last executing test programs: 3.266350844s ago: executing program 4 (id=298): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000340)={'ip_vti0\x00', &(0x7f0000000300)={'ip_vti0\x00', 0x0, 0x8000, 0x1, 0x5, 0x2, {{0x5, 0x4, 0x1, 0x5, 0x14, 0x66, 0x0, 0xe, 0x2f, 0x0, @loopback, @rand_addr=0x64010102}}}}) 3.259640703s ago: executing program 4 (id=300): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0xa82, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) syslog(0x1, 0x0, 0x0) io_setup(0x7, &(0x7f0000000280)=0x0) timer_create(0x1, &(0x7f0000000800)={0x0, 0x21}, &(0x7f0000000000)) timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$PROG_LOAD(0x5, 0x0, 0x0) io_submit(r1, 0x1, &(0x7f0000000b40)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x7, 0x8655, r0, 0x0}]) 3.197003671s ago: executing program 0 (id=305): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x401, 0x70bd25, 0x83, {0x0, 0x0, 0x0, 0x0, 0x1503}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x2}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) 3.196292291s ago: executing program 0 (id=308): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) gettid() timer_create(0x3, 0x0, &(0x7f0000bbdffc)) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 2.798297112s ago: executing program 1 (id=316): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001e00010000000000fedbdf2507000000", @ANYRES32, @ANYBLOB="000010"], 0x28}}, 0x0) 2.68665013s ago: executing program 1 (id=317): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001bc0)={{0x14}, [@NFT_MSG_NEWSET={0x44, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_POLICY={0x8, 0x8, 0x1, 0x0, 0x1}]}], {0x14}}, 0x6c}}, 0x0) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000002240)={&(0x7f0000002200)={0x14, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x20}}, 0x14}, 0x1, 0x0, 0x0, 0x20040011}, 0x24040808) 2.592011381s ago: executing program 1 (id=319): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) bind$802154_dgram(r0, &(0x7f0000000040)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0102}}}, 0x14) connect$802154_dgram(r0, &(0x7f0000000240)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) sendmmsg(r0, &(0x7f00000196c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010) 2.487007301s ago: executing program 1 (id=320): r0 = socket(0x23, 0x2, 0x1) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000640)={0x0}, 0x1, 0x0, 0x0, 0x8884}, 0x10000) 2.378687229s ago: executing program 1 (id=321): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) listen(r0, 0xfffffe00) 2.321804188s ago: executing program 1 (id=323): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000440)=@nat={'nat\x00', 0x62, 0x5, 0x3e0, 0x0, 0x178, 0xffffffff, 0x0, 0x2a0, 0x348, 0x348, 0xffffffff, 0x348, 0x348, 0x5, 0x0, {[{{@uncond, 0x0, 0x98, 0xd0, 0x0, {0x22e}, [@common=@unspec=@state={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x25, {0x3, @local, @broadcast}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @remote, @empty, @gre_key, @gre_key}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 'batadv0\x00', 'bond0\x00'}, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@addrtype={{0x30}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @multicast1, @multicast2, @gre_key, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @local, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) syz_usb_connect(0x2, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x250, 0xb5, 0x29, 0x91, 0x10, 0x4dd, 0x9032, 0x4346, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x16, 0x2, 0x60, 0x40}}]}}, 0x0) 2.265025667s ago: executing program 0 (id=325): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000140)='./file2\x00', 0x20048a, &(0x7f0000000300), 0x12, 0x538, &(0x7f0000000340)="$eJzs3U9sHFcZAPBvxn92k7pNCj0AKjSUQkBRdu1NG1W9UE4VQpUQPXJIjb2xrOxmo+y61CYSzpE7EpU4wYkzByQOSD1xR+IANyRUDkgFIlCMQGLRzM7GG9sbb2N7N/H+ftJo3syb3e+9Hc9747f2vACm1oWI2I6I+Yh4NyLOFfuTYok3e0t23P17d1Z27t1ZSaLbfefvSZ5/f+7OSgy8JvNM8Z7liPjOWxHfS/YE/X1Ee3PrxnKjUb9d7Kp2mreq7c2ty+vN5bX6Wv1mrXZ16eri61deqx1bXV9q/vLjMxHxm19//qPfbX/tB1mxFoq8rG7HFmhAr+pzD+JEdPOP+FsnEWwCZiJitvj5+cQe60UcpzQiPhURL2fX/3x2Pmf3HfPwafr6GEsHAJyEbvdccUfa3wYATrs0HwNL0koxFrAQaVqp9MbwXoizaaPV7ly63tq4udobKzsfc+n19UZ9sRgrPB9zyfX12fpSnu5vN+q1PdtXIuL5iPhx6Uy+XVlpNVYneeMDAFPsmT39/79Kvf4fADjlyrvJ0iTLAQCMT3nSBQAAxk7/DwDTR/8PANNH/w8A00f/DwDTR/8PAFPl22+/nS3dneL516vvbW7caL13ebXevlFpbqxUVlq3b1XWWq21/Jk9zcPer9Fq3Vp6NTber3bq7U61vbl1rdnauNm5lj/X+1p9biy1AgAe5fmXPvxjEhHbb5zJlxh43v+hffWLJ1064CSlky4AMDEzky4AMDH7Z/sCpsXBv+P/+T9jLwgwdv/rdrsxMHdvRNx9kBp4GOjQPxH6YKQwqXlD4clz8bNHGP8HnmrG/2F6Pd74v3t5OA2M/8P06nYTc/4DwJQxxg8kQ/b3vx8Y/P5/sTuwMdr3/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAqLeRLklaKuT4WIk0rlYhnI+J8zCXX1xv1xYh4LiL+UJorZdtLEWHeIAB4mqV/TYr5vy6ee2Vhb+586d+lfB0R3//pOz95f7nTub0UMZ/848H+zgfF/tokyg8AHKbfT/f78b779+6s9Jdxlufjb/QmF83i7hRLL2c2ZvN1OR9rOPvPpNjuye5XZo4h/vbdiPjMQfVP8rGR88XMp3vjZ7GfHWv89KH4aZ7XW2efxaePoSwwbT7M2p83D7r+0riQrw++/st5C3V0/fZvZ1/7lz5o/2aGtH8XRo3x6m+/uW9n91wv727E52YjdvpvPtD+9OMnQ+K/MmL8P734hZeH5XV/FnExDqp/8lCsaqd5q9re3Lq83lxeq6/Vb9ZqV5euLr5+5bVaNR+jrvZHqvf72xuXnhsWP6v/2SHxy4fU/8sj1v/n/333u198RPyvfmk3/g9j9/y/8Ij4WZ/4lRHjL5/9VXlYXhZ/dUj9Dzv/l0aM/9FftlZHPBQAGIP25taN5UajfvvoifIjj0mPI8QIiSRi+4RD7CZKv/jRW4cfXBpbeR4zEcOyZp6UEp6aROnJKMYIiUm3TMBJ273oJ10SAAAAAAAAAAAAAABgmKP8h9B8RIxy8KTrCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOn1/wAAAP//K2bVsw==") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuacct.usage_percpu_user\x00', 0x26e1, 0x0) 2.218655368s ago: executing program 4 (id=326): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0xb4, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x8c, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x24}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x89}]}}}, {0x54, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x14}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_XOR={0x4}, @NFTA_BITWISE_MASK={0x24, 0x4, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x15, 0x1, "ede64e4d0b94ea064422b4f3274423b4b5"}]}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x128}}, 0x0) 2.218379698s ago: executing program 4 (id=328): timer_create(0x1, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x94eb2000) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x1}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mknod$loop(&(0x7f00000009c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x40, 0x1) 1.911871388s ago: executing program 0 (id=330): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x2e}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000080)=0x20, 0x4) 791.421307ms ago: executing program 4 (id=335): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000280)='scalable', 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0x801, 0xfffffffd, 0x8000000, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20421}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x8024) sendto$inet(r0, &(0x7f0000000180)="8995b3", 0x3, 0x4c041, 0x0, 0x0) 606.923701ms ago: executing program 4 (id=338): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000000000)=0x5, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x1, @remote}, 0x10) socket(0x10, 0x3, 0x0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10}}]}}, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$sierra_net(r1, 0x0, &(0x7f0000000380)={0x1c, &(0x7f00000002c0)={0x40, 0x8, 0x4, "bf718993"}, 0x0, 0x0}) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x0, &(0x7f0000000140)}, 0x10) r3 = socket$inet6(0xa, 0x3, 0x6) sendto$inet6(r3, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x3, @mcast2={0xff, 0x5}, 0xfffffffc}, 0x1c) 490.433537ms ago: executing program 0 (id=343): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x41d, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x31}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x8}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2, 0x84}}}, 0xa4}}, 0x0) 490.323027ms ago: executing program 0 (id=344): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x6c, 0x2c, 0x6f14cf9ac61f9c9b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0xfffa}, {}, {0x1c, 0xfff9}}, [@filter_kind_options=@f_flower={{0xb}, {0x3c, 0x2, [@TCA_FLOWER_ACT={0x38, 0x3, [@m_connmark={0x34, 0x1, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x6c}}, 0x24000000) socket$netlink(0x10, 0x3, 0x0) close(r2) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0x4ffe6, 0x8864000000000000) 443.906598ms ago: executing program 2 (id=348): syz_mount_image$ext4(&(0x7f0000000b80)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x200000, &(0x7f0000000040)={[{@grpquota}]}, 0x1, 0xbac, &(0x7f00000017c0)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtKxk5nGdGaOSX8/eHPe97wn8zxPTmfOe2BOA3hqTWc/0ohDEXE2iZis708jYqjaG4nYrB13/+7l+awlUam8/VsSSUTcu3t5vvFaSX07Xh+MRMTN15L490etcVfXN5bnyuXSSn18dO38paOr6xuvLJ2fO1c6V7pwYvbVE7MnZ2e7WOvtS+998cwPbzx/9frHM29+fuC7JE7HRH2uuY5umY7prb9Js0JEzHU7WE4G6vU015kUckwIAICO0qY13H9jMgbi4eJtMr79MdfkAAAAgK6oDERUAAAAgH0ucf8PAAAA+1zjewD37l6eb7R8v5HQX3fORMRUrf7G8821mUJsVrcjMRgRY78n0fxYa1L7tSc2nUX6+vtS1qJHzyF3snklIv6/3flPqvVPVZ/ibq0/jYiZLsSffmS8l+o/3YX4edcPwNPpxpnahaz1+pdurX9im+tfYZtr127kff1rrP/ut6z/HtY/0Gb999YOYxx+8NLNdnPN6793P/l5IYufbZ+oqL/hzpWIw4Xt6k+26k/a1H92hzHG529fazeX1Z/V22j9rr9yPeJIdTXXWn9D0un/Jzq6uFQuzdR+bvP66yc7x28+/1nL4jfuBfohO/9jsbvzf2mHMab+9+uhdnOPrz/9ZSh5p9obqu/5cG5tbeVYxFDyeuv+451zaRzTeI2s/hef6/z+367+7DNhs/53yP71XKlvs/HVR2KOHzn+1e7r762s/oVdnv9Pdxjjy2+uvd9uLu/6AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANgb0oiYiCQtbvXTtFiMGI+I/8RYWr64uvby4sUPLixkcxFTMZguLpVLMxExWRsn2fhYtf9wfPyR8WxEHIyIzyZHq+Pi/MXyQt7FAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsGU8IiYiSYsRkUbEH5NpWizmnRUAAADQdVN5JwAAAAD0nPt/AAAA2P9a7v8LfxmN9DMXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9qWDz964lUTE5qnRassM1ecGc80M6LV0Z4eN9ToPoP8G8k4AyE2hqV+pVCo5pgL0mXt8IHnM/EjbmeGu5wIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAP9cLh27cSiJi89RotWWG6nODuWYG9FqadwJAbgY6TSaP3QHsYYW8EwBy4x4fqK3sH1RqWudH2v7m8BNHBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGDvmKi2JC1GRFrtp2mxGPGviJiKwWRxqVyaiYgDEfHT5OBwNj6Wd9IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB03er6xvJcuVxa0dHR6WJnNPoWa7T+Zm5zzHD7qQ6dnD+YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADIxer6xvJcuVxaWc07EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBvq+sby3Plcmmlh528awQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID9/BgAA///GyAmy") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) unshare(0x20000400) fdatasync(r0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) 278.665536ms ago: executing program 2 (id=349): madvise(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x12) 249.21019ms ago: executing program 2 (id=350): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001080)=@newlink={0x54, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x3fc03, 0x25f14}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0xfeffffffffffffff, 0xfffffffffffffffe}}]}}}, @IFLA_MTU={0x8, 0x4, 0x1000}]}, 0x54}, 0x1, 0x0, 0x0, 0x14044080}, 0x0) 186.549537ms ago: executing program 2 (id=353): unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfdffa000) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r0, 0x29, 0x40, &(0x7f0000000500)={'nat\x00', 0x0, [0x7f, 0x7, 0x20000004, 0x3, 0x100000c]}, &(0x7f0000000040)=0x54) 86.292558ms ago: executing program 3 (id=359): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r1) sendmsg$IEEE802154_LLSEC_ADD_DEV(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x1c, r2, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x4, 0x700000000000000}, 0x0) 78.918056ms ago: executing program 3 (id=360): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x201c802, &(0x7f00000001c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="83d786cc1b88fa3c682d7897b3ef743c826f001657a3417ec9508a1502e77c9c623736aca145483db4f7d5dbca70f74df8d39e6bdf2d254800678cd1c4a5104c3b094da122969af49928ed026b436c71e168c7bfee0a51c13736bc0a204a4ec8e7cd57324c359fabe3b5c1cc842e"], 0x1, 0x307, &(0x7f0000000a00)="$eJzs3U1rE1sYwPFnkqZ56e1tF5fL5XIvHHrhci/SoQ24c2GRFsWA0jaCFYSpnWrINClJKETEdiG4de2iC5ciiODOjYjbbvwEat11051dBI9MZibNyxhTJX3R/2/RPJ1znjmnc05aeto5s3PmwUp+OSEiEhWRPS2eUYnUD7g25P/Xm+/+nnv1i/e5UjNT85NppSIicu3Ok7GXlaErz399EZet0es7u+kPW3/Ni3yavyURlSurgtbKUovFYsVwk5dy5byp1GXHtsq2yhXKdqnil1uLjq2WneLqalVZhaXh1GrJLpeVVaiqvF1VlaKqlKrKumnlCso0TTWcEtQHKxDpKDO6JWYf72ktu1prHd8QrXVI7Y0giPmv8e/rLI6TtvHvWrdjckT72TMchj090PP448fjvf/fP+xt/PX6IXULh2Tu6sLFqUxmelaphMjK/bXsWtZ79crfDklOHLFlc/bUQk3cOeITw/04cyEzPaHqRuXflXU/f30t6/1wmFqu528HSU35EuRPevmqNT8mqf18W9IyIr9JaH46yJdIU/6g/PdPU74pI/LmhhTFkSV3Jjfl351U6tylTFv7yXo9AAAAAAAAAABOIlM17K/fG40/9SZNM17/j49GedI97NbzKjTW1ydkRGrh6/MToev7A/LnwBF+4QAAAAAA/ETK1dt5y3HsUn+C6KNklyZiIuIGIvfG3M50PeHvfo97a31QRDqLot2baAmSp732ns76HZN+XqggSByghyFBcLNG3qo9C4qSElY5cqAJMD4YeuUTJUP6On9aAumlsiS+bWLHU71OrfbAqAVH/gito42vn0dbTsw7Io0R7J519kBvhy8GifYLNb7tndfp/F5xPgg+Npb4AAAAAJwgTb84AQAAAAAAAAAAAAAAAAAAAAAAAAAAAACAI9K4/9/wn/Tfy+Zhwb79rUXiPyK+c0u29ufEs+8/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgGPocwAAAP//N1u2ag==") 66.703404ms ago: executing program 3 (id=361): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f00000000c0)={[{@noload}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1}}, {@bh}, {@noload}, {@data_err_ignore}, {@auto_da_alloc_val={'auto_da_alloc', 0x3d, 0x8f53}}]}, 0xff, 0x44d, &(0x7f0000000900)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpsa107hx6rb+fKRNZrzjzHx3d+zZGTsBDKyx7EcSsTkifouIkUb2vwXGGr+uXTk389eVczNJ1Otv/Jnk5a5eOTdTFi2ft6mRqdeL/Lo29V54O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TdbezcX+5jh6ZaxxdNt6qteV9dmWpnRS7WND6EolIrLTNZT3/5GoxIalfSPx8qd9bRywpur1er3d+3PhfB24hyXR7xYA/VG+0Wf3v+V2m4Yed4TLhyPeP9iI/1qxNfZUIy3KDLXc3/bSWEQcOf/3l9kWazQPAQDQ7LvDEfFcu/FfGg82lftfsYYyGhH/j4j7IuL+iNgaEQ9E5GUfioiHu6y/dYXkxvFPeumWAluhbPz3QrG2tTT++6eex18YrRS5LXn8Q8nR47W5PcUx2R1D67L85DJ1fP/Sr5932tc8/su2rP5yLNiQXqq2TNDNTi9OrzLsJZc/idhebYk/l0S5jJNExLaI2N7VX75+h3H8ma93dCp18/iX0YN1pvpXEU83zv/5aIm/lHRcn5w8eGBq/8T6qM3tmSivihv9/MuF1zvVv6r4eyA7/xtbr//cUvyjyfqIhTNnT+TrtQvd13Hh98863tPc6vU/nLyZp4eLxz6cXlw8PRkxnLx64+NT159b5svyWfy7d7WLP81f48oj8UhEZBfxzoh4NCIeK9r+eEQ8ERG7lon/xxeffLf7+JeZle+hLP7Zm53/aD7/3ScqJ374tvv4S9n535endhePrOT1b6UNXM2xAwAAgLtFmn8GPknHl9JpOj7e+Az/1tiY1uYXFp89Ov/BqdnGZ+VHYygtZ7pGmuZDJ4u54TI/1ZLfW8wbf1HZkOfHZ+Zrs/0OHgbcpg79P/NHpd+tA9ac72vB4NL/YXDp/zC49H8YXPo/DK52/f/jPrQDuP28/8Pg0v9hcOn/MLj0fxhIHb8bn67qK/8S93wi0u6fVY07pPF3U6K64n9mcYuJdW139fuVCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoDf+DQAA//9X4u4v") unshare(0x22020600) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fadvise64(r0, 0x2, 0x5, 0x300) 14.303634ms ago: executing program 2 (id=362): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e84, 0xf, @mcast2, 0x14}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x44004) 14.092454ms ago: executing program 2 (id=363): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x101000, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x2}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x4000000, 0x6, 0x7, 0x9}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}}, 0x20000000) 14.016643ms ago: executing program 3 (id=364): r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x28, r0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}]}]}, 0x28}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) 13.841303ms ago: executing program 3 (id=365): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000a40)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffe00, {0x0, 0x0, 0x0, r7, {0x8}, {0xffff}, {0xfff2, 0xffe1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x0, 0x6, 0x80000000, 0xb, 0x4, 0x2, 0xfffffff6, 0x5, 0x0, 0x8, 0xa, 0x11, 0x1f, 0x5, 0xb, 0x40bf}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 0s ago: executing program 3 (id=366): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@mpls_getroute={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0x1c}}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.52' (ED25519) to the list of known hosts. [ 27.971969][ T24] audit: type=1400 audit(1772258728.750:64): avc: denied { mounton } for pid=267 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.975206][ T267] cgroup: Unknown subsys name 'net' [ 27.994740][ T24] audit: type=1400 audit(1772258728.750:65): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.021948][ T24] audit: type=1400 audit(1772258728.780:66): avc: denied { unmount } for pid=267 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.022351][ T267] cgroup: Unknown subsys name 'devices' [ 28.228050][ T267] cgroup: Unknown subsys name 'hugetlb' [ 28.233651][ T267] cgroup: Unknown subsys name 'rlimit' [ 28.434135][ T24] audit: type=1400 audit(1772258729.210:67): avc: denied { setattr } for pid=267 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.457446][ T24] audit: type=1400 audit(1772258729.210:68): avc: denied { mounton } for pid=267 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.482173][ T24] audit: type=1400 audit(1772258729.210:69): avc: denied { mount } for pid=267 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 28.509857][ T269] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 28.518863][ T24] audit: type=1400 audit(1772258729.300:70): avc: denied { relabelto } for pid=269 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.544316][ T24] audit: type=1400 audit(1772258729.300:71): avc: denied { write } for pid=269 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.579938][ T24] audit: type=1400 audit(1772258729.360:72): avc: denied { read } for pid=267 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.605507][ T24] audit: type=1400 audit(1772258729.360:73): avc: denied { open } for pid=267 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.605593][ T267] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.164237][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.171362][ T275] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.178891][ T275] device bridge_slave_0 entered promiscuous mode [ 29.186845][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.193887][ T275] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.201531][ T275] device bridge_slave_1 entered promiscuous mode [ 29.251502][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.258606][ T276] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.266079][ T276] device bridge_slave_0 entered promiscuous mode [ 29.277053][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.284102][ T278] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.291501][ T278] device bridge_slave_0 entered promiscuous mode [ 29.298399][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.305442][ T278] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.313043][ T278] device bridge_slave_1 entered promiscuous mode [ 29.319712][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.326908][ T276] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.334296][ T276] device bridge_slave_1 entered promiscuous mode [ 29.406519][ T277] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.413585][ T277] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.421061][ T277] device bridge_slave_0 entered promiscuous mode [ 29.431008][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.438094][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.445409][ T279] device bridge_slave_0 entered promiscuous mode [ 29.452349][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.459419][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.466869][ T279] device bridge_slave_1 entered promiscuous mode [ 29.476301][ T277] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.483344][ T277] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.490837][ T277] device bridge_slave_1 entered promiscuous mode [ 29.614140][ T278] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.621220][ T278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.628538][ T278] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.635690][ T278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.647035][ T275] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.654086][ T275] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.661561][ T275] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.668642][ T275] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.686945][ T276] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.694002][ T276] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.701295][ T276] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.708341][ T276] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.750847][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.757933][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.765293][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.772369][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.787048][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.794527][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.801976][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.809824][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.817091][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.824245][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.832031][ T48] bridge0: port 1(bridge_slave_0) entered disabled state [ 29.839230][ T48] bridge0: port 2(bridge_slave_1) entered disabled state [ 29.847090][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 29.854464][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.873139][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.880618][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.888860][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.895904][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.918231][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 29.926467][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 29.934625][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 29.941702][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 29.949916][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.958684][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 29.965732][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 29.973102][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 29.981154][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 29.989911][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 29.998173][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.005198][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.025427][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.033629][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.040722][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.048501][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.056753][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.063784][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.086749][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.095403][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.104044][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.111112][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.118907][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.127136][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.134153][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.141528][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.149512][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.157589][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.165466][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.174032][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 30.188624][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 30.196194][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 30.213435][ T275] device veth0_vlan entered promiscuous mode [ 30.225370][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 30.233814][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 30.242293][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 30.249352][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 30.257082][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 30.265466][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 30.273724][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 30.280758][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 30.288414][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.296671][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.304887][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.312818][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.320840][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.328890][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.336951][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.344358][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.354296][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.362684][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.373916][ T275] device veth1_macvtap entered promiscuous mode [ 30.385329][ T278] device veth0_vlan entered promiscuous mode [ 30.400041][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.408221][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.416797][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.424336][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 30.433280][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.441298][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.449270][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.457375][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.465728][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.474083][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 30.482335][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 30.490609][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 30.498809][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 30.506949][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.514396][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.528147][ T276] device veth0_vlan entered promiscuous mode [ 30.538362][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.546613][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.554621][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.562978][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.571179][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.578785][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.592683][ T278] device veth1_macvtap entered promiscuous mode [ 30.603824][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.611652][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.620078][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.629091][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.637354][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.645581][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.654118][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.662480][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.670324][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.678419][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.686046][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.704382][ T277] device veth0_vlan entered promiscuous mode [ 30.716771][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 30.718296][ T275] request_module fs-gadgetfs succeeded, but still no fs? [ 30.726500][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 30.741659][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 30.749700][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 30.758129][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.766533][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.774855][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.783122][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.791500][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.799920][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.808504][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 30.816057][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 30.824051][ T276] device veth1_macvtap entered promiscuous mode [ 30.831397][ T279] device veth0_vlan entered promiscuous mode [ 30.841024][ T275] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 30.851890][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 30.859638][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.872013][ T279] device veth1_macvtap entered promiscuous mode [ 30.888347][ T277] device veth1_macvtap entered promiscuous mode [ 30.902535][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 30.912823][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 30.921757][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.930923][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 30.939675][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 30.949324][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 30.980598][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 30.995520][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.008262][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 31.023763][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 31.036971][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.045342][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.060379][ T307] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7'. [ 31.070260][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 31.080507][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 31.191012][ T309] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,,errors=continue [ 31.223110][ T312] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,errors=remount-ro, [ 31.237736][ T312] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.251961][ T319] ====================================================== [ 31.251961][ T319] WARNING: the mand mount option is being deprecated and [ 31.251961][ T319] will be removed in v5.15! [ 31.251961][ T319] ====================================================== [ 31.293493][ T319] EXT4-fs (loop0): Ignoring removed bh option [ 31.303866][ T319] EXT4-fs (loop0): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 31.317392][ T319] EXT4-fs warning (device loop0): read_mmp_block:115: Error -117 while reading MMP block 73 [ 31.358782][ T326] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 31.445451][ C0] IPv4: Oversized IP packet from 127.0.0.1 [ 31.578894][ T339] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue [ 31.589611][ T339] ext4 filesystem being mounted at /2/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.685065][ T356] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 31.694779][ T356] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 31.855743][ T20] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 31.935047][ T367] netlink: 12 bytes leftover after parsing attributes in process `syz.3.24'. [ 31.982355][ T370] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 32.095778][ T20] usb 3-1: Using ep0 maxpacket: 32 [ 32.265762][ T20] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 32.403204][ T20] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 32.440577][ T383] netlink: 27 bytes leftover after parsing attributes in process `syz.0.30'. [ 32.995911][ T20] usb 3-1: New USB device found, idVendor=2a39, idProduct=3fa0, bcdDevice=4b.70 [ 33.098771][ T24] kauditd_printk_skb: 69 callbacks suppressed [ 33.098793][ T24] audit: type=1400 audit(1772258733.880:143): avc: denied { read write } for pid=391 comm="syz.3.32" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 33.155972][ T388] EXT4-fs (loop4): Test dummy encryption mode enabled [ 33.162939][ T388] EXT4-fs (loop4): Ignoring removed orlov option [ 33.185828][ T20] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 33.217607][ T388] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,bsddf,nodioread_nolock,test_dummy_encryption,lazytime,nodelalloc,minixdf,orlov,,errors=continue [ 33.419526][ T20] usb 3-1: Product: syz [ 33.441876][ T20] usb 3-1: Manufacturer: syz [ 33.467067][ T20] usb 3-1: SerialNumber: syz [ 33.489280][ T24] audit: type=1400 audit(1772258733.910:144): avc: denied { open } for pid=391 comm="syz.3.32" path="/dev/binderfs/binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 33.526055][ T392] FAT-fs (loop3): Directory bread(block 64) failed [ 33.532624][ T392] FAT-fs (loop3): Directory bread(block 65) failed [ 33.539600][ T392] FAT-fs (loop3): Directory bread(block 66) failed [ 33.546142][ T392] FAT-fs (loop3): Directory bread(block 67) failed [ 33.552675][ T392] FAT-fs (loop3): Directory bread(block 68) failed [ 33.559348][ T392] FAT-fs (loop3): Directory bread(block 69) failed [ 33.566198][ T392] FAT-fs (loop3): Directory bread(block 70) failed [ 33.572738][ T392] FAT-fs (loop3): Directory bread(block 71) failed [ 33.579509][ T392] FAT-fs (loop3): Directory bread(block 72) failed [ 33.586069][ T392] FAT-fs (loop3): Directory bread(block 73) failed [ 33.655993][ T20] usb 3-1: config 0 descriptor?? [ 33.681764][ T24] audit: type=1400 audit(1772258733.990:145): avc: denied { getopt } for pid=391 comm="syz.3.32" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 33.701460][ T24] audit: type=1400 audit(1772258734.020:146): avc: denied { getopt } for pid=379 comm="syz.4.27" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 33.850853][ T24] audit: type=1400 audit(1772258734.630:147): avc: denied { read } for pid=398 comm="syz.4.33" name="msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.146333][ T20] usb 3-1: USB disconnect, device number 2 [ 34.218310][ T24] audit: type=1400 audit(1772258734.630:148): avc: denied { open } for pid=398 comm="syz.4.33" path="/dev/cpu/0/msr" dev="devtmpfs" ino=85 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 34.389766][ T24] audit: type=1400 audit(1772258734.650:149): avc: denied { prog_load } for pid=398 comm="syz.4.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 34.461265][ T24] audit: type=1400 audit(1772258734.650:150): avc: denied { bpf } for pid=398 comm="syz.4.33" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 34.481840][ T24] audit: type=1400 audit(1772258734.840:151): avc: denied { perfmon } for pid=398 comm="syz.4.33" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 34.502655][ T24] audit: type=1400 audit(1772258734.840:152): avc: denied { prog_run } for pid=398 comm="syz.4.33" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 34.578118][ T412] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 34.725899][ T289] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 34.818491][ T419] EXT4-fs error (device loop2): ext4_acquire_dquot:6225: comm syz.2.39: Failed to acquire dquot type 0 [ 34.830266][ T419] EXT4-fs (loop2): 1 truncate cleaned up [ 34.836078][ T419] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 34.847992][ T419] EXT4-fs error (device loop2): ext4_acquire_dquot:6225: comm syz.2.39: Failed to acquire dquot type 0 [ 34.936650][ T426] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 34.958045][ T426] EXT4-fs error (device loop2): ext4_acquire_dquot:6225: comm syz.2.40: Failed to acquire dquot type 1 [ 34.969225][ T303] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 34.971229][ T426] EXT4-fs error (device loop2) in ext4_do_update_inode:5355: error 27 [ 34.985149][ T426] EXT4-fs error (device loop2): ext4_dirty_inode:6162: inode #16: comm syz.2.40: mark_inode_dirty error [ 34.996485][ T289] usb 2-1: device descriptor read/64, error -71 [ 34.997038][ T426] EXT4-fs error (device loop2) in ext4_do_update_inode:5355: error 27 [ 35.011426][ T426] EXT4-fs error (device loop2): __ext4_ext_dirty:182: inode #16: comm syz.2.40: mark_inode_dirty error [ 35.022741][ T426] EXT4-fs error (device loop2) in ext4_do_update_inode:5355: error 27 [ 35.031258][ T426] EXT4-fs error (device loop2) in ext4_orphan_del:3292: error 27 [ 35.039363][ T426] EXT4-fs error (device loop2) in ext4_do_update_inode:5355: error 27 [ 35.047756][ T426] EXT4-fs error (device loop2): ext4_truncate:4396: inode #16: comm syz.2.40: mark_inode_dirty error [ 35.059041][ T426] EXT4-fs error (device loop2) in ext4_orphan_cleanup:3108: error 27 [ 35.067735][ T426] EXT4-fs (loop2): 1 truncate cleaned up [ 35.073441][ T426] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue [ 35.082470][ T426] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 35.215763][ T303] usb 4-1: Using ep0 maxpacket: 8 [ 35.385700][ T289] usb 2-1: device descriptor read/64, error -71 [ 35.415783][ T303] usb 4-1: config 1 interface 0 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 16 [ 35.425835][ T303] usb 4-1: config 1 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 32 [ 35.435950][ T303] usb 4-1: config 1 interface 0 has no altsetting 0 [ 35.595892][ T303] usb 4-1: New USB device found, idVendor=04b8, idProduct=0202, bcdDevice= 0.40 [ 35.605074][ T303] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 35.613141][ T303] usb 4-1: Product: 픨繿煮퇪笽ᙸ訌尾잊䱟ᢲ [ 35.620304][ T303] usb 4-1: Manufacturer: ꡸軌徜̛㽖뾓䕠㖉磢夶ﮖ挓｀ﾯੌ탆缮闼퀫ɸ鱷勿ꋣ겥씭㶌ꕂ쵟췖魕≙쏸埄繱荝돗退햳黬ෲ㣩햡貚꼳㗲풸拐積ݕꋔፌ䏽䡫ᳯ䳒⩗ۢ鏺䗗韨磹ࠇᓁ騉ꑈ䣷ᣤ퐪ズ㌁뀂䯌ﶝ㽬䩻⁜ [ 35.645488][ T303] usb 4-1: SerialNumber: أ好쟤Ȳ휢宫ꑌ濞⮧렚ꁃ㤥 [ 35.655997][ T289] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 35.685713][ T416] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 35.694339][ T416] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 35.926021][ T289] usb 2-1: device descriptor read/64, error -71 [ 36.087288][ T459] EXT4-fs (loop2): test_dummy_encryption requires encrypt feature [ 36.186415][ T303] usblp 4-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 2 proto 2 vid 0x04B8 pid 0x0202 [ 36.228425][ T303] usb 4-1: USB disconnect, device number 2 [ 36.244032][ T303] usblp0: removed [ 36.326075][ T289] usb 2-1: device descriptor read/64, error -71 [ 36.446679][ T289] usb usb2-port1: attempt power cycle [ 36.717813][ T474] netlink: 28 bytes leftover after parsing attributes in process `syz.3.57'. [ 36.739465][ T471] EXT4-fs (loop4): Ignoring removed orlov option [ 36.748020][ T476] devtmpfs: Bad value for 'nr_inodes' [ 36.759021][ T471] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 36.772557][ T471] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 36.780633][ T471] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=c040e118, mo2=0002] [ 36.789527][ T471] EXT4-fs (loop4): orphan cleanup on readonly fs [ 36.796053][ T471] EXT4-fs warning (device loop4): ext4_enable_quotas:6490: Failed to enable quota tracking (type=1, err=-22, ino=4). Please run e2fsck to fix. [ 36.810895][ T471] EXT4-fs (loop4): Cannot turn on quotas: error -22 [ 36.817873][ T471] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.58: bg 0: block 40: padding at end of block bitmap is not set [ 36.839095][ T471] EXT4-fs error (device loop4) in ext4_mb_clear_bb:5661: Corrupt filesystem [ 36.848999][ T471] EXT4-fs (loop4): 1 truncate cleaned up [ 36.854739][ T471] EXT4-fs (loop4): mounted filesystem without journal. Opts: orlov,noload,noblock_validity,norecovery,i_version,nomblk_io_submit,,errors=continue [ 36.875692][ T289] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 36.883494][ T471] fscrypt (loop4, inode 16): Error -61 getting encryption context [ 37.037938][ T499] netlink: 12 bytes leftover after parsing attributes in process `syz.3.70'. [ 37.084370][ T495] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000 [ 37.086127][ T289] usb 2-1: device descriptor read/8, error -71 [ 37.117377][ T503] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 37.127580][ T503] ext4 filesystem being mounted at /24/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.140347][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 3: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=60, inode=113, rec_len=0, size=2048 fake=0 [ 37.166438][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 12: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5066064, rec_len=1, size=2048 fake=0 [ 37.202898][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 13: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653246737, rec_len=1, size=2048 fake=0 [ 37.224103][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 14: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 37.244427][ T510] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 37.255898][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 15: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=5, rec_len=0, size=2048 fake=0 [ 37.257760][ T510] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 1046) [ 37.277470][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 16: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3653245223, rec_len=1, size=2048 fake=0 [ 37.306555][ T503] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 17: comm syz.4.72: path /24/file0: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=3, rec_len=0, size=2048 fake=0 [ 37.322485][ T510] FAT-fs (loop2): Filesystem has been set read-only [ 37.328357][ T503] EXT4-fs error (device loop4): ext4_map_blocks:630: inode #2: block 18: comm syz.4.72: lblock 23 mapped to illegal pblock 18 (length 1) [ 37.397075][ T517] EXT4-fs (loop3): mounted filesystem without journal. Opts: nouid32,nodioread_nolock,barrier=0x0000000000000000,delalloc,journal_dev=0x0000000000000009,bsdgroups,,errors=continue [ 37.415075][ T517] ext4 filesystem being mounted at /22/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 37.435743][ T289] usb 2-1: device descriptor read/8, error -71 [ 37.531459][ T517] EXT4-fs error (device loop3): ext4_map_blocks:740: inode #15: block 3: comm syz.3.76: lblock 3 mapped to illegal pblock 3 (length 3) [ 37.557942][ T517] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 3 with max blocks 3 with error 117 [ 37.571392][ T517] EXT4-fs (loop3): This should not happen!! Data will be lost [ 37.571392][ T517] [ 37.597546][ T517] EXT4-fs error (device loop3): ext4_ext_remove_space:2924: inode #15: comm syz.3.76: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 37.616042][ T517] EXT4-fs error (device loop3) in ext4_setattr:5726: Corrupt filesystem [ 37.628729][ T524] EXT4-fs (loop1): Cannot turn on journaled quota: type 0: error -2 [ 37.638983][ T524] EXT4-fs (loop1): Cannot turn on journaled quota: type 1: error -2 [ 37.649280][ T524] EXT4-fs (loop1): 1 truncate cleaned up [ 37.654961][ T524] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsold,grpjquota="journal_checksum,noload,nombcache,usrjquota="dax,errors=remount-ro,barrier, [ 37.707218][ T524] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #2: block 4: comm syz.1.79: lblock 0 mapped to illegal pblock 4 (length 1) [ 37.722377][ T524] EXT4-fs (loop1): Remounting filesystem read-only [ 37.733596][ T524] EXT4-fs error (device loop1): ext4_map_blocks:630: inode #2: block 4: comm syz.1.79: lblock 0 mapped to illegal pblock 4 (length 1) [ 37.753194][ T536] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 37.779007][ T536] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2797: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 37.792242][ T536] EXT4-fs (loop4): 1 truncate cleaned up [ 37.797981][ T536] EXT4-fs (loop4): mounted filesystem without journal. Opts: init_itable=0x0000000000000000,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,jqfmt=vfsold,minixdf,quota,,errors=continue [ 37.866712][ T550] EXT4-fs (loop2): Unrecognized mount option "mb_optimize_scan=0x0000000000000001" or missing value [ 37.946808][ T563] cgroup: syz.1.93 (563) created nested cgroup for controller "memory" which has incomplete hierarchy support. Nested cgroups may change behavior in the future. [ 37.975095][ T563] cgroup: "memory" requires setting use_hierarchy to 1 on the root [ 38.004063][ T563] tipc: Started in network mode [ 38.020484][ T563] tipc: Own node identity ea5b0f66d891, cluster identity 4711 [ 38.029305][ T563] tipc: Enabled bearer , priority 0 [ 38.099396][ T563] device syzkaller0 entered promiscuous mode [ 38.110797][ T560] tipc: Resetting bearer [ 38.122132][ T560] tipc: Disabling bearer [ 38.218308][ T581] FAT-fs (loop3): Directory bread(block 64) failed [ 38.236760][ T581] FAT-fs (loop3): Directory bread(block 65) failed [ 38.243560][ T581] FAT-fs (loop3): Directory bread(block 66) failed [ 38.250163][ T581] FAT-fs (loop3): Directory bread(block 67) failed [ 38.256977][ T581] FAT-fs (loop3): Directory bread(block 68) failed [ 38.268030][ T581] FAT-fs (loop3): Directory bread(block 69) failed [ 38.274588][ T581] FAT-fs (loop3): Directory bread(block 70) failed [ 38.303537][ T581] FAT-fs (loop3): Directory bread(block 71) failed [ 38.308716][ T596] device bridge_slave_0 left promiscuous mode [ 38.322278][ T581] FAT-fs (loop3): Directory bread(block 72) failed [ 38.330629][ T581] FAT-fs (loop3): Directory bread(block 73) failed [ 38.337287][ T596] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.350292][ T596] device bridge_slave_1 left promiscuous mode [ 38.362844][ T596] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.450180][ T24] kauditd_printk_skb: 36 callbacks suppressed [ 38.450201][ T24] audit: type=1400 audit(1772258739.230:182): avc: denied { block_suspend } for pid=604 comm="syz.1.113" capability=36 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 38.520461][ T24] audit: type=1400 audit(1772258739.290:183): avc: denied { getopt } for pid=613 comm="syz.4.115" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 38.540991][ T612] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 38.554479][ T24] audit: type=1400 audit(1772258739.330:184): avc: denied { mount } for pid=618 comm="syz.2.118" name="/" dev="ramfs" ino=16153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 38.599427][ T24] audit: type=1400 audit(1772258739.330:185): avc: denied { mount } for pid=610 comm="syz.1.117" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 38.627619][ T24] audit: type=1400 audit(1772258739.410:186): avc: denied { unmount } for pid=275 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 38.659165][ T24] audit: type=1400 audit(1772258739.440:187): avc: denied { mounton } for pid=618 comm="syz.2.118" path="/file2" dev="ramfs" ino=16161 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=dir permissive=1 [ 38.701466][ T619] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 38.726008][ T24] audit: type=1400 audit(1772258739.510:188): avc: denied { read write } for pid=626 comm="syz.1.122" name="vga_arbiter" dev="devtmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 38.777269][ T619] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a00ec019, mo2=0002] [ 38.785364][ T619] System zones: 1-12 [ 38.790451][ T619] EXT4-fs (loop2): 1 truncate cleaned up [ 38.799497][ T619] EXT4-fs (loop2): mounted filesystem without journal. Opts: nogrpid,jqfmt=vfsv0,debug_want_extra_isize=0x0000000000000068,debug,nombcache,quota,nolazytime,,errors=continue [ 38.814679][ T24] audit: type=1400 audit(1772258739.540:189): avc: denied { open } for pid=626 comm="syz.1.122" path="/dev/vga_arbiter" dev="devtmpfs" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 38.993344][ T24] audit: type=1400 audit(1772258739.770:190): avc: denied { nlmsg_read } for pid=641 comm="syz.1.128" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 39.021440][ T639] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 39.038913][ T639] EXT4-fs (loop2): 1 truncate cleaned up [ 39.044985][ T639] EXT4-fs (loop2): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,data_err=abort,noload,data_err=ignore,auto_da_alloc,,errors=continue [ 39.064249][ T24] audit: type=1400 audit(1772258739.840:191): avc: denied { remove_name } for pid=638 comm="syz.2.127" name="file0" dev="loop2" ino=13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 39.105686][ T5] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 39.453034][ T663] EXT4-fs (loop1): mounted filesystem without journal. Opts: nouid32,nodioread_nolock,barrier=0x0000000000000000,delalloc,journal_dev=0x0000000000000009,bsdgroups,,errors=continue [ 39.472428][ T663] ext4 filesystem being mounted at /24/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 39.490732][ T5] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 39.519628][ T5] usb 4-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 39.536300][ T5] usb 4-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 39.555694][ T5] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 39.577441][ T5] usb 4-1: config 0 descriptor?? [ 39.828336][ T5] usb 4-1: USB disconnect, device number 3 [ 40.069181][ T685] EXT4-fs (loop1): Ignoring removed nobh option [ 40.095720][ T685] EXT4-fs (loop1): Ignoring removed orlov option [ 40.102096][ T685] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 40.130025][ T685] EXT4-fs error (device loop1): __ext4_iget:5027: inode #11: block 1: comm syz.1.147: invalid block [ 40.161388][ T685] EXT4-fs error (device loop1): ext4_orphan_get:1400: comm syz.1.147: couldn't read orphan inode 11 (err -117) [ 40.190587][ T685] EXT4-fs (loop1): mounted filesystem without journal. Opts: noauto_da_alloc,nobh,max_dir_size_kb=0x0000000000000008,debug_want_extra_isize=0x0000000000000080,nodiscard,sysvgroups,orlov,mblk_io_submit,noauto_da_alloc,,errors=continue [ 40.326968][ T689] EXT4-fs (loop1): Ignoring removed oldalloc option [ 40.350910][ T689] EXT4-fs (loop1): 1 truncate cleaned up [ 40.366029][ T689] EXT4-fs (loop1): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000002,bsdgroups,nouid32,i_version,delalloc,oldalloc,stripe=0x0000000000000005,,errors=continue [ 40.379323][ T695] xt_hashlimit: size too large, truncated to 1048576 [ 40.681450][ T734] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 40.695739][ T734] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 40.709092][ T734] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:476: comm syz.2.168: Invalid block bitmap block 0 in block_group 0 [ 40.722902][ T734] EXT4-fs error (device loop2) in ext4_mb_clear_bb:5661: Corrupt filesystem [ 40.732096][ T734] EXT4-fs error (device loop2): ext4_clear_blocks:880: inode #11: comm syz.2.168: attempt to clear invalid blocks 983261 len 1 [ 40.745844][ T734] EXT4-fs error (device loop2): __ext4_get_inode_loc:4444: comm syz.2.168: Invalid inode table block 0 in block_group 0 [ 40.758576][ T734] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 40.771004][ T737] FAT-fs (loop1): error, fat_bmap_cluster: request beyond EOF (i_pos 52) [ 40.779710][ T734] EXT4-fs error (device loop2) in ext4_orphan_del:3292: Corrupt filesystem [ 40.788572][ T737] FAT-fs (loop1): Filesystem has been set read-only [ 40.798555][ T734] EXT4-fs error (device loop2): __ext4_get_inode_loc:4444: comm syz.2.168: Invalid inode table block 0 in block_group 0 [ 40.816463][ T734] EXT4-fs error (device loop2) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 40.826382][ T734] EXT4-fs error (device loop2): ext4_truncate:4396: inode #11: comm syz.2.168: mark_inode_dirty error [ 40.838554][ T734] EXT4-fs error (device loop2) in ext4_orphan_cleanup:3108: Corrupt filesystem [ 40.848046][ T734] EXT4-fs error (device loop2): __ext4_get_inode_loc:4444: comm syz.2.168: Invalid inode table block 0 in block_group 0 [ 40.861268][ T734] EXT4-fs (loop2): 1 truncate cleaned up [ 40.867123][ T734] EXT4-fs (loop2): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,journal_dev=0x0000000000000002,noblock_validity,,errors=continue [ 41.041602][ T754] EXT4-fs (loop3): journaled quota format not specified [ 41.180260][ T765] EXT4-fs (loop4): Ignoring removed orlov option [ 41.191776][ T765] EXT4-fs (loop4): Ignoring removed nobh option [ 41.206936][ T765] EXT4-fs (loop4): mounted filesystem without journal. Opts: data_err=ignore,errors=remount-ro,sysvgroups,norecovery,nodioread_nolock,orlov,nogrpid,noauto_da_alloc,nobh, [ 41.429154][ T775] EXT4-fs (loop1): Ignoring removed nobh option [ 41.435506][ T775] EXT4-fs (loop1): Ignoring removed orlov option [ 41.455768][ T775] EXT4-fs (loop1): Ignoring removed mblk_io_submit option [ 41.476651][ T775] EXT4-fs error (device loop1): __ext4_iget:5027: inode #11: block 1: comm syz.1.184: invalid block [ 41.485426][ T785] netlink: 24 bytes leftover after parsing attributes in process `syz.3.187'. [ 41.499710][ T775] EXT4-fs error (device loop1): ext4_orphan_get:1400: comm syz.1.184: couldn't read orphan inode 11 (err -117) [ 41.520418][ T775] EXT4-fs (loop1): mounted filesystem without journal. Opts: noauto_da_alloc,nobh,max_dir_size_kb=0x0000000000000008,debug_want_extra_isize=0x0000000000000080,nodiscard,sysvgroups,orlov,mblk_io_submit,noauto_da_alloc,,errors=continue [ 41.644399][ T788] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 41.759448][ T305] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 41.849059][ T797] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 41.859709][ T797] ext4 filesystem being mounted at /42/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 41.871205][ T814] EXT4-fs (loop4): Ignoring removed nobh option [ 41.879965][ T814] EXT4-fs (loop4): Ignoring removed orlov option [ 41.887736][ T814] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 41.918914][ T814] EXT4-fs error (device loop4): __ext4_iget:5027: inode #11: block 1: comm syz.4.199: invalid block [ 41.933056][ T797] EXT4-fs error (device loop3): ext4_mb_generate_buddy:824: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 41.933223][ T814] EXT4-fs error (device loop4): ext4_orphan_get:1400: comm syz.4.199: couldn't read orphan inode 11 (err -117) [ 41.973414][ T797] EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 1 with max blocks 31 with error 28 [ 41.995888][ T797] EXT4-fs (loop3): This should not happen!! Data will be lost [ 41.995888][ T797] [ 42.006486][ T814] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,nobh,max_dir_size_kb=0x0000000000000008,debug_want_extra_isize=0x0000000000000080,nodiscard,sysvgroups,orlov,mblk_io_submit,noauto_da_alloc,,errors=continue [ 42.016740][ T797] EXT4-fs (loop3): Total free blocks count 0 [ 42.035327][ T797] EXT4-fs (loop3): Free/Dirty block details [ 42.041427][ T797] EXT4-fs (loop3): free_blocks=65280 [ 42.047334][ T797] EXT4-fs (loop3): dirty_blocks=31 [ 42.052527][ T797] EXT4-fs (loop3): Block reservation details [ 42.066071][ T797] EXT4-fs (loop3): i_reserved_data_blocks=31 [ 42.265931][ T289] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 42.381343][ T857] EXT4-fs (loop4): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 42.393864][ T857] ext4 filesystem being mounted at /54/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 42.483989][ T870] netlink: 36 bytes leftover after parsing attributes in process `syz.3.223'. [ 42.585704][ T289] usb 3-1: Using ep0 maxpacket: 32 [ 42.926644][ T289] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 42.942585][ T289] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 42.998179][ T882] EXT4-fs (loop3): mounted filesystem without journal. Opts: barrier=0x000000007fffffff,max_dir_size_kb=0x0000000000000004,,errors=continue [ 43.012792][ T882] ext4 filesystem being mounted at /57/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 43.051630][ T885] EXT4-fs error (device loop0): dx_probe:796: inode #2: comm syz.0.227: Directory hole found for htree index block 0 [ 43.064262][ T885] EXT4-fs (loop0): Cannot turn on journaled quota: type 1: error -117 [ 43.072825][ T885] EXT4-fs (loop0): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,auto_da_alloc=0x0000000000000009,jqfmt=vfsold,nolazytime,grpjquota=.nouid32,resuid=0x0000000000000000,barrier=0x0000000000000005,grpid,,,errors=continue [ 43.125834][ T289] usb 3-1: New USB device found, idVendor=10cf, idProduct=5503, bcdDevice=2c.45 [ 43.133511][ T890] EXT4-fs (loop1): mounted filesystem without journal. Opts: i_version,bsdgroups,abort,,errors=continue [ 43.135024][ T289] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 43.146474][ T890] ext4 filesystem being mounted at /44/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 43.155457][ T289] usb 3-1: Product: syz [ 43.168960][ T289] usb 3-1: Manufacturer: syz [ 43.173686][ T289] usb 3-1: SerialNumber: syz [ 43.178960][ T289] usb 3-1: config 0 descriptor?? [ 43.307164][ T899] EXT4-fs (loop0): mounted filesystem without journal. Opts: barrier,nodioread_nolock,noquota,barrier,usrquota,nombcache,,errors=continue [ 43.322618][ T899] ext4 filesystem being mounted at /10/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.361489][ T902] EXT4-fs (loop3): mounted filesystem without journal. Opts: bsddf,user_xattr,journal_dev=0x0000000000000004,,errors=continue [ 43.381001][ T911] tc_dump_action: action bad kind [ 43.432808][ T826] udc-core: couldn't find an available UDC or it's busy [ 43.460714][ T826] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 43.469747][ T826] udc-core: couldn't find an available UDC or it's busy [ 43.477078][ T826] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 43.485951][ T826] udc-core: couldn't find an available UDC or it's busy [ 43.492960][ T826] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 43.520364][ T289] usb 3-1: USB disconnect, device number 3 [ 43.569160][ T915] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 43.591010][ T915] ext4 filesystem being mounted at /56/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.602238][ T902] mmap: syz.3.233 (902) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 43.620282][ T24] kauditd_printk_skb: 24 callbacks suppressed [ 43.620293][ T24] audit: type=1400 audit(1772258744.400:216): avc: denied { nlmsg_read } for pid=925 comm="syz.0.241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 43.649298][ T915] process 'syz.4.238' launched './file0' with NULL argv: empty string added [ 43.656384][ T24] audit: type=1400 audit(1772258744.430:217): avc: denied { setattr } for pid=914 comm="syz.4.238" name="file0" dev="loop4" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 43.680110][ T915] Invalid argument reading file caps for ./file0 [ 43.683019][ T24] audit: type=1400 audit(1772258744.460:218): avc: denied { execute_no_trans } for pid=914 comm="syz.4.238" path="/56/file0/file0" dev="loop4" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 43.728713][ T928] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue [ 43.737986][ T928] ext4 filesystem being mounted at /50/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 43.782781][ T24] audit: type=1400 audit(1772258744.560:219): avc: denied { create } for pid=927 comm="syz.1.242" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 43.811608][ T24] audit: type=1400 audit(1772258744.580:220): avc: denied { write } for pid=927 comm="syz.1.242" name="file1" dev="loop1" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 43.834075][ T24] audit: type=1400 audit(1772258744.580:221): avc: denied { add_name } for pid=927 comm="syz.1.242" name="file3" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 43.987515][ T961] capability: warning: `syz.4.257' uses deprecated v2 capabilities in a way that may be insecure [ 44.006678][ T952] FAT-fs (loop1): Directory bread(block 32) failed [ 44.013269][ T952] FAT-fs (loop1): Directory bread(block 33) failed [ 44.019993][ T952] FAT-fs (loop1): Directory bread(block 34) failed [ 44.026814][ T952] FAT-fs (loop1): Directory bread(block 35) failed [ 44.033409][ T952] FAT-fs (loop1): Directory bread(block 36) failed [ 44.042872][ T952] FAT-fs (loop1): Directory bread(block 37) failed [ 44.051160][ T952] FAT-fs (loop1): Directory bread(block 38) failed [ 44.065705][ T952] FAT-fs (loop1): Directory bread(block 39) failed [ 44.072339][ T952] FAT-fs (loop1): Directory bread(block 40) failed [ 44.076637][ T960] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 44.079165][ T952] FAT-fs (loop1): Directory bread(block 41) failed [ 44.091874][ T960] ext4 filesystem being mounted at /16/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.156181][ T961] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue [ 44.166823][ T952] FAT-fs (loop1): error, corrupted directory (invalid entries) [ 44.180023][ T960] EXT4-fs error (device loop0): ext4_validate_inode_bitmap:106: comm syz.0.255: Corrupt inode bitmap - block_group = 0, inode_bitmap = 20 [ 44.198948][ T961] ext4 filesystem being mounted at /61/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 44.237295][ T981] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 44.348044][ T24] audit: type=1400 audit(1772258745.130:222): avc: denied { setattr } for pid=959 comm="syz.4.257" name="file1" dev="loop4" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 44.375150][ T24] audit: type=1400 audit(1772258745.130:223): avc: denied { rename } for pid=980 comm="syz.3.264" name="file0" dev="loop3" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 44.397645][ T24] audit: type=1400 audit(1772258745.130:224): avc: denied { rmdir } for pid=980 comm="syz.3.264" name=131377C5FC35D41454D5D41D29AD1A6029598146E6BE166E41AD0DBD4054033C9F33BBDA8224A2F3D772E7636E48B33CBF708372E8F1B9933EC5127743BE2206209EF02DF9CBF2F6E880D338 dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 44.432147][ T24] audit: type=1400 audit(1772258745.130:225): avc: denied { rename } for pid=980 comm="syz.3.264" name=131377C5FC35D41454D5D41D29AD1A6029598146E6BE166E41AD0DBD4054033C9F33BBDA8224A2F3D772E7636E48B33CBF708372E8F1B9933EC5127743BE2206209EF02DF9CBF2F6E880D338 dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 44.734091][ T1017] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 44.771761][ T1017] EXT4-fs (loop4): 1 truncate cleaned up [ 44.800215][ T1017] EXT4-fs (loop4): mounted filesystem without journal. Opts: init_itable=0x0000000000000000,jqfmt=vfsold,debug_want_extra_isize=0x000000000000006a,jqfmt=vfsold,minixdf,quota,,errors=continue [ 44.839297][ T1043] device syzkaller0 entered promiscuous mode [ 44.970064][ T1060] serio: Serial port ptm0 [ 45.039063][ T1073] EXT4-fs (loop3): mounted filesystem without journal. Opts: nodioread_nolock,sb=0x0000000000000001,,errors=continue [ 45.051739][ T1073] ext4 filesystem being mounted at /77/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 45.085716][ T5] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 45.336770][ T1095] tmpfs: Unsupported parameter 'mpol' [ 45.515952][ T5] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 45.540906][ T1097] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue [ 45.546112][ T5] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 45.609728][ T5] usb 3-1: New USB device found, idVendor=0c45, idProduct=8001, bcdDevice=90.0a [ 45.635964][ T5] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 45.654313][ T5] usb 3-1: config 0 descriptor?? [ 45.928834][ T5] usb 3-1: USB disconnect, device number 4 [ 46.107873][ T1123] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 46.146791][ T1123] ext4 filesystem being mounted at /28/file2 supports timestamps until 2038-01-19 (0x7fffffff) [ 46.325740][ T421] usb 2-1: new full-speed USB device number 6 using dummy_hcd [ 46.748180][ T1145] EXT4-fs (loop2): Ignoring removed oldalloc option [ 46.773974][ T1145] EXT4-fs (loop2): Ignoring removed bh option [ 46.780816][ T1145] EXT4-fs (loop2): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 46.799367][ T1145] EXT4-fs (loop2): mounted filesystem without journal. Opts: delalloc,data_err=abort,barrier=0x0000000000000002,usrquota,data_err=ignore,nobarrier,oldalloc,grpquota,noload,user_xattr,bh,dioread_nolock,,errors=continue [ 47.577692][ T1160] tipc: Started in network mode [ 47.584433][ T1160] tipc: Own node identity ff000000000000000000000000000001, cluster identity 4711 [ 47.586843][ T1156] EXT4-fs (loop3): mounted filesystem without journal. Opts: bsddf,user_xattr,journal_dev=0x0000000000000004,,errors=continue [ 47.596307][ T1160] tipc: Enabling of bearer rejected, failed to enable media [ 47.828197][ T1185] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpquota,,errors=continue [ 47.885682][ T5] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 48.023147][ T1202] bridge0: port 3(veth0_to_team) entered blocking state [ 48.031186][ T1202] bridge0: port 3(veth0_to_team) entered disabled state [ 48.038819][ T1202] device veth0_to_team entered promiscuous mode [ 48.135740][ T5] usb 5-1: Using ep0 maxpacket: 32 [ 48.178235][ T1223] ================================================================== [ 48.186376][ T1223] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x842/0x3280 [ 48.194552][ T1223] Read of size 8 at addr ffff888119440ec0 by task syz.2.363/1223 [ 48.202281][ T1223] [ 48.204653][ T1223] CPU: 0 PID: 1223 Comm: syz.2.363 Not tainted syzkaller #0 [ 48.212052][ T1223] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 48.222235][ T1223] Call Trace: [ 48.225557][ T1223] __dump_stack+0x21/0x24 [ 48.229916][ T1223] dump_stack_lvl+0x1a7/0x208 [ 48.234615][ T1223] ? show_regs_print_info+0x18/0x18 [ 48.239831][ T1223] ? thaw_kernel_threads+0x220/0x220 [ 48.245130][ T1223] print_address_description+0x7f/0x2c0 [ 48.250673][ T1223] ? tc_setup_flow_action+0x842/0x3280 [ 48.256154][ T1223] kasan_report+0xe2/0x130 [ 48.260699][ T1223] ? flow_action_cookie_create+0x28/0x90 [ 48.266329][ T1223] ? tc_setup_flow_action+0x842/0x3280 [ 48.271934][ T1223] __asan_report_load8_noabort+0x14/0x20 [ 48.277728][ T1223] tc_setup_flow_action+0x842/0x3280 [ 48.283099][ T1223] ? __kmalloc+0x1a4/0x330 [ 48.287533][ T1223] ? flow_rule_alloc+0x32/0x2c0 [ 48.292392][ T1223] mall_replace_hw_filter+0x2cc/0x8a0 [ 48.297757][ T1223] ? pcpu_block_update_hint_alloc+0x8bf/0xc50 [ 48.303816][ T1223] ? mall_set_parms+0x410/0x410 [ 48.308666][ T1223] ? tcf_exts_destroy+0xb0/0xb0 [ 48.313510][ T1223] ? pcpu_alloc+0xf9b/0x16b0 [ 48.318098][ T1223] ? mall_set_parms+0x19d/0x410 [ 48.323059][ T1223] mall_change+0x546/0x760 [ 48.327525][ T1223] ? __kasan_check_write+0x14/0x20 [ 48.332653][ T1223] ? mall_get+0xa0/0xa0 [ 48.336816][ T1223] ? tcf_chain_tp_insert_unique+0xac1/0xc10 [ 48.342838][ T1223] ? nla_strcmp+0xf4/0x140 [ 48.347336][ T1223] tc_new_tfilter+0x1452/0x1a90 [ 48.352181][ T1223] ? mall_get+0xa0/0xa0 [ 48.356357][ T1223] ? tcf_gate_entry_destructor+0x20/0x20 [ 48.362022][ T1223] ? security_capable+0x87/0xb0 [ 48.366949][ T1223] ? ns_capable+0x8c/0xf0 [ 48.371271][ T1223] ? netlink_net_capable+0x125/0x160 [ 48.376547][ T1223] ? tcf_gate_entry_destructor+0x20/0x20 [ 48.382193][ T1223] rtnetlink_rcv_msg+0x845/0xcc0 [ 48.387130][ T1223] ? rtnetlink_bind+0x80/0x80 [ 48.391833][ T1223] ? arch_stack_walk+0xee/0x140 [ 48.396687][ T1223] ? stack_trace_save+0xa6/0xf0 [ 48.401538][ T1223] ? stack_trace_snprint+0xf0/0xf0 [ 48.406664][ T1223] ? avc_has_perm+0x168/0x3d0 [ 48.411491][ T1223] ? memcpy+0x56/0x70 [ 48.415472][ T1223] ? avc_has_perm+0x27f/0x3d0 [ 48.420151][ T1223] ? __kasan_slab_alloc+0xbd/0xf0 [ 48.425381][ T1223] ? slab_post_alloc_hook+0x5d/0x2f0 [ 48.431121][ T1223] ? avc_has_perm_noaudit+0x260/0x260 [ 48.436517][ T1223] ? selinux_nlmsg_lookup+0x3fb/0x4a0 [ 48.441894][ T1223] netlink_rcv_skb+0x1f5/0x440 [ 48.446657][ T1223] ? rtnetlink_bind+0x80/0x80 [ 48.451354][ T1223] ? netlink_ack+0xb70/0xb70 [ 48.455949][ T1223] ? __netlink_lookup+0x387/0x3b0 [ 48.460989][ T1223] rtnetlink_rcv+0x1c/0x20 [ 48.465460][ T1223] netlink_unicast+0x876/0xa40 [ 48.470226][ T1223] netlink_sendmsg+0x89c/0xb50 [ 48.474988][ T1223] ? netlink_getsockopt+0x530/0x530 [ 48.480216][ T1223] ? security_socket_sendmsg+0x82/0xa0 [ 48.485731][ T1223] ? netlink_getsockopt+0x530/0x530 [ 48.491284][ T1223] ____sys_sendmsg+0x5b7/0x8f0 [ 48.496060][ T1223] ? __sys_sendmsg_sock+0x40/0x40 [ 48.501087][ T1223] ? import_iovec+0x7c/0xb0 [ 48.505600][ T1223] ___sys_sendmsg+0x236/0x2e0 [ 48.510300][ T1223] ? __sys_sendmsg+0x280/0x280 [ 48.515169][ T1223] ? alloc_file+0x82/0x540 [ 48.519583][ T1223] ? __fdget+0x1a1/0x230 [ 48.523814][ T1223] __x64_sys_sendmsg+0x1f9/0x2c0 [ 48.528748][ T1223] ? __kasan_check_write+0x14/0x20 [ 48.533850][ T1223] ? ___sys_sendmsg+0x2e0/0x2e0 [ 48.538693][ T1223] ? __kasan_check_read+0x11/0x20 [ 48.543718][ T1223] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 48.549358][ T1223] do_syscall_64+0x31/0x40 [ 48.553766][ T1223] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.559682][ T1223] RIP: 0033:0x7faef843d799 [ 48.564122][ T1223] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 48.583739][ T1223] RSP: 002b:00007faef6e98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 48.592160][ T1223] RAX: ffffffffffffffda RBX: 00007faef86b6fa0 RCX: 00007faef843d799 [ 48.600134][ T1223] RDX: 0000000020000000 RSI: 0000200000000580 RDI: 0000000000000006 [ 48.608112][ T1223] RBP: 00007faef84d3bd9 R08: 0000000000000000 R09: 0000000000000000 [ 48.616114][ T1223] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 48.624091][ T1223] R13: 00007faef86b7038 R14: 00007faef86b6fa0 R15: 00007fff8e8c4c28 [ 48.632066][ T1223] [ 48.634398][ T1223] Allocated by task 1223: [ 48.638749][ T1223] __kasan_kmalloc+0xda/0x110 [ 48.643425][ T1223] __kmalloc+0x1a4/0x330 [ 48.647672][ T1223] tcf_idr_create+0x5f/0x790 [ 48.652262][ T1223] tcf_idr_create_from_flags+0x61/0x70 [ 48.657724][ T1223] tcf_gact_init+0x2e6/0x560 [ 48.662319][ T1223] tcf_action_init_1+0x443/0x6e0 [ 48.667254][ T1223] tcf_action_init+0x227/0x780 [ 48.672019][ T1223] tcf_exts_validate+0x248/0x570 [ 48.676962][ T1223] mall_set_parms+0x4b/0x410 [ 48.681563][ T1223] mall_change+0x47a/0x760 [ 48.685984][ T1223] tc_new_tfilter+0x1452/0x1a90 [ 48.690833][ T1223] rtnetlink_rcv_msg+0x845/0xcc0 [ 48.695768][ T1223] netlink_rcv_skb+0x1f5/0x440 [ 48.700529][ T1223] rtnetlink_rcv+0x1c/0x20 [ 48.704946][ T1223] netlink_unicast+0x876/0xa40 [ 48.709714][ T1223] netlink_sendmsg+0x89c/0xb50 [ 48.714481][ T1223] ____sys_sendmsg+0x5b7/0x8f0 [ 48.719254][ T1223] ___sys_sendmsg+0x236/0x2e0 [ 48.723928][ T1223] __x64_sys_sendmsg+0x1f9/0x2c0 [ 48.728865][ T1223] do_syscall_64+0x31/0x40 [ 48.733294][ T1223] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.739179][ T1223] [ 48.741528][ T1223] The buggy address belongs to the object at ffff888119440e00 [ 48.741528][ T1223] which belongs to the cache kmalloc-192 of size 192 [ 48.755579][ T1223] The buggy address is located 0 bytes to the right of [ 48.755579][ T1223] 192-byte region [ffff888119440e00, ffff888119440ec0) [ 48.769195][ T1223] The buggy address belongs to the page: [ 48.774851][ T1223] page:ffffea0004651000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119440 [ 48.785093][ T1223] flags: 0x4000000000000200(slab) [ 48.790127][ T1223] raw: 4000000000000200 ffffea0004576900 0000000300000003 ffff888100043380 [ 48.798721][ T1223] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 48.807324][ T1223] page dumped because: kasan: bad access detected [ 48.813737][ T1223] page_owner tracks the page as allocated [ 48.819465][ T1223] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 95, ts 6215046998, free_ts 0 [ 48.834518][ T1223] prep_new_page+0x179/0x180 [ 48.839127][ T1223] get_page_from_freelist+0x223b/0x23d0 [ 48.844680][ T1223] __alloc_pages_nodemask+0x290/0x620 [ 48.850061][ T1223] new_slab+0x84/0x3f0 [ 48.854131][ T1223] ___slab_alloc+0x2a6/0x450 [ 48.858722][ T1223] __slab_alloc+0x63/0xa0 [ 48.863060][ T1223] kmem_cache_alloc_trace+0x1b0/0x2e0 [ 48.868529][ T1223] kernfs_fop_open+0x343/0xb30 [ 48.873297][ T1223] do_dentry_open+0x793/0x1090 [ 48.878063][ T1223] vfs_open+0x73/0x80 [ 48.882046][ T1223] path_openat+0x280f/0x31c0 [ 48.886639][ T1223] do_filp_open+0x1e2/0x410 [ 48.891150][ T1223] do_sys_openat2+0x19f/0x750 [ 48.895864][ T1223] __x64_sys_openat+0x136/0x160 [ 48.900724][ T1223] do_syscall_64+0x31/0x40 [ 48.905143][ T1223] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 48.911032][ T1223] page_owner free stack trace missing [ 48.916399][ T1223] [ 48.918737][ T1223] Memory state around the buggy address: [ 48.924372][ T1223] ffff888119440d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.932439][ T1223] ffff888119440e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 48.940508][ T1223] >ffff888119440e80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 48.948567][ T1223] ^ [ 48.954726][ T1223] ffff888119440f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.962913][ T1223] ffff888119440f80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 48.970973][ T1223] ================================================================== [ 48.979032][ T1223] Disabling lock debugging due to kernel taint [ 49.024837][ T24] kauditd_printk_skb: 24 callbacks suppressed [ 49.024849][ T24] audit: type=1400 audit(1772258749.780:250): avc: denied { read } for pid=77 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 49.045902][ T421] usb 2-1: unable to get BOS descriptor or descriptor too short [ 49.053082][ T24] audit: type=1400 audit(1772258749.780:251): avc: denied { search } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.081941][ T24] audit: type=1400 audit(1772258749.780:252): avc: denied { write } for pid=77 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.106035][ T5] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 49.110498][ T24] audit: type=1400 audit(1772258749.780:253): avc: denied { add_name } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 49.120418][ T5] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 49.138075][ T24] audit: type=1400 audit(1772258749.780:254): avc: denied { create } for pid=77 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.166590][ T24] audit: type=1400 audit(1772258749.790:255): avc: denied { append open } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.189600][ T24] audit: type=1400 audit(1772258749.790:256): avc: denied { getattr } for pid=77 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 49.225808][ T421] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 49.233406][ T421] usb 2-1: can't read configurations, error -71 [ 49.325790][ T5] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 49.334879][ T5] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 49.342948][ T5] usb 5-1: Product: syz [ 49.347330][ T5] usb 5-1: Manufacturer: syz [ 49.351931][ T5] usb 5-1: SerialNumber: syz [ 49.357544][ T5] usb 5-1: config 0 descriptor?? [ 50.604563][ T25] usb 5-1: USB disconnect, device number 2