145097][T10788] perf_trace_event_init+0x331/0x6d0 [ 211.145131][T10788] perf_trace_init+0x15f/0x1d0 [ 211.145181][T10788] perf_tp_event_init+0x68/0xc0 [ 211.145242][T10788] perf_try_init_event+0x24d/0x7b0 [ 211.145269][T10788] ? radix_tree_lookup+0xfa/0x140 [ 211.145304][T10788] perf_event_alloc+0xb13/0x19e0 [ 211.145413][T10788] __se_sys_perf_event_open+0x67d/0x1290 [ 211.145437][T10788] ? do_futex+0x391/0x460 [ 211.145480][T10788] __x64_sys_perf_event_open+0x67/0x80 [ 211.145545][T10788] x64_sys_call+0x1f25/0x2550 [ 211.145572][T10788] do_syscall_64+0x112/0x360 [ 211.145610][T10788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 211.145682][T10788] RIP: 0033:0x7fb2e6d4f559 [ 211.145702][T10788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 211.145724][T10788] RSP: 002b:00007fb2e57a7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 211.145751][T10788] RAX: ffffffffffffffda RBX: 00007fb2e6fd5fa0 RCX: 00007fb2e6d4f559 [ 211.145769][T10788] RDX: dfffffffffffffff RSI: 0000000000000000 RDI: 0000200000000280 [ 211.145786][T10788] RBP: 00007fb2e6de6b20 R08: 0000000000000009 R09: 0000000000000000 [ 211.145981][T10788] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 211.145999][T10788] R13: 00007fb2e6fd6038 R14: 00007fb2e6fd5fa0 R15: 00007ffcbfa2c598 [ 211.146021][T10788] [ 211.152339][ T29] audit: type=1400 audit(1792704982.606:689): avc: denied { name_bind } for pid=10779 comm="syz.2.2806" src=20002 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 211.269218][T10799] syzkaller0: entered promiscuous mode [ 211.269274][T10799] syzkaller0: entered allmulticast mode [ 211.413221][T10816] ip_tables: iptables: counters copy to user failed while replacing table [ 211.555700][T10827] tipc: Resetting bearer [ 211.559020][T10817] tipc: Resetting bearer [ 211.565196][T10841] syzkaller0: entered promiscuous mode [ 211.565217][T10841] syzkaller0: entered allmulticast mode [ 211.818519][T10881] loop1: detected capacity change from 0 to 512 [ 211.831171][T10881] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 211.847566][T10881] EXT4-fs (loop1): orphan cleanup on readonly fs [ 211.851907][T10881] EXT4-fs error (device loop1): ext4_validate_block_bitmap:445: comm syz.1.2845: bg 0: block 248: padding at end of block bitmap is not set [ 211.851960][T10881] loop1: lost filesystem error report for type 5 error -117 [ 211.852586][T10881] Quota error (device loop1): write_blk: dquota write failed [ 211.852700][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 211.852730][ C1] EXT4-fs (loop1): last error at time 1792704983: ext4_validate_block_bitmap:445 [ 211.852994][T10881] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 211.853141][T10881] EXT4-fs error (device loop1): ext4_acquire_dquot:7079: comm syz.1.2845: Failed to acquire dquot type 1 [ 211.853207][T10881] loop1: lost filesystem error report for type 5 error -117 [ 211.854897][T10881] EXT4-fs (loop1): 1 truncate cleaned up [ 211.861647][T10881] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 212.053874][ T32] tipc: Resetting bearer [ 212.135026][T10895] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.2845: deleted inode referenced: 12 [ 212.135976][T10895] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.2845: deleted inode referenced: 12 [ 214.661194][T10855] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 214.763852][T10908] __nla_validate_parse: 7 callbacks suppressed [ 214.763892][T10908] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2855'. [ 214.771094][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 214.832874][ T29] audit: type=1400 audit(1792704986.296:690): avc: denied { watch watch_reads } for pid=10920 comm="syz.5.2861" path="/523" dev="tmpfs" ino=2673 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 214.883230][ T29] audit: type=1400 audit(1792704986.346:691): avc: denied { watch } for pid=10923 comm="syz.0.2862" path="/" dev="nullfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 214.906101][T10924] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 215.157399][T10968] syzkaller0: entered promiscuous mode [ 215.157428][T10968] syzkaller0: entered allmulticast mode [ 215.196326][T10970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2877'. [ 215.202582][T10970] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2877'. [ 215.898185][T10983] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2882'. [ 217.832050][T11005] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2891'. [ 218.024335][T10948] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 218.070939][T11011] netlink: 108 bytes leftover after parsing attributes in process `syz.3.2894'. [ 218.562047][ T29] audit: type=1400 audit(1792704990.016:692): avc: denied { read write } for pid=11061 comm="syz.3.2912" name="usbmon6" dev="devtmpfs" ino=160 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 218.588018][ T29] audit: type=1400 audit(1792704990.016:693): avc: denied { open } for pid=11061 comm="syz.3.2912" path="/dev/usbmon6" dev="devtmpfs" ino=160 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 218.588156][ T29] audit: type=1400 audit(1792704990.036:694): avc: denied { map } for pid=11061 comm="syz.3.2912" path="/dev/usbmon6" dev="devtmpfs" ino=160 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 218.588183][ T29] audit: type=1400 audit(1792704990.036:695): avc: denied { execute } for pid=11061 comm="syz.3.2912" path="/dev/usbmon6" dev="devtmpfs" ino=160 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 218.591117][ T29] audit: type=1400 audit(1792704990.046:696): avc: denied { ioctl } for pid=11061 comm="syz.3.2912" path="/dev/usbmon6" dev="devtmpfs" ino=160 ioctlcmd=0x9204 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 218.695832][T11063] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 219.017443][T11097] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2927'. [ 219.040023][T11099] syzkaller0: entered promiscuous mode [ 219.040056][T11099] syzkaller0: entered allmulticast mode [ 219.110937][T11089] rxe_eth0 speed is unknown, defaulting to 1000 [ 219.211416][T11089] lo speed is unknown, defaulting to 1000 [ 219.518012][T11089] bridge0: port 1(bridge_slave_0) entered blocking state [ 219.518086][T11089] bridge0: port 1(bridge_slave_0) entered disabled state [ 219.518248][T11089] bridge_slave_0: entered allmulticast mode [ 219.518806][T11089] bridge_slave_0: entered promiscuous mode [ 219.551552][T11089] bridge0: port 2(bridge_slave_1) entered blocking state [ 219.551593][T11089] bridge0: port 2(bridge_slave_1) entered disabled state [ 219.551716][T11089] bridge_slave_1: entered allmulticast mode [ 219.552301][T11089] bridge_slave_1: entered promiscuous mode [ 219.592207][T11089] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 219.594537][T11148] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2945'. [ 219.612832][T11089] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 219.614639][T11117] loop0: detected capacity change from 0 to 1024 [ 219.615403][T11117] EXT4-fs: Ignoring removed oldalloc option [ 219.615434][T11117] EXT4-fs: Ignoring removed orlov option [ 219.652723][T11117] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 219.674182][T11089] team0: Port device team_slave_0 added [ 219.684133][T11089] team0: Port device team_slave_1 added [ 219.691855][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 219.705765][T11089] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 219.705782][T11089] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 219.705815][T11089] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 219.706443][T11089] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 219.706462][T11089] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 219.706489][T11089] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 219.756560][T11089] hsr_slave_0: entered promiscuous mode [ 219.757006][T11089] hsr_slave_1: entered promiscuous mode [ 219.757277][T11089] debugfs: 'hsr0' already exists in 'hsr' [ 219.757293][T11089] Cannot create hsr debugfs directory [ 219.865534][T11089] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.909326][T11089] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.926691][T11177] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2956'. [ 219.956355][T11170] tipc: Resetting bearer [ 219.962039][T11089] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 219.987692][T11168] tipc: Resetting bearer [ 220.001791][T11089] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 220.093248][T11089] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 220.099279][T11089] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 220.101270][T11089] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 220.126026][T11089] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 220.127907][T11089] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 220.146620][T11089] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 220.147285][T11089] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 220.168348][T11089] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 220.225902][T11089] 8021q: adding VLAN 0 to HW filter on device bond0 [ 220.231895][T11089] 8021q: adding VLAN 0 to HW filter on device team0 [ 220.258838][T11089] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 220.258865][T11089] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 220.276758][ T51] bridge0: port 1(bridge_slave_0) entered blocking state [ 220.276796][ T51] bridge0: port 1(bridge_slave_0) entered forwarding state [ 220.281820][ T51] bridge0: port 2(bridge_slave_1) entered blocking state [ 220.281854][ T51] bridge0: port 2(bridge_slave_1) entered forwarding state [ 220.524791][T11089] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 220.536293][T11239] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 220.635246][T11089] veth0_vlan: entered promiscuous mode [ 220.638324][T11089] veth1_vlan: entered promiscuous mode [ 220.661250][T11089] veth0_macvtap: entered promiscuous mode [ 220.663094][T11089] veth1_macvtap: entered promiscuous mode [ 220.681583][T11089] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 220.691657][T11089] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 220.702330][ T38] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.702398][ T38] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.702437][ T38] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.713275][ T38] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 220.936137][T11262] loop3: detected capacity change from 0 to 512 [ 220.941737][T11262] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 220.959788][T11262] EXT4-fs (loop3): orphan cleanup on readonly fs [ 220.961640][T11262] EXT4-fs error (device loop3): ext4_validate_block_bitmap:445: comm syz.3.2924: bg 0: block 248: padding at end of block bitmap is not set [ 220.961718][T11262] loop3: lost filesystem error report for type 5 error -117 [ 220.962202][T11262] Quota error (device loop3): write_blk: dquota write failed [ 220.962316][T11262] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 220.962352][T11262] EXT4-fs error (device loop3): ext4_acquire_dquot:7079: comm syz.3.2924: Failed to acquire dquot type 1 [ 220.962416][T11262] loop3: lost filesystem error report for type 5 error -117 [ 220.983604][ C0] EXT4-fs (loop3): error count since last fsck: 2 [ 220.983630][ C0] EXT4-fs (loop3): last error at time 1792704992: ext4_acquire_dquot:7079 [ 220.985388][T11262] EXT4-fs (loop3): 1 truncate cleaned up [ 220.995113][T11262] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 220.997273][ T38] tipc: Resetting bearer [ 221.067845][ T29] audit: type=1400 audit(1792704992.526:697): avc: denied { write } for pid=11275 comm="syz.5.2984" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 221.124918][T11278] loop2: detected capacity change from 0 to 8192 [ 221.127490][T11278] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 221.292041][T11262] EXT4-fs error (device loop3): ext4_lookup:1791: inode #2: comm syz.3.2924: deleted inode referenced: 12 [ 221.296616][T11262] EXT4-fs error (device loop3): ext4_lookup:1791: inode #2: comm syz.3.2924: deleted inode referenced: 12 [ 221.446621][T11293] loop0: detected capacity change from 0 to 512 [ 221.479345][T11293] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 221.482505][T11293] EXT4-fs (loop0): orphan cleanup on readonly fs [ 221.485300][T11293] EXT4-fs error (device loop0): ext4_validate_block_bitmap:445: comm syz.0.2990: bg 0: block 248: padding at end of block bitmap is not set [ 221.485414][T11293] loop0: lost filesystem error report for type 5 error -117 [ 221.485850][T11293] Quota error (device loop0): write_blk: dquota write failed [ 221.485883][T11293] Quota error (device loop0): qtree_write_dquot: Error -117 occurred while creating quota [ 221.485914][T11293] EXT4-fs error (device loop0): ext4_acquire_dquot:7079: comm syz.0.2990: Failed to acquire dquot type 1 [ 221.485963][T11293] loop0: lost filesystem error report for type 5 error -117 [ 221.487502][T11293] EXT4-fs (loop0): 1 truncate cleaned up [ 221.492837][ C1] EXT4-fs (loop0): error count since last fsck: 2 [ 221.493134][ C1] EXT4-fs (loop0): last error at time 1792704992: ext4_acquire_dquot:7079 [ 221.495564][T11293] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 221.510972][T11288] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 221.790959][T11293] EXT4-fs error (device loop0): ext4_lookup:1791: inode #2: comm syz.0.2990: deleted inode referenced: 12 [ 221.792062][T11293] EXT4-fs error (device loop0): ext4_lookup:1791: inode #2: comm syz.0.2990: deleted inode referenced: 12 [ 221.883833][T11089] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 221.927754][T11316] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2998'. [ 222.041426][T11327] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 222.411126][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 222.730392][T11352] loop1: detected capacity change from 0 to 512 [ 222.734932][T11352] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 222.756046][T11352] EXT4-fs (loop1): orphan cleanup on readonly fs [ 222.769387][T11352] EXT4-fs error (device loop1): ext4_validate_block_bitmap:445: comm syz.1.3012: bg 0: block 248: padding at end of block bitmap is not set [ 222.769452][T11352] loop1: lost filesystem error report for type 5 error -117 [ 222.772274][T11352] Quota error (device loop1): write_blk: dquota write failed [ 222.772389][T11352] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 222.772423][T11352] EXT4-fs error (device loop1): ext4_acquire_dquot:7079: comm syz.1.3012: Failed to acquire dquot type 1 [ 222.772570][T11352] loop1: lost filesystem error report for type 5 error -117 [ 222.772651][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 222.772701][ C1] EXT4-fs (loop1): last error at time 1792704994: ext4_acquire_dquot:7079 [ 222.776782][T11352] EXT4-fs (loop1): 1 truncate cleaned up [ 222.789529][T11352] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 222.893757][T11357] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3014'. [ 222.922030][ T29] audit: type=1400 audit(1792704994.376:698): avc: denied { write } for pid=11354 comm="syz.5.3013" name="os_desc" dev="configfs" ino=25793 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 223.008480][T11361] loop3: detected capacity change from 0 to 8192 [ 223.020804][T11361] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 223.105372][T11352] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.3012: deleted inode referenced: 12 [ 223.110393][T11352] EXT4-fs error (device loop1): ext4_lookup:1791: inode #2: comm syz.1.3012: deleted inode referenced: 12 [ 223.227400][T11342] loop0: detected capacity change from 0 to 1024 [ 223.288391][T11342] EXT4-fs: Ignoring removed oldalloc option [ 223.290835][T11342] EXT4-fs: Ignoring removed orlov option [ 223.365718][T11342] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 223.448313][ T3305] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.714024][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 223.846869][T11400] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 224.363961][T11406] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3027'. [ 224.696884][T11413] loop1: detected capacity change from 0 to 1024 [ 224.697480][T11413] EXT4-fs: Ignoring removed oldalloc option [ 224.697511][T11413] EXT4-fs: Ignoring removed orlov option [ 224.718454][T11413] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 224.742891][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 224.778452][T11420] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3032'. [ 225.328512][T11432] rxe_eth0 speed is unknown, defaulting to 1000 [ 225.355846][T11432] lo speed is unknown, defaulting to 1000 [ 225.452533][ T405] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.452576][ T405] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.479208][T11432] bridge0: port 1(bridge_slave_0) entered blocking state [ 225.479231][T11432] bridge0: port 1(bridge_slave_0) entered disabled state [ 225.479356][T11432] bridge_slave_0: entered allmulticast mode [ 225.479788][T11432] bridge_slave_0: entered promiscuous mode [ 225.480748][T11432] bridge0: port 2(bridge_slave_1) entered blocking state [ 225.480781][T11432] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.480910][T11432] bridge_slave_1: entered allmulticast mode [ 225.481435][T11432] bridge_slave_1: entered promiscuous mode [ 225.495340][T11432] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 225.496638][T11432] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 225.507771][T11432] team0: Port device team_slave_0 added [ 225.509041][T11432] team0: Port device team_slave_1 added [ 225.521524][T11432] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 225.521571][T11432] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.521598][T11432] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 225.522203][T11432] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 225.522215][T11432] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 225.522311][T11432] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 225.529988][ T405] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.530027][ T405] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.618306][T11432] hsr_slave_0: entered promiscuous mode [ 225.618795][T11432] hsr_slave_1: entered promiscuous mode [ 225.619159][T11432] debugfs: 'hsr0' already exists in 'hsr' [ 225.619174][T11432] Cannot create hsr debugfs directory [ 225.668894][ T405] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.668933][ T405] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.731020][ T405] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 225.731106][ T405] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 225.785547][ T405] bridge_slave_1: left allmulticast mode [ 225.785571][ T405] bridge_slave_1: left promiscuous mode [ 225.785726][ T405] bridge0: port 2(bridge_slave_1) entered disabled state [ 225.787174][ T405] bridge_slave_0: left allmulticast mode [ 225.787196][ T405] bridge_slave_0: left promiscuous mode [ 225.787399][ T405] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.028159][ T405] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 226.052148][ T405] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 226.062310][ T405] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 226.063717][ T405] bond0 (unregistering): Released all slaves [ 226.080731][ T29] audit: type=1400 audit(1792704997.536:699): avc: denied { read } for pid=3024 comm="dhcpcd" name="n32" dev="tmpfs" ino=1155 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.080809][ T29] audit: type=1400 audit(1792704997.536:700): avc: denied { open } for pid=3024 comm="dhcpcd" path="/run/udev/data/n32" dev="tmpfs" ino=1155 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.080910][ T29] audit: type=1400 audit(1792704997.536:701): avc: denied { getattr } for pid=3024 comm="dhcpcd" path="/run/udev/data/n32" dev="tmpfs" ino=1155 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.154325][T11367] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 226.165922][ T405] tipc: Left network mode [ 226.167741][T11429] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3036'. [ 226.255436][T11458] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3039'. [ 226.415483][ T29] audit: type=1400 audit(1792704997.866:702): avc: denied { write } for pid=11451 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 226.415519][ T29] audit: type=1400 audit(1792704997.866:703): avc: denied { create } for pid=11451 comm="dhcpcd-run-hook" name="resolv.conf.eth5.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.415545][ T29] audit: type=1400 audit(1792704997.866:704): avc: denied { write } for pid=11451 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth5.link" dev="tmpfs" ino=1168 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.415652][ T29] audit: type=1400 audit(1792704997.866:705): avc: denied { append } for pid=11451 comm="dhcpcd-run-hook" name="resolv.conf.eth5.link" dev="tmpfs" ino=1168 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.419360][ T405] hsr_slave_0: left promiscuous mode [ 226.419744][ T405] hsr_slave_1: left promiscuous mode [ 226.420327][ T405] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 226.420343][ T405] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 226.420723][ T405] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 226.420738][ T405] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 226.447495][ T405] veth1_macvtap: left promiscuous mode [ 226.447586][ T405] veth0_macvtap: left promiscuous mode [ 226.447704][ T405] veth1_vlan: left promiscuous mode [ 226.447739][ T405] veth0_vlan: left promiscuous mode [ 226.467736][ T29] audit: type=1400 audit(1792704997.926:706): avc: denied { write } for pid=11485 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 226.467823][ T29] audit: type=1400 audit(1792704997.926:707): avc: denied { unlink } for pid=11485 comm="rm" name="resolv.conf.eth5.link" dev="tmpfs" ino=1168 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.637275][T11493] ip_tables: iptables: counters copy to user failed while replacing table [ 226.702018][ T405] team0 (unregistering): Port device team_slave_1 removed [ 226.741711][ T405] team0 (unregistering): Port device team_slave_0 removed [ 226.772978][T11492] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 226.862764][ T29] audit: type=1400 audit(1792704998.316:708): avc: denied { write } for pid=11497 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 226.965608][ T405] IPVS: stop unused estimator thread 0... [ 229.213014][T11453] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 229.214410][T11432] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 229.220225][T11432] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 229.220841][T11432] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 229.229208][T11432] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 229.229966][T11432] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 229.276951][T11432] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 229.281944][T11432] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 229.287228][T11432] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 229.303121][T11534] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3053'. [ 229.334449][T11546] ip_tables: iptables: counters copy to user failed while replacing table [ 229.391099][T11554] netlink: 84 bytes leftover after parsing attributes in process `syz.5.3061'. [ 229.417035][T11432] 8021q: adding VLAN 0 to HW filter on device bond0 [ 229.427121][T11555] syzkaller0: entered promiscuous mode [ 229.427143][T11555] syzkaller0: entered allmulticast mode [ 229.431505][T11432] 8021q: adding VLAN 0 to HW filter on device team0 [ 229.436554][ T32] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.436592][ T32] bridge0: port 1(bridge_slave_0) entered forwarding state [ 229.468794][ T32] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.468835][ T32] bridge0: port 2(bridge_slave_1) entered forwarding state [ 229.508881][T11562] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3059'. [ 229.616243][T11572] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3066'. [ 229.712558][T11432] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 229.852196][T11432] veth0_vlan: entered promiscuous mode [ 229.856539][T11432] veth1_vlan: entered promiscuous mode [ 229.878267][T11432] veth0_macvtap: entered promiscuous mode [ 229.881842][T11432] veth1_macvtap: entered promiscuous mode [ 229.883270][T11609] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3077'. [ 229.887995][T11432] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 229.891797][T11432] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 229.895503][ T51] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.895635][ T51] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.895681][ T51] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 229.895719][ T51] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.037302][T11615] tipc: Enabling of bearer rejected, failed to enable media [ 230.157060][T11621] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3080'. [ 230.157536][T11621] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3080'. [ 230.249072][T11607] loop3: detected capacity change from 0 to 1024 [ 230.252256][T11607] EXT4-fs: Ignoring removed oldalloc option [ 230.252287][T11607] EXT4-fs: Ignoring removed orlov option [ 230.278272][T11607] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 230.496023][T11089] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 230.532001][T11646] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3088'. [ 231.267916][T11699] __nla_validate_parse: 3 callbacks suppressed [ 231.267935][T11699] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3111'. [ 231.636110][T11712] loop2: detected capacity change from 0 to 1024 [ 231.638050][T11712] EXT4-fs: Ignoring removed oldalloc option [ 231.638083][T11712] EXT4-fs: Ignoring removed orlov option [ 231.686994][T11712] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 231.709898][T11738] TC_ACT_REPEAT abuse ? [ 231.769035][ T3308] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 231.991349][T11767] TC_ACT_REPEAT abuse ? [ 232.292989][T11791] TC_ACT_REPEAT abuse ? [ 232.336085][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 232.336104][ T29] audit: type=1400 audit(1792705003.796:710): avc: denied { bind } for pid=11795 comm="syz.3.3153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 232.363064][ T29] audit: type=1400 audit(1792705003.796:711): avc: denied { listen } for pid=11795 comm="syz.3.3153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 232.363515][ T29] audit: type=1400 audit(1792705003.826:712): avc: denied { accept } for pid=11795 comm="syz.3.3153" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 232.411783][T11797] loop1: detected capacity change from 0 to 1024 [ 232.412559][T11797] EXT4-fs: Ignoring removed oldalloc option [ 232.412932][T11797] EXT4-fs: Ignoring removed orlov option [ 232.434199][T11797] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 232.470211][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.622646][T11828] TC_ACT_REPEAT abuse ? [ 232.683922][T11832] loop1: detected capacity change from 0 to 1024 [ 232.684579][T11832] EXT4-fs: Ignoring removed oldalloc option [ 232.684625][T11832] EXT4-fs: Ignoring removed orlov option [ 232.707458][T11832] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 232.725826][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 232.851373][T11848] loop1: detected capacity change from 0 to 8192 [ 232.856966][T11848] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 232.980980][ T29] audit: type=1400 audit(1792705004.436:713): avc: denied { allowed } for pid=11847 comm="syz.1.3173" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 233.207438][T11856] rxe_eth0 speed is unknown, defaulting to 1000 [ 233.229585][ T405] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.247102][T11856] lo speed is unknown, defaulting to 1000 [ 233.266642][ T405] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.284967][T11870] TC_ACT_REPEAT abuse ? [ 233.302312][ T405] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.428325][T11882] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3184'. [ 233.431974][ T405] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 233.512026][T11856] bridge0: port 1(bridge_slave_0) entered blocking state [ 233.512073][T11856] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.512132][T11856] bridge_slave_0: entered allmulticast mode [ 233.513007][T11856] bridge_slave_0: entered promiscuous mode [ 233.513908][T11856] bridge0: port 2(bridge_slave_1) entered blocking state [ 233.513940][T11856] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.514002][T11856] bridge_slave_1: entered allmulticast mode [ 233.514779][T11856] bridge_slave_1: entered promiscuous mode [ 233.534022][T11856] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 233.589013][T11856] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 233.628710][T11856] team0: Port device team_slave_0 added [ 233.644214][T11856] team0: Port device team_slave_1 added [ 233.686766][ T405] bridge_slave_1: left allmulticast mode [ 233.686791][ T405] bridge_slave_1: left promiscuous mode [ 233.686973][ T405] bridge0: port 2(bridge_slave_1) entered disabled state [ 233.690683][ T405] bridge_slave_0: left allmulticast mode [ 233.690709][ T405] bridge_slave_0: left promiscuous mode [ 233.690797][ T405] bridge0: port 1(bridge_slave_0) entered disabled state [ 233.808020][ T405] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 233.811225][ T405] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 233.832156][ T405] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 233.844216][ T405] bond0 (unregistering): Released all slaves [ 233.847511][ T405] bond1 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 233.848438][ T405] bond1 (unregistering): Released all slaves [ 233.856034][T11856] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 233.856051][T11856] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 233.856128][T11856] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 233.856719][T11856] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 233.856731][T11856] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 233.856771][T11856] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 233.922103][T11856] hsr_slave_0: entered promiscuous mode [ 233.924844][T11856] hsr_slave_1: entered promiscuous mode [ 233.928225][ T405] tipc: Disabling bearer [ 233.954840][ T405] tipc: Left network mode [ 234.054862][ T29] audit: type=1400 audit(1792705005.506:714): avc: denied { write } for pid=11896 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 234.092017][ T29] audit: type=1400 audit(1792705005.546:715): avc: denied { write } for pid=11910 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 234.144385][ T405] hsr_slave_0: left promiscuous mode [ 234.154754][ T405] hsr_slave_1: left promiscuous mode [ 234.159162][ T405] veth1_macvtap: left promiscuous mode [ 234.159190][ T405] veth0_macvtap: left promiscuous mode [ 234.159291][ T405] veth1_vlan: left promiscuous mode [ 234.159324][ T405] veth0_vlan: left promiscuous mode [ 234.286211][ T405] team0 (unregistering): Port device team_slave_1 removed [ 234.290974][ T405] team0 (unregistering): Port device team_slave_0 removed [ 234.327050][ T32] smc: removing ib device syz0 [ 234.341140][ T3024] 8021q: adding VLAN 0 to HW filter on device eth5 [ 234.642017][T11935] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3192'. [ 234.749434][ T29] audit: type=1400 audit(1792705006.206:716): avc: denied { write } for pid=11929 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 234.894477][ T29] audit: type=1400 audit(1792705006.356:717): avc: denied { write } for pid=11949 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 234.952798][ T3024] 8021q: adding VLAN 0 to HW filter on device eth6 [ 235.212598][ T29] audit: type=1400 audit(1792705006.666:718): avc: denied { create } for pid=11968 comm="syz.5.3200" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 235.344494][T11979] TC_ACT_REPEAT abuse ? [ 235.398259][T11856] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 235.444681][T11856] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 235.445402][T11856] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 235.449955][T11856] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 235.474800][T11856] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 235.478585][T11856] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 235.479122][T11856] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 235.482436][T11856] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 235.557955][ T29] audit: type=1400 audit(1792705007.016:719): avc: denied { write } for pid=11981 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 235.561965][T11856] 8021q: adding VLAN 0 to HW filter on device bond0 [ 235.600124][T11856] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.602608][ T32] bridge0: port 1(bridge_slave_0) entered blocking state [ 235.602667][ T32] bridge0: port 1(bridge_slave_0) entered forwarding state [ 235.627419][ T32] bridge0: port 2(bridge_slave_1) entered blocking state [ 235.627457][ T32] bridge0: port 2(bridge_slave_1) entered forwarding state [ 235.984783][T11856] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 236.066615][T12055] TC_ACT_REPEAT abuse ? [ 236.139081][T12064] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3220'. [ 236.160737][T11856] veth0_vlan: entered promiscuous mode [ 236.170403][T11856] veth1_vlan: entered promiscuous mode [ 236.189426][T11856] veth0_macvtap: entered promiscuous mode [ 236.191796][T11856] veth1_macvtap: entered promiscuous mode [ 236.203431][T11856] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 236.205570][T11856] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 236.223099][ T38] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.225238][ T38] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.225288][ T38] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.225411][ T38] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 236.466117][T12087] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3225'. [ 236.696778][T12117] loop0: detected capacity change from 0 to 1024 [ 236.697858][T12117] EXT4-fs: Ignoring removed oldalloc option [ 236.697889][T12117] EXT4-fs: Ignoring removed orlov option [ 236.716137][T12117] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 236.732930][T11432] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 239.583667][T12102] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 239.645058][T12153] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3247'. [ 239.890795][T12202] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3265'. [ 239.932237][T12200] loop0: detected capacity change from 0 to 8192 [ 239.943165][T12200] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 240.268921][T12242] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3278'. [ 240.610430][T12284] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3290'. [ 241.073938][T12294] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 242.888845][T12312] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3301'. [ 243.389287][T12253] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 243.396920][T12289] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3292'. [ 243.493512][T12329] loop2: detected capacity change from 0 to 8192 [ 243.497992][T12329] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 243.510817][T12337] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3312'. [ 243.745898][T12357] ip_tables: iptables: counters copy to user failed while replacing table [ 243.745929][ T29] kauditd_printk_skb: 3 callbacks suppressed [ 243.745943][ T29] audit: type=1400 audit(1792705015.206:723): avc: denied { setopt } for pid=12356 comm="syz.3.3318" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 243.747721][ T29] audit: type=1400 audit(1792705015.206:724): avc: denied { write } for pid=12356 comm="syz.3.3318" lport=255 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 244.090749][T12365] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3321'. [ 244.354672][T12382] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3325'. [ 244.547821][T12388] rxe_eth0 speed is unknown, defaulting to 1000 [ 244.586643][ T38] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.626270][ T38] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.679858][ T38] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.719069][T12388] bridge0: port 1(bridge_slave_0) entered blocking state [ 244.719125][T12388] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.719280][T12388] bridge_slave_0: entered allmulticast mode [ 244.719705][T12388] bridge_slave_0: entered promiscuous mode [ 244.721028][T12388] bridge0: port 2(bridge_slave_1) entered blocking state [ 244.721060][T12388] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.721193][T12388] bridge_slave_1: entered allmulticast mode [ 244.721582][T12388] bridge_slave_1: entered promiscuous mode [ 244.733727][T12388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 244.734829][T12388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 244.746159][T12388] team0: Port device team_slave_0 added [ 244.747239][T12388] team0: Port device team_slave_1 added [ 244.757987][T12388] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 244.758004][T12388] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 244.758031][T12388] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 244.758675][T12388] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 244.758687][T12388] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 244.758716][T12388] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 244.799039][ T38] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 244.806380][T12388] hsr_slave_0: entered promiscuous mode [ 244.806928][T12388] hsr_slave_1: entered promiscuous mode [ 244.807291][T12388] debugfs: 'hsr0' already exists in 'hsr' [ 244.807306][T12388] Cannot create hsr debugfs directory [ 244.938647][ T38] bridge_slave_1: left allmulticast mode [ 244.938673][ T38] bridge_slave_1: left promiscuous mode [ 244.938773][ T38] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.945440][ T38] bridge_slave_0: left allmulticast mode [ 244.945463][ T38] bridge_slave_0: left promiscuous mode [ 244.945689][ T38] bridge0: port 1(bridge_slave_0) entered disabled state [ 245.046414][ T38] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 245.047709][ T38] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 245.048614][ T38] bond0 (unregistering): Released all slaves [ 245.110210][ T38] hsr_slave_0: left promiscuous mode [ 245.110463][ T38] hsr_slave_1: left promiscuous mode [ 245.110790][ T38] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 245.110803][ T38] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 245.111137][ T38] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 245.111152][ T38] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 245.125581][ T38] veth1_macvtap: left promiscuous mode [ 245.125609][ T38] veth0_macvtap: left promiscuous mode [ 245.125673][ T38] veth1_vlan: left promiscuous mode [ 245.125756][ T38] veth0_vlan: left promiscuous mode [ 245.204618][ T38] team0 (unregistering): Port device team_slave_1 removed [ 245.206926][ T38] team0 (unregistering): Port device team_slave_0 removed [ 246.998594][T12430] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3337'. [ 246.998765][T12430] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3337'. [ 247.288274][T12368] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 247.290638][T12413] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3332'. [ 247.293012][T12388] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 247.308811][T12388] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 247.311176][T12388] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 247.316879][T12388] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 247.318015][T12388] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 247.336608][T12388] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 247.337660][T12388] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 247.344909][T12388] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 247.489695][T12388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 247.510120][T12388] 8021q: adding VLAN 0 to HW filter on device team0 [ 247.522557][ T405] bridge0: port 1(bridge_slave_0) entered blocking state [ 247.522722][ T405] bridge0: port 1(bridge_slave_0) entered forwarding state [ 247.528138][ T405] bridge0: port 2(bridge_slave_1) entered blocking state [ 247.528176][ T405] bridge0: port 2(bridge_slave_1) entered forwarding state [ 247.544128][T12465] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3344'. [ 247.570366][ T29] audit: type=1400 audit(1792705019.026:725): avc: denied { write } for pid=12450 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 247.602019][T12461] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 247.637418][ T29] audit: type=1400 audit(1792705019.096:726): avc: denied { write } for pid=12470 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 247.821062][T12388] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 247.846625][T12494] ip_tables: iptables: counters copy to user failed while replacing table [ 247.919139][ T29] audit: type=1400 audit(1792705019.376:727): avc: denied { write } for pid=12477 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 247.998622][ T29] audit: type=1400 audit(1792705019.456:728): avc: denied { write } for pid=12512 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 248.055979][T12517] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3351'. [ 248.174103][T12388] veth0_vlan: entered promiscuous mode [ 248.182044][T12388] veth1_vlan: entered promiscuous mode [ 248.238311][T12388] veth0_macvtap: entered promiscuous mode [ 248.241651][T12388] veth1_macvtap: entered promiscuous mode [ 248.255521][T12388] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 248.263691][T12388] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 248.343855][ T149] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.344263][ T149] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.344301][ T149] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.344396][ T149] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.367609][T12530] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3354'. [ 248.422859][ T29] audit: type=1400 audit(1792705019.886:729): avc: denied { create } for pid=12535 comm="syz.0.3356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 248.424590][ T29] audit: type=1400 audit(1792705019.886:730): avc: denied { bind } for pid=12535 comm="syz.0.3356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 248.467611][ T29] audit: type=1400 audit(1792705019.926:731): avc: denied { connect } for pid=12535 comm="syz.0.3356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 248.469318][ T29] audit: type=1400 audit(1792705019.926:732): avc: denied { write } for pid=12535 comm="syz.0.3356" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 248.598589][T12544] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3357'. [ 248.598821][T12544] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3357'. [ 248.813650][T12560] syzkaller1: entered promiscuous mode [ 248.813674][T12560] syzkaller1: entered allmulticast mode [ 248.815058][ T29] audit: type=1400 audit(1792705020.276:733): avc: denied { ioctl } for pid=12559 comm="syz.1.3365" path="socket:[38500]" dev="sockfs" ino=38500 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 248.832593][T12463] loop3: detected capacity change from 0 to 1024 [ 248.895305][T12463] EXT4-fs: Ignoring removed oldalloc option [ 248.898334][T12463] EXT4-fs: Ignoring removed orlov option [ 248.900643][T12562] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3366'. [ 248.940130][T12463] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 249.122160][T12573] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 249.155801][T11089] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 249.176326][T12579] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3371'. [ 249.176534][T12579] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3371'. [ 249.558647][T12605] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3381'. [ 249.575041][T12609] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3382'. [ 249.575245][T12609] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3382'. [ 249.717302][T12613] loop2: detected capacity change from 0 to 1024 [ 249.718436][T12613] EXT4-fs: Ignoring removed oldalloc option [ 249.718535][T12613] EXT4-fs: Ignoring removed orlov option [ 249.750249][T12613] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 249.784753][T11856] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 249.981458][T12648] loop1: detected capacity change from 0 to 1024 [ 249.985640][T12648] EXT4-fs: Ignoring removed oldalloc option [ 249.985669][T12648] EXT4-fs: Ignoring removed orlov option [ 250.005495][T12648] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 250.028545][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 250.088603][T12660] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 250.089347][ T29] audit: type=1400 audit(1792705021.546:734): avc: denied { connect } for pid=12659 comm="syz.5.3401" lport=44 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 250.244786][T12664] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 250.684120][T12689] loop1: detected capacity change from 0 to 8192 [ 250.698148][T12689] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 251.463670][T12723] syzkaller0: entered promiscuous mode [ 251.463695][T12723] syzkaller0: entered allmulticast mode [ 251.465692][T12723] tipc: Started in network mode [ 251.465722][T12723] tipc: Node identity 764aeb87086, cluster identity 4711 [ 251.465827][T12723] tipc: Enabled bearer , priority 0 [ 251.468002][T12723] tipc: Resetting bearer [ 251.507298][T12722] tipc: Resetting bearer [ 251.508777][T12722] tipc: Disabling bearer [ 251.527105][T12679] loop5: detected capacity change from 0 to 1024 [ 251.538948][T12679] EXT4-fs: Ignoring removed oldalloc option [ 251.541074][T12679] EXT4-fs: Ignoring removed orlov option [ 251.569245][T12679] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 251.725314][T12388] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 252.032332][T12758] syzkaller0: entered promiscuous mode [ 252.032354][T12758] syzkaller0: entered allmulticast mode [ 252.050015][T12758] tipc: Enabled bearer , priority 0 [ 252.051922][T12758] tipc: Resetting bearer [ 252.065743][T12757] tipc: Resetting bearer [ 252.071567][T12757] tipc: Disabling bearer [ 252.175966][T12766] loop1: detected capacity change from 0 to 1024 [ 252.176511][T12766] EXT4-fs: Ignoring removed oldalloc option [ 252.176796][T12766] EXT4-fs: Ignoring removed orlov option [ 252.224405][T12766] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 252.315701][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 252.444267][T12785] loop1: detected capacity change from 0 to 8192 [ 252.445131][T12785] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 252.526093][T12791] syzkaller0: entered promiscuous mode [ 252.526115][T12791] syzkaller0: entered allmulticast mode [ 252.542769][T12791] tipc: Started in network mode [ 252.542922][T12791] tipc: Node identity 468aba1c500c, cluster identity 4711 [ 252.542965][T12791] tipc: Enabled bearer , priority 0 [ 252.567373][T12790] tipc: Resetting bearer [ 252.587548][T12790] tipc: Disabling bearer [ 253.035294][T12836] syzkaller0: entered promiscuous mode [ 253.035318][T12836] syzkaller0: entered allmulticast mode [ 253.040142][T12836] tipc: Started in network mode [ 253.040175][T12836] tipc: Node identity fe602aefae24, cluster identity 4711 [ 253.040220][T12836] tipc: Enabled bearer , priority 0 [ 253.075614][T12835] tipc: Resetting bearer [ 253.094824][T12835] tipc: Disabling bearer [ 253.144586][T12845] ip_tables: iptables: counters copy to user failed while replacing table [ 253.219911][T12853] __nla_validate_parse: 15 callbacks suppressed [ 253.219931][T12853] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3480'. [ 253.431986][T12869] syzkaller0: entered promiscuous mode [ 253.432013][T12869] syzkaller0: entered allmulticast mode [ 253.434621][T12869] tipc: Enabled bearer , priority 0 [ 253.456914][T12870] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3486'. [ 253.456924][T12868] tipc: Resetting bearer [ 253.460053][T12868] tipc: Disabling bearer [ 253.493199][T12872] ip_tables: iptables: counters copy to user failed while replacing table [ 253.658121][T12885] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3495'. [ 253.763028][T12897] ip_tables: iptables: counters copy to user failed while replacing table [ 253.808268][T12903] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3500'. [ 253.845484][T12904] syzkaller0: entered promiscuous mode [ 253.845506][T12904] syzkaller0: entered allmulticast mode [ 253.848003][T12904] tipc: Started in network mode [ 253.848050][T12904] tipc: Node identity ce9af09a2387, cluster identity 4711 [ 253.848093][T12904] tipc: Enabled bearer , priority 0 [ 253.849592][T12902] tipc: Resetting bearer [ 253.871205][T12902] tipc: Disabling bearer [ 254.020261][T12908] loop5: detected capacity change from 0 to 8192 [ 254.022942][T12908] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 254.101184][T12921] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3512'. [ 254.103709][T12918] netlink: 'syz.1.3511': attribute type 25 has an invalid length. [ 254.170054][T12927] ip_tables: iptables: counters copy to user failed while replacing table [ 254.423847][T12944] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3520'. [ 254.569777][T12946] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 254.822091][T12954] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 254.885767][T12958] netlink: 'syz.0.3526': attribute type 25 has an invalid length. [ 255.229663][T12994] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 255.344256][T12978] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 255.483113][T13013] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3547'. [ 255.518132][T13014] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3549'. [ 255.601025][T13026] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3553'. [ 255.635837][T13031] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 255.776684][T13043] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3559'. [ 255.889720][T13062] syzkaller0: entered promiscuous mode [ 255.889748][T13062] syzkaller0: entered allmulticast mode [ 255.891903][T13062] tipc: Enabled bearer , priority 0 [ 255.912125][T13062] tipc: Resetting bearer [ 255.919688][T13061] tipc: Resetting bearer [ 255.920933][T13061] tipc: Disabling bearer [ 256.048801][T13087] ip_tables: iptables: counters copy to user failed while replacing table [ 256.791063][T13170] loop0: detected capacity change from 0 to 8192 [ 256.807144][T13170] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 257.916490][T13281] tipc: Enabled bearer , priority 0 [ 257.917059][T13281] syzkaller0: entered promiscuous mode [ 257.917079][T13281] syzkaller0: entered allmulticast mode [ 257.921422][T13281] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 257.951634][T13281] tipc: Resetting bearer [ 257.959440][T13280] tipc: Resetting bearer [ 257.960994][T13280] tipc: Disabling bearer [ 257.964423][T13283] loop1: detected capacity change from 0 to 8192 [ 257.969421][T13283] FAT-fs (loop1): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 258.233265][T13303] syzkaller0: entered promiscuous mode [ 258.233289][T13303] syzkaller0: entered allmulticast mode [ 258.241335][T13303] tipc: Enabled bearer , priority 0 [ 258.266157][T13303] tipc: Resetting bearer [ 258.281438][T13302] tipc: Resetting bearer [ 258.293948][T13302] tipc: Disabling bearer [ 258.400531][T13321] __nla_validate_parse: 13 callbacks suppressed [ 258.400553][T13321] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3666'. [ 258.432116][T13323] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3667'. [ 258.565922][T13335] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3673'. [ 258.693153][T13360] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3682'. [ 258.819440][T13378] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3690'. [ 258.878778][T13392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3695'. [ 259.073932][T13410] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3703'. [ 259.112329][T13420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3707'. [ 259.248236][T13438] loop5: detected capacity change from 0 to 8192 [ 259.259030][T13438] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 259.324357][T13451] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3719'. [ 259.325413][T13448] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3720'. [ 260.125218][T13547] syzkaller0: entered promiscuous mode [ 260.125246][T13547] syzkaller0: entered allmulticast mode [ 260.618692][T13606] loop1: detected capacity change from 0 to 1024 [ 260.636170][T13606] EXT4-fs: Ignoring removed oldalloc option [ 260.636281][T13606] EXT4-fs: Ignoring removed orlov option [ 260.718493][T13606] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 260.763836][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 260.876719][T13628] loop5: detected capacity change from 0 to 8192 [ 260.880019][T13628] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 260.949473][T13634] net_ratelimit: 4 callbacks suppressed [ 260.949511][T13634] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 261.190605][T13652] loop1: detected capacity change from 0 to 1024 [ 261.197569][T13652] EXT4-fs: Ignoring removed oldalloc option [ 261.197600][T13652] EXT4-fs: Ignoring removed orlov option [ 261.219259][T13652] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 261.305400][T10131] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 261.768983][T13705] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 262.123118][T13750] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 262.188943][T12388] ================================================================== [ 262.188989][T12388] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 262.189015][T12388] [ 262.189021][T12388] read-write to 0xffff888107345228 of 8 bytes by interrupt on cpu 0: [ 262.189042][T12388] __xa_clear_mark+0xf5/0x1e0 [ 262.189063][T12388] __folio_end_writeback+0xe7/0x530 [ 262.189088][T12388] folio_end_writeback_no_dropbehind+0x6d/0x200 [ 262.189121][T12388] folio_end_writeback+0x1c/0x70 [ 262.189151][T12388] mpage_write_end_io+0x245/0x4c0 [ 262.189176][T12388] bio_endio+0x390/0x570 [ 262.189197][T12388] blk_update_request+0x33a/0x710 [ 262.189233][T12388] blk_mq_end_request+0x26/0x50 [ 262.189254][T12388] lo_complete_rq+0x98/0x130 [ 262.189289][T12388] blk_done_softirq+0x77/0xb0 [ 262.189319][T12388] handle_softirqs+0x109/0x310 [ 262.189345][T12388] __irq_exit_rcu+0x40/0xf0 [ 262.189369][T12388] sysvec_apic_timer_interrupt+0x74/0x80 [ 262.189398][T12388] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 262.189425][T12388] kcsan_setup_watchpoint+0x42b/0x4a0 [ 262.189448][T12388] xas_load+0x2d6/0x430 [ 262.189481][T12388] filemap_get_entry+0x96/0x2e0 [ 262.189511][T12388] shmem_get_folio_gfp+0x1ee/0xd80 [ 262.189533][T12388] shmem_write_begin+0xfc/0x1f0 [ 262.189553][T12388] generic_perform_write+0x186/0x490 [ 262.189588][T12388] shmem_file_write_iter+0xc5/0xf0 [ 262.189613][T12388] lo_rw_aio+0x6a6/0x760 [ 262.189647][T12388] loop_process_work+0x569/0xac0 [ 262.189680][T12388] loop_rootcg_workfn+0x22/0x30 [ 262.189715][T12388] process_scheduled_works+0x53f/0xa10 [ 262.189748][T12388] worker_thread+0x569/0x750 [ 262.189783][T12388] kthread+0x223/0x270 [ 262.189807][T12388] ret_from_fork+0x146/0x330 [ 262.189855][T12388] ret_from_fork_asm+0x1a/0x30 [ 262.189891][T12388] [ 262.189899][T12388] read to 0xffff888107345228 of 8 bytes by task 12388 on cpu 1: [ 262.189919][T12388] xas_find_marked+0x211/0x650 [ 262.189940][T12388] filemap_get_folios_tag+0xf7/0x400 [ 262.189969][T12388] filemap_fdatawait_keep_errors+0x6c/0x190 [ 262.190003][T12388] sync_inodes_sb+0x424/0x4d0 [ 262.190046][T12388] sync_filesystem+0x108/0x190 [ 262.190077][T12388] generic_shutdown_super+0x4c/0x220 [ 262.190111][T12388] kill_block_super+0x2d/0xb0 [ 262.190133][T12388] deactivate_locked_super+0x73/0x180 [ 262.190167][T12388] deactivate_super+0x9a/0xb0 [ 262.190199][T12388] cleanup_mnt+0x143/0x1c0 [ 262.190228][T12388] __cleanup_mnt+0x19/0x20 [ 262.190260][T12388] task_work_run+0x133/0x190 [ 262.190287][T12388] exit_to_user_mode_loop+0x1e4/0x8c0 [ 262.190311][T12388] do_syscall_64+0x212/0x360 [ 262.190343][T12388] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 262.190368][T12388] [ 262.190373][T12388] value changed: 0xffffffffffffc000 -> 0xffffffffff800000 [ 262.190388][T12388] [ 262.190393][T12388] Reported by Kernel Concurrency Sanitizer on: [ 262.190405][T12388] CPU: 1 UID: 0 PID: 12388 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) [ 262.190435][T12388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 262.190449][T12388] ================================================================== [ 264.888865][T13744] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 264.888882][T13744] nci: nci_start_poll: failed to set local general bytes [ 264.889482][T13723] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 270.194919][ T32] bridge_slave_1: left allmulticast mode [ 270.194939][ T32] bridge_slave_1: left promiscuous mode [ 270.195095][ T32] bridge0: port 2(bridge_slave_1) entered disabled state [ 270.195763][ T32] bridge_slave_0: left allmulticast mode [ 270.195776][ T32] bridge_slave_0: left promiscuous mode [ 270.195867][ T32] bridge0: port 1(bridge_slave_0) entered disabled state [ 270.265173][ T32] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 270.266482][ T32] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 270.267435][ T32] bond0 (unregistering): Released all slaves [ 270.303683][ T32] tipc: Disabling bearer [ 270.303888][ T32] tipc: Left network mode [ 270.324214][ T32] hsr_slave_1: left promiscuous mode [ 270.324511][ T32] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 270.324523][ T32] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 270.324882][ T32] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 270.324898][ T32] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 270.327593][ T32] veth0_macvtap: left promiscuous mode [ 270.327629][ T32] veth1_vlan: left promiscuous mode [ 270.327655][ T32] veth0_vlan: left promiscuous mode [ 270.424656][ T32] team0 (unregistering): Port device team_slave_1 removed [ 270.427529][ T32] team0 (unregistering): Port device team_slave_0 removed [ 270.471428][ T29] audit: type=1400 audit(1792705041.926:735): avc: denied { write } for pid=13766 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.503397][ T29] audit: type=1400 audit(1792705041.966:736): avc: denied { write } for pid=13780 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.576180][ T29] audit: type=1400 audit(1792705042.036:737): avc: denied { write } for pid=13782 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.616511][ T29] audit: type=1400 audit(1792705042.076:738): avc: denied { write } for pid=13793 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.698046][ T29] audit: type=1400 audit(1792705042.156:739): avc: denied { write } for pid=13795 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.734577][ T29] audit: type=1400 audit(1792705042.196:740): avc: denied { write } for pid=13806 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.822213][ T29] audit: type=1400 audit(1792705042.276:741): avc: denied { write } for pid=13808 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.846344][ T29] audit: type=1400 audit(1792705042.286:742): avc: denied { write } for pid=13819 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.914143][ T29] audit: type=1400 audit(1792705042.376:743): avc: denied { write } for pid=13821 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 270.946265][ T29] audit: type=1400 audit(1792705042.386:744): avc: denied { write } for pid=13832 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1