last executing test programs: 43.535751758s ago: executing program 1 (id=544): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8c, 0x5}, 0x0, 0x80000000, 0x400000, 0x9, 0x800000, 0x43, 0x4d7, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000540)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=ANY=[@ANYBLOB="0100000003ece1e40ad8871061ab0800", @ANYRES64=r0, @ANYRES8=r1, @ANYRES64=0x0, @ANYBLOB="1a2c6e865682dc062e080b103359a3e2b84c678113ae05345ffc4834980fb8d8db26d49235f999018607f477a321c0cc30116142c64bc9025a89c15f6bdb5c44e7559fab9afe2b39ffb8b774b977ac46a680d48a23df357dfdd5a90766c0cf38b1ed563d578998012d01b5c65281500f5d39d6352ed8b61f65e4af601ef03e4d86b17df21774175538", @ANYBLOB], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x40004) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) openat$cgroup_devices(r3, &(0x7f0000001080)='devices.deny\x00', 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000004c0)="99", 0x1}], 0x1}, 0x4048043) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000400)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x3, 0x4, 0xe652, 0x9, 0x14, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x1, 0xf06, 0x0, 0xac, 0x5, 0x5}, 0x9c) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4000000, &(0x7f0000006680)) r6 = epoll_create(0x1e) epoll_pwait2(r6, &(0x7f0000000000)=[{}], 0x1, &(0x7f0000000080), 0x0, 0x0) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000002301000008000300", @ANYRES32=r8, @ANYBLOB="05001f0002"], 0x24}}, 0x0) r9 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r9, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r9, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r10}}, 0x30) write$RDMA_USER_CM_CMD_RESOLVE_IP(r9, &(0x7f0000000340)={0x3, 0x40, 0xfa00, {{0xa, 0x4e23, 0x5, @loopback, 0x7}, {0xa, 0x4e24, 0xf107, @empty, 0x8000}, r10, 0x1}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_MCAST(r9, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {0x0, 0x4, r10, 0x10, 0x0, @in={0x2, 0x4e23, @loopback}}}, 0xa0) syz_io_uring_setup(0x320, &(0x7f00000011c0)={0x0, 0x920e, 0x800, 0x0, 0x1}, &(0x7f0000000000), &(0x7f0000001180), 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r11 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x4942, 0x0) waitid$P_PIDFD(0x3, r11, 0x0, 0x80000009, &(0x7f0000001240)) 42.30283954s ago: executing program 1 (id=558): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x22, &(0x7f0000000200)=0x1, 0x4) shutdown(r0, 0x1) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e20, 0x9, @loopback, 0x5}, 0x1c) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000380)={@in6={{0xa, 0x4e24, 0xfffffffe, @loopback, 0x1}}, 0x0, 0x0, 0x4c, 0x0, "5aa1f50a3cb63c3635852b1d0b0ac8bbc455e170385fefb683affb65799f7a308ec96cd29e9b33df174bcdcf78a7bccda39e047719afe332de441e7e8e68bf5adbf7a35d75885fb07c3e40612a459451"}, 0xd8) sendmmsg$inet6(r0, &(0x7f0000000140)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x3, @empty, 0xfffffffe}, 0x1c, &(0x7f0000000b40)=[{&(0x7f0000000480)="78be47", 0x3}], 0x1}}], 0x1, 0x20080058) 42.268463299s ago: executing program 1 (id=559): capset(&(0x7f0000000040)={0x19980330}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0xad, 0x0, &(0x7f00000001c0)="b461802305624431ed3373010000003d2600906919d5d5fe00c6fc7ef8eef9757a601bee936390009c5bbd000000003632b69f0eb206f51005002818f2980660abbc6f6322cbfac48000d75bfab0cd655ba6f12c02869ec5254594d7d144c39e3200000000d76a6100810800ffff000000000000e6b2347d38650608e39d2f8e612f5787cfb4d8b5808cf339089d46844de51517a756705ab535c084ee3da160dffccccbc132908c2d4588aec2", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffefffc}, 0x50) r0 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) 42.237126338s ago: executing program 1 (id=560): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(0x0, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400004, 0x0, @perf_config_ext={0x80000001}, 0x82, 0x0, 0x0, 0x1, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mq_open(&(0x7f00000004c0)='bata`\xde_sla\x00\x00_1\x00x!\x98\x842\x01\xa3y=\x10\xec\xb9\xfa\xc8\x96\x8d\xd1\xde\x95\x8a\"B\xbdRE\x95jl\\\xcd\r\x13\x05\x9c\x1c\b\xf5\x9d\f\xf0\x99^x.\x0f\xc3l\x9a\x9e\xdd\xca\t\x91v\x9a\xc9\'O\xcf\xb2(\xe3\x89|\xf4;\r\xa999\fzM\xb0.wy\xd8\xe4\xa35q[(\xf2)\x02.\xc5\x960xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x5607, 0x2d) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) ioctl$TIOCL_SETVESABLANK(r5, 0x560e, &(0x7f0000000140)) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, 0x0) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x10001) ioctl$TIOCL_BLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x2c, 0x11, 0x0, 0x1, @limit={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x3}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x101}]}}}]}, @NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}, {0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xf8}}, 0x0) r6 = socket(0x8, 0x5, 0x7fff) ioctl$sock_SIOCOUTQNSD(r6, 0x40106150, &(0x7f0000000000)) 20.816341018s ago: executing program 2 (id=785): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000008500000018000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$XFS_IOC_AG_GEOMETRY(r0, 0xc080583d, &(0x7f0000000080)={0x7, 0x4, 0x1b, 0xc96, 0x1c41, 0x9, 0x348a, 0x8000}) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0xf61cb000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'syz1\x00'}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x2}}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0x0, 0xffffff00], [], 'erspan0\x00', 'netdevsim0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'vcan0\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xf9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) socket$inet_tcp(0x2, 0x1, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r3, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x40, 0x5}]}}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x400}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x19, r4, 0xffffffffffffffff, 0x274b) sched_setscheduler(r4, 0x0, &(0x7f0000000000)=0x6000) r5 = timerfd_create(0x8, 0x0) read(r5, &(0x7f0000002180)=""/262, 0x106) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x2f, 0xe, 0x0, &(0x7f0000000180)="e4e6abc9f494d44d5166a7ad6797", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 20.294561193s ago: executing program 3 (id=789): perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, @perf_config_ext={0x0, 0x8}, 0x1000, 0x0, 0x80000000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) io_uring_setup(0x48e, &(0x7f0000000240)={0x0, 0x2607, 0x2, 0x2, 0x29d}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f00000001c0)={0x30, 0x1, 0x4, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFULA_CFG_MODE={0xa, 0x2, {0x9, 0x1}}, @NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x1}, @NFULA_CFG_QTHRESH={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4800}, 0x8014) r1 = socket$netlink(0x10, 0x3, 0x0) socket$rxrpc(0x21, 0x2, 0xa) sendto(r1, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000040000000000000000001800058014000180080001000000000008000300640000000c000700e803000000000000", 0x68, 0x0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x800) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000840)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000800)={&(0x7f00000009c0)=ANY=[@ANYBLOB="e4000000070a01030000000000000000000000050900010073797a30000000006f0007406ef05de2e3cfbab5ec624b87dfb1eeea048c156aa86b477098e1cc74b31cdd72821417a569e000000000000079d78e2ae9ef12c42b6227ab878943ee0ff9c3cb0c289f8af055fff8d2782699533e153a0d8c6066642a3431dada4d33951dd92af6f76106e94fabd6c7979f0008000b40000000024c000740233eea8b28c99c92fe88e7c792d670df2eb6894895fd8444baffc35cf25fd4fdf97cf7eaa8e402bde99b9c271276b2d179d989ac3151a43ff35500"/228], 0xe4}}, 0x48000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtaction={0x64, 0x30, 0x871a15abc695fb3d, 0x0, 0x25dfdbfe, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x8a1, 0x202, 0x3, 0x4, 0x3}, 0x3}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001a40)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a58000000060a010400000000000000000a0000110900010073797a31000000002c0004802800018007000100637400001c0002800800024000000011080001400000000a05000300000000000900"], 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x4000004) sched_setscheduler(0x0, 0x2, &(0x7f0000000300)=0x7) setns(0xc9, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) writev(r3, &(0x7f0000000540)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000000000005600000025000000190004000400000007fd1700000900000400000000", 0x35}, {&(0x7f0000000580)="36bab602ec8ba10477f39065529b88f8dac5f3eb4442865b56505ba44350e4651ea1241d1fb74eec80cbb50b995242d77ea9d0a35f79cb824f41fc2bf702edc89288f2c0c4c48bccb73fd726ab953edc0bd83ce370e4a433c2402349aa29bf006a042818afba94d8caad2e0ad8d6", 0x6e}], 0x2) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb006}, 0x4) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401f, 0x68180, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x6f, 0x1, @perf_config_ext={0x800, 0x1ff}, 0x400, 0x5, 0x7, 0x4, 0x6, 0x8001, 0x7fff}, 0x0, 0xff6fbfffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xfffffffffffffffd}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0xd}, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setns(0xc9, 0x0) r6 = socket(0x2a, 0x2, 0x9) connect(r6, &(0x7f0000000240)=@qipcrtr={0x2a, 0x4, 0xfffffffe}, 0x80) bind$inet(r6, &(0x7f0000000180)={0x2a, 0x4e23, @empty=0x1000000}, 0x10) connect$inet(r5, 0x0, 0x0) socket(0x10, 0x3, 0x0) 19.863340682s ago: executing program 2 (id=791): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x1b7c, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4004004) r0 = socket$inet(0x2, 0x80001, 0x84) writev(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, 0x0, 0xfffffffb) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup/cgroup.procs\x00', 0x2, 0x0) read(r2, &(0x7f0000000080)=""/1, 0x1) r3 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000300)=ANY=[], 0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0xdabc3000) close_range(r1, 0xffffffffffffffff, 0x0) 19.7637903s ago: executing program 3 (id=794): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x44541, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='sys\x00', &(0x7f00000007e0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./sys/devices/platform/vhci_hcd.0/attach\x00', 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x503, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffe}, 0x50) r3 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x60}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000002c0), 0x0) writev(r1, &(0x7f0000000900)=[{&(0x7f0000000980)='\t', 0x1}], 0x1) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x3) pipe(&(0x7f0000000180)={0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r4, 0x58}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r5, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f00000003c0)=0x16) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002000)=@newtaction={0xecc, 0x30, 0xb, 0x0, 0x0, {}, [{0xeb8, 0x1, [@m_gact={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0xbf2, 0x4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe60, 0x2, 0x0, 0x0, {{0xa}, {0xe34, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x3, 0xfffffffc}, {0x6, 0x400, 0x9321, 0x9, 0x6, 0x7}, {0x5, 0x5, 0xffffffc0, 0x0, 0x3}, {0xe, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x40080003}, {0x3, 0x3, 0x80, 0x0, 0xacc8, 0x2}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0xfff, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4, 0x1000000}, {0x8004, 0x80000001, 0xfffffeff, 0xdf, 0x4, 0x5}, {0x0, 0x80000001, 0x9, 0x7, 0x7fffffff, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x1}, {0x7fffffff, 0x1, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x5, 0xf}, {0x9b7d, 0x52fc, 0x6, 0x40000003, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x9, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff417, 0x1, 0x3ff}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0x3, 0x3, 0x3ff, 0x1, 0x400}, {0x1, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x3, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x381, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x6, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3, 0x7}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0x7}, {0xf85, 0x2e, 0x100, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000, 0xcb06}, {0x4e2, 0x6ae, 0x2, 0x100, 0x5, 0xd}, {0x1, 0xcad, 0xa5, 0x2, 0x4d800, 0x6}, {0x20, 0x7f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x2, 0x0, 0x1}, {0x2, 0x8, 0x10000002, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0xffffffff}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x2, 0x4, 0x800, 0x1}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0x103, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x8, 0x7023, 0x8, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x8, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0x40, 0x2, 0x89, 0x2}, {0x2, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x9, 0x7, 0x2}, {0x7, 0x1, 0x8, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x8}, {0x100, 0x3ff, 0x0, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x6, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xfff, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x3ee, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x8000400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x2000007f, 0x8}, {0x5, 0x25b, 0x0, 0x3, 0x2, 0x2}, {0x29dbdf0, 0xd, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x400, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800002, 0x3, 0x10, 0x5}, {0x7f, 0x7, 0x6, 0xffffffff, 0x3, 0x8}, {0xfffffff3, 0x5, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x4ce}, {0x6, 0xd, 0x6, 0xfb0003, 0x1, 0x7}, {0xe0, 0x100, 0x1, 0xb, 0x8, 0x7}, {0xfff, 0x1d, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x9, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0x800004, 0x10001, 0x2, 0xce}, {0x4, 0x8, 0x8, 0x3, 0xf, 0x9}, {0x8000006, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0x3, 0x4, 0x7, 0x7}, {0x4, 0x61c5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0xc651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0xfffffffe, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x36b6800}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0xae82}, {0x6, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdc}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x7, 0x3, 0x400, 0x81}, {0x970, 0x100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0x1a5e666b, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x7, 0x101, 0xef}, {0x70a0, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x402, 0x4, 0x8, 0x7}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d8, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x0, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x800, 0xfffffff9, 0xa, 0x4b64, 0x80000001}, {0x2ad78a25, 0x202, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x129, 0xc}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xfffffff9}, {0x4a3, 0x0, 0x3, 0x514c, 0xf8a, 0x19}], [{0x1}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x1}, {0x3, 0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x5}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}, {0x1}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x2}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4}, {0x6, 0x1}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x10, 0x5, 0x0, 0x1, [{0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}]}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xecc}}, 0x0) r7 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x84) io_uring_enter(r7, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) 18.927503402s ago: executing program 3 (id=800): syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0x60bc, 0x130c8, 0x6, 0x30e}, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x6020400) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000ff07000009"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xd, 0x6, 0x4, 0x7fff, 0x1, r0}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x9, r1, 0x900}, 0x38) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x28, r2, 0xb589de7b26d064b1, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x16}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) 18.815363353s ago: executing program 2 (id=803): signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffbfffff5]}, 0x8, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401f, 0x68180, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x6f, 0x1, @perf_bp={0x0, 0x1}, 0x10c0e8, 0x0, 0x0, 0x3, 0x6, 0x8001, 0x7fff}, 0x0, 0xff6fbfffffffffff, 0xffffffffffffffff, 0x1) r0 = socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xf}, 0x0, 0x2df, 0x0, 0x0, 0x2, 0x7fffffff, 0xfffc, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_mount_image$ext4(&(0x7f0000000680)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x800700, &(0x7f0000000100), 0x3, 0x465, &(0x7f0000001900)="$eJzs3M9vFFUcAPDvzLYgP1sRf4CoVWJs/NHSgsrBi0YTDxhN9IDH2hZCWKihNRFCpBqDFxND1LPxaOJf4M2LUU8mXvVuSIhyAT3VzOwM7C67pYXtLnQ/n2SX92Ze+963b97Mm3m7BNC3RrK3JGJrRPwREUO1bGOBkdo/Vy+fnf738tnpJJaW3v47yctduXx2uixa/tyWIjOaRqSfJkUljeZPnzk+Va3Oniry4wsn3h+fP33muWMnpo7OHp09OXnw4IH9Ey++MPn8Mq3fuOI4s7iu7P5obs+u19+98Mb04Qvv/fJ91t6txf76ODplJAv8n6Vc3eYvs7cnO11Zj22rSycDPWwIq1KJiKy7BvPxPxSVuN55Q/HaJz1tHLCmsmvTMlfRxSVgHUtihcViZQWBu0V5oc/uf8tXl6Yed4RLL9dugLK4rxav2p6BSIsyg033t500EhGHF//7JnvFGj2HAACo9/n014fi2VbzvzQeqCu3vVhDGY6IeyNiR0TcFxE7I+L+iLzsgxHxUNuaNrTc2rw0dOP8J714y8GtQDb/e6lY22qc/5Wzv8pwpchty+MfTI4cq87uK/4mozG4MctPLFPHj6/+/kW7ffXzv+yV1V/OBYt2XBxoekA3M7UwlU9KO+DSxxG7B1rFn1xbCchu/XdFxO7V/ertZeLY09/taVfo5vEvowPrTEvfRjxV6//FaIq/lCy/Pjl+T1Rn942XR8WNfv3t/Fvt6r+t+Dsg6//Njcd/c5HhpH69dn71dZz/87O29zS3evxvSN7J+6U8q3w4tbBwaiJiQ3Iozzdsn7z+s2W+LJ/FP7q39fjfUUtsyt4ejojsIH4kIh6NiMeKtj8eEU9ExN5l4v/5lfb77oT+n2l5/rt2/Df1/+oTleM//dCu/pX1/4E8NVpsyc9/N7HSBt7O3w4AAADuFmn+GfgkHbuWTtOxsdpn+HfG5rQ6N7/wzJG5D07O1D4rPxyDafmka6jueehEslj8xlp+snhWXO7fXzw3/qqyKc+PTc9VZ3ocO/S7LW3Gf+avSq9bB6y5Vutoky3Xaxu+yAasA83jP23Mnnuzm40Busr3taF/3WT8p91qB9B9rv/Qv1qN/3NNeWsBsD65/kP/Mv6hfxn/0L+Mf+hLt/O9/n5OZKfMO6AZ1aGiH7tfe6S9jl1iLRKt/58mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAu9X/AQAA//9l+OT1") syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) pipe(&(0x7f0000000180)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32, @ANYBLOB="e0ff8b0a"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x20040040) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001d"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0xc31fe084736598c) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5}, 0x38) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080), 0xc) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x811}, 0x4000804) 18.506607228s ago: executing program 2 (id=809): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r0}, 0x4) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="18080000d0ffffff000000000000001718110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b706000014000000b7030000000d00008500000005000000bca900000000000035090100000000009500000000000000b7020000000000007b6af8ff00000000b50902000f0000007baaf0ff00000000bf8700000000000007080000fffdffffbf2400000000000007060000f0ffffff740200000800000018200000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7010000080000004608f0ff76000000bf9800000000000079080000000000008500000005000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0xc, &(0x7f0000000040)={0x0, 0xc8a1, 0xdb00, 0x8, 0x4}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000", @ANYRES32=0x1], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x1f, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) listns(&(0x7f00000000c0)={0x20, 0x0, 0x100000000, 0x4000000, 0x0, 0x1}, 0x0, 0x0, 0x0) 18.422777451s ago: executing program 2 (id=811): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x44541, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000007c0)='sys\x00', 0x1ff) mount(0x0, &(0x7f00000007c0)='sys\x00', &(0x7f00000007e0)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000008c0)='./sys/devices/platform/vhci_hcd.0/attach\x00', 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x7, 0x20002f9}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x503, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffffe}, 0x50) r3 = socket$inet(0x2, 0x80001, 0x84) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{0x0, 0x60}], 0x1}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)='8', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x4000845) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000002c0), 0x0) writev(r1, &(0x7f0000000900)=[{&(0x7f0000000980)='\t', 0x1}], 0x1) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x3) pipe(&(0x7f0000000180)={0xffffffffffffffff}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, 0x0, 0x0, 0x1, 0x5}, 0x94) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r4, 0x58}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r5, 0x1, 0x4d, 0xffffffffffffffff, &(0x7f00000003c0)=0x16) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000002000)=@newtaction={0xecc, 0x30, 0xb, 0x0, 0x0, {}, [{0xeb8, 0x1, [@m_gact={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80006}}, @TCA_GACT_PROB={0xc, 0x3, {0x2, 0xbf2, 0x4}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe60, 0x2, 0x0, 0x0, {{0xa}, {0xe34, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x3, 0xfffffffc}, {0x6, 0x400, 0x9321, 0x9, 0x6, 0x7}, {0x5, 0x5, 0xffffffc0, 0x0, 0x3}, {0xe, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x40080003}, {0x3, 0x3, 0x80, 0x0, 0xacc8, 0x2}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0xfff, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4, 0x1000000}, {0x8004, 0x80000001, 0xfffffeff, 0xdf, 0x4, 0x5}, {0x0, 0x80000001, 0x9, 0x7, 0x7fffffff, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x1}, {0x7fffffff, 0x1, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x5, 0xf}, {0x9b7d, 0x52fc, 0x6, 0x40000003, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x9, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff417, 0x1, 0x3ff}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0x3, 0x3, 0x3ff, 0x1, 0x400}, {0x1, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x3, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x381, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x6, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3, 0x7}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0x7}, {0xf85, 0x2e, 0x100, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000, 0xcb06}, {0x4e2, 0x6ae, 0x2, 0x100, 0x5, 0xd}, {0x1, 0xcad, 0xa5, 0x2, 0x4d800, 0x6}, {0x20, 0x7f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x2, 0x0, 0x1}, {0x2, 0x8, 0x10000002, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0xffffffff}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x2, 0x4, 0x800, 0x1}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0x103, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x8, 0x7023, 0x8, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x8, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0x40, 0x2, 0x89, 0x2}, {0x2, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x9, 0x7, 0x2}, {0x7, 0x1, 0x8, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x8}, {0x100, 0x3ff, 0x0, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x6, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xfff, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x3ee, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x8000400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x2000007f, 0x8}, {0x5, 0x25b, 0x0, 0x3, 0x2, 0x2}, {0x29dbdf0, 0xd, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x400, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800002, 0x3, 0x10, 0x5}, {0x7f, 0x7, 0x6, 0xffffffff, 0x3, 0x8}, {0xfffffff3, 0x5, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x4ce}, {0x6, 0xd, 0x6, 0xfb0003, 0x1, 0x7}, {0xe0, 0x100, 0x1, 0xb, 0x8, 0x7}, {0xfff, 0x1d, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x9, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0x800004, 0x10001, 0x2, 0xce}, {0x4, 0x8, 0x8, 0x3, 0xf, 0x9}, {0x8000006, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0x3, 0x4, 0x7, 0x7}, {0x4, 0x61c5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0xc651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0xfffffffe, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x36b6800}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0xae82}, {0x6, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdc}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x7, 0x3, 0x400, 0x81}, {0x970, 0x100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0x1a5e666b, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x7, 0x101, 0xef}, {0x70a0, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x402, 0x4, 0x8, 0x7}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d8, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x0, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x800, 0xfffffff9, 0xa, 0x4b64, 0x80000001}, {0x2ad78a25, 0x202, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x129, 0xc}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xfffffff9}, {0x4a3, 0x0, 0x3, 0x514c, 0xf8a, 0x19}], [{0x1}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x1}, {0x3, 0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x5}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}, {0x1}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x2}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4}, {0x6, 0x1}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x10, 0x5, 0x0, 0x1, [{0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}]}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xecc}}, 0x0) r7 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x2, 0x325}) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x84) io_uring_enter(r7, 0x12a, 0xffffffdc, 0x17, 0x0, 0x0) 17.553689093s ago: executing program 2 (id=817): r0 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'ip6_vti0\x00', 0x0}) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000600)={&(0x7f0000000180)={0x24, @none={0x0, 0x2}}, 0x14, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x44090}, 0x80) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040)={0x7, 0x9, 0x5, 0x4, 0x1, 0x4, 0x7f, 0x26, 0x7, 0x8, 0x2, 0x6, 0x2}, 0xe) r4 = open_tree(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x9901) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000380)={'sit0\x00', r1, 0x7, 0xd0, 0x37, 0xfffffffd, {{0x23, 0x4, 0x2, 0x2, 0x8c, 0x66, 0x0, 0xae, 0x4, 0x0, @multicast1, @remote, {[@noop, @timestamp_prespec={0x44, 0x2c, 0xfb, 0x3, 0x1, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1c000}, {@multicast2, 0x5}, {@broadcast, 0x6}, {@multicast1, 0x9c}, {@rand_addr=0x64010100, 0xa7}]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x1f, 0xb3, [@local, @local, @empty, @multicast2, @rand_addr=0x64010101, @local, @empty]}, @generic={0x88, 0x6, "bb4e7295"}, @generic={0x7, 0xe, "7e1d1e3eb84d691d94b63e5c"}, @timestamp={0x44, 0x14, 0xdd, 0x0, 0x8, [0x4, 0x81, 0xfffffd68, 0xfffff93e]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@bloom_filter={0x1e, 0xfffffffd, 0x800, 0x7, 0x2400, 0xffffffffffffffff, 0x4, '\x00', r1, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0x1}, 0x50) 15.278233803s ago: executing program 5 (id=831): set_mempolicy(0x3, &(0x7f0000000040)=0xe3, 0x8) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x303a, 0xffffffffffffffff, 0xe80a0000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, @perf_config_ext={0x4d5, 0x3ff}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0xc3, 0x0, &(0x7f0000000300)="cff72c72a33bc30a1198699d50939a54493ef6eda26df1f57fe2d30830fc6dc2b7f53135cb2b55860978e3e916e16e675653e35ab70770c6577762f0c53a9d8928159a7ce9488f1423f81c7efb9b6d9a587c73bc54835f8165836fc4d1d85f7b7c798ab174b5528c15c4ce75dc654807153abefb058e5d3f2ac8c2c10d6269a0e7eed3f3d438bbfea8df037b252125812d129206b2abdd629c5d474b74d7fa5184aa30912b31bf0d7c858e5834ee9c7af5b55b1d6e488c43485aeb7bac3a34d9572e0f", 0x0, 0xfffffe00, 0x0, 0x2d, 0x119, &(0x7f0000000240)="50fe4c04c3a92254375d801f70f8422de639f5134a1d6e261e5c2a7d650ad1470976b55fa70c3a649e9dc82510", &(0x7f0000001e00)="5b38c54c54f6f65139c530f10baa23530d18844a2c797cd61613000047676f71e8e8a4fcbf16bf57fc9bcffbdeeefa1a8a531bbbb6d541fa2e1785f9a511fcce32ba91b6b968a2a0a95759c8de8d022f6b5679d34b6ebf1ea6b2232f3b139d96315b9815e0a0e03878dbdd05f6bbff580a98283324c8a21d840892b20a163a92f502423e60eefc738c591e3607441b78a8a9ea74ca802bb99d0b422cee5e2df2d975b386775d6694f7588a8e4da61977593014eb8beceba0497685b9cd72ec5e6f9187a18561809815157dad4c4a4008cc70bef43ad48110d8aa2eb21eebdecb3531706fbaa6f128f29cfea22fc49edb4defcc45b3acf0fed71e8cf9f7f88f95791cf4e3434de1e03977a40a057cf73c7921b5cb49a838c91c", 0x2, 0x0, 0x8}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500), 0xc) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000400)={0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000001c0)=""/5}, 0x20) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) futex_waitv(&(0x7f0000000780), 0x0, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1) futex(&(0x7f0000000080), 0x3, 0x2, 0x0, &(0x7f0000000140)=0x2, 0xfffffffd) 15.194192037s ago: executing program 5 (id=832): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x8, &(0x7f0000000500)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [@jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0x3}, @alu={0x7}, @cb_func={0x18, 0x0, 0x4, 0x0, 0x2}, @jmp={0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) keyctl$set_reqkey_keyring(0xe, 0x1) (async) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000000)=0x4) 15.11161255s ago: executing program 5 (id=833): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x8000, 0x8f, 0x0, 0x7}, 0xe3, 0x1, 0x1, 0x7, 0xff7, 0xc, 0x1, 0x10, 0x7, 0x7, {0x6, 0xfff, 0x10, 0xffff, 0x6a1, 0x8}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@newtfilter={0x34, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0040000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000001", 0x2e}], 0x1}, 0x4005) 14.991481313s ago: executing program 5 (id=837): r0 = openat2(0xffffffffffffffff, &(0x7f0000000200)='./file1\x00', &(0x7f0000000240)={0x4000, 0x104, 0x39}, 0x18) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r0, 0xc038943b, &(0x7f00000002c0)={0x1400000000000000, 0x10, '\x00', 0x0, &(0x7f0000000280)=[0x0, 0x0]}) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_wakeup_irq', 0x202100, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x972, &(0x7f0000006680)) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffff70) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r1, 0x84, 0x1e, &(0x7f0000000140)=0x80000001, 0x4) syz_emit_ethernet(0x3e, &(0x7f0000000180)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x1d, 0x30, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x1, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x68, 0x6, 0x3, 0x4, 0x0, @empty, @remote}}}}}}, 0x0) perf_event_open(&(0x7f0000001880)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401f, 0x5a0d0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x73, 0x1, @perf_bp={0x0, 0xb}, 0x13c0e8, 0x0, 0x0, 0x989c6d54a3fb7abf, 0x5, 0x1, 0x7fff}, 0x0, 0xff6fbfffffffffff, 0xffffffffffffffff, 0x1) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x21081e, &(0x7f00000001c0)={[{@grpquota}, {@nogrpid}, {@quota}]}, 0x1, 0x4fa, &(0x7f00000005c0)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") syz_clone(0x100, &(0x7f0000000340)="0b11ad1eaa79048b50ba287c5940ed4d26df42c7f7d20b8d2e3415daa37de495f6c399755c37fc0b0709e54d0978c0c97e3e74c5d638cb66ab525ede8d4d61577323b2d31fc327a13f4e0390f99014b9a9814f47d71195c307df270231be3cdf111b91f4", 0x64, &(0x7f0000000400), &(0x7f0000000440), &(0x7f0000001900)="88f77243ebfbd4b65a2f871274309dac56d88e6804c2aa8722b9b5ae867215ad780cd6041b07d5381aae79f6f062a55f7ac2940811e3918ff88b748090a989b71d7509d800b28f2dfaa929bcc7f390e445b36f52b54a5ba59323262e126cb0ce0ce296b4cd8476cda81839aa80b506245f699b3cf37666653e0dbd53d8bb40e5967f25f81db976a48bda736291b6c252b38c8dec41b2136067e0e687b30ca0fbd3db639ecc99b4a9f61661177e0134c74e64a0bbccc40752e2a9c9928a19d72cbe6fd11d1008e3a96b2aaaf356e06e0b58ac6a71e82e36d5238ae76bfbc693fb8b8a375861e75eb08217c9295bd4d48f42f9449e438a2797ec6a0162b122440ba51298ff579a8600c2a3b7694acabea218ccc7ed018f15fe482d1fd40e9c9cb18581ea3ece7417737fad873f17eb9edf806f52faa70b8621d01dfa06dacdf221cb065efdc0f037d1533bc0fd0df4787d4401500f5c3b79715ad89a708acef3f091c6a640b284117b842da777c0cc522dc077d107ec9a7ebe5045ed99ad3f1a1573646a52a5bfc66abe164972a175ae1ce2faa93dd87f52f49ba8c8a7631afe98ef03c3003c1dfa762b9c740e6fa940b3e3b9658494b3263ada2ec0e66093afbe51c354d52c993ea30869acaad9784525a8aed0bd32625a38cf327c651a0b08605dd17e3df81d9ca1debd1ee28f988ec01d4a84fa8dc6f36f5ea1c2432ee7258eb8bf52858c90b006d9b361d36e3f5078217fb616e4ec91499a3700ee6555d1c78866d540adcb0e53720e03589f7447ee0f640f38a026e83a2652cc4b66b92bece31069e30f61b5087018f50b9b9dd4d248ce381d3aa001526348b4837cdb7a0174b6453c0a31f2d3a1e2eb0fa1287a4ac81f2eab035c0b333439dc2dead57acb3a977cec0fc1d2996dc93bddfc539e94d7076d7c35364ebef63296da1c2a2ccb91ebd3aaf067ac4c9ec564909bf4ff444c5e55794a97c38e9951ca867a20784d95796d32090b81ce5313d8419c66b80f28edff474b92fe7db0c6bc8465195edca5cea6ee76a906e51342940d1bdc5ebbeceabdbfef0c7d0481c445d2ef3094629b80e95194426fe986c0b8414562ae73f2587b1e4994e392afa245ecec466c0fe8f29dc61fc796fd73452b56cfd3602a73f2d8bd6ee4a032de5a79fe1e3370d27946bc7120ffd66b52f07c28203a486de627afac6d36f8a172717aa62edfa97ae4e1ce90b8c0a1c3f61ab1fe4d3a7d93cd3ca446cb202f3a00c0b6f9ab3dd900cbb35dfd201ad08be1bc78f41988b5fb3a8d9223f796e3a3b767cf15abee74699b36042e6c6d07a2f9b730a4ce94a871cde1fb30e66ad907253935ef5e8ee4900af39e08fd5b1247bc41c98b53cd4e38c466815acc88c9d21340ac8680b77b2b73933fa50711fdbd94fa385efa133641d64f0c7f6dc89ea28ddceaf82819754dbfb0ebfaddea82a9a0f5d3b47c2fe3771c01057d04ba7c4a1747a718d5f4210036472ea7b78837ebfc5c4c1e64326b14beb8b0cf287900662ff0aa4562d733bdfbf130d0db0b867eeffc3d0997adf38d1dfd414a37146f350c1533aa1045c8012d38ad3b3d1d3cd254d445e9e67e58caf99af8b27d49093cfbf60917531e0205faa37c5211d974a1480419566df22be964dbecfd230855f7dead07dead4575990ba470a184ac9e53bbac736bb380c1bd38d4533ece6ec06aebae3aac8049961c27121e0661d83e7ae91048d717d9d9acaf399ea264098f4781986fb361cd9888d04053901b9f21369b4f1ea8d91e4b5333e01075db56d0f3ef2bd4548826dec72caafafce71a153c67f26c85ec275dc2ac14293591a0791cfb6b7c4dd4f47d79f18a330f898688d05df088437f8d0449ed368f7a3ab606e7b1b9e1b238c30e11e364a726782f5e13a8c4fec622c09320a8b9b120dc590f074334cf2c392b108f0e064ed58ca7fdf5f5c456790dbeb8bb5aa857f6cf20b0ec749ac0322f528e40bd9761177913477d81264cd9eab44976f8d261ea36b20b52fcc2023789dec5a52f214c0cfdfa74a8e85ad62718f6b35bc1bb51ded77c4e10c53653a14a5cfaa59f06640bff7032b6859dac88e7fedc6459cc59e92790123f3b9f09f414f1daa5600d37bfbc35947004f98c883b17c8d31562644b27fe43d99e6b65ca974e88e789370f7de3e2f9caaa20cfa3e93097aba928dae066c0223a759de1ca14d0b868b54b1d2791a4e7355dc4f6cf1a222d41e072e4009752589c110a7608fafab977dd2ddc968c38739ae1ea17dbc56f04e560efe414ee17d1ebef93bd27e0980e52d193b38e0b5f02affd16e94b5c1da22c901384538f09f1153c9cdd2b6d2ebfef0388500f7f060cac48c1b925659b674cf96d668a917a79766e2c6caeb01e72446828a23cf5bc30fa4f39cc9ae57d6be3a3706c83206c2f80bd1b05e66de1f7e0946ef68efb144fa2e50b1f3920a326f44098b8e25508ac2eac8fb4ffa6ea04d707d61e6bc39b325b4354f577e740da3f804c0b5bc8122d721e0cd839cdb0b0d4778603e9f8c552ff8511d6184a590bc0bbdd76ddeca34ce478e5cd50ec7f4dbfbec72f3cb8a43a0b4abe74f9a4ed7d67a154ed823021eb69cdcd77589db3abfd82330300a0b989f4eb2fb34f27464eec58eda3b7ed5c2c63c6b63f9f02a43630905aebcb2f045339dd5b19a94f3d5abb67fbc9442e847bfd1a7a64bd3fd99693b7c4220dda18d94e06c5e05db97178ac2692028ac585eebd652a73f2e873ac4ab0a193dfb9ef8d223b6cf38f6f433f1afd19487f9505c4742f1e6606c5f50c79e9f145f82b1e612545139412a4269d5188eb65c6afab00c33da53e4f8baee4e48ba2af32f59c862e54f9689fb3ef60fca968c1551dcfee2e1e468c7f55ade50a60cc5908553cba15cdf434f12f800b718fc864db6646d51836d8b3217445feabc620e9754e1e5ad282246db54ec9e3a78c17b156cccbe476ab53b388ea7e92de75d814a9b7c492f0625a55b36f6587c15fe77e2affe392275f50f94b9daf2ed824676a8699e626d783955929d09a4fe0596a3b528b513ec9d6bf262e7a07a6100684225be916bad9c211497fe06c1b76069bc4b95f32b5ea597ccdda5873e955d902298fc33920d0a87c053961ec590c3994b682f68bdb7db6f894d3287e9610aeb0a853de98b4c28a186ac22368219d8d6d45d5021c339ec1223f02416315a0dad9fbe4cdbb584985f6cba3eaf2fade51f22d41ac6f13f45ac1a718be2634c8244ba4b7124eca3e68eae071fcc190887acc50797485bc7731d2daa1d327619fe0865760efb5e8bb245611d3c49b393f437f023e7efa4d06613624149f52a0eb7daa8274f2ff2727caa1cb9ac8c4bd132a8034dcbce537b1fc3b9323641f3afe4863d076ef51e21739366944a4a970e9b59b45562ae6cb9ebc51e645a81e590ea788a7f3f7c65d88884ab8ca1cf86f4765f306527dd48087a63a69e6328c6a9daa099b6473e926a01a0cccf521a66042437cb916ebef9ce686e71c08dd981de9672560e5864ac5b8d9cfa2e3108239fd0b78f5d7d75a95cf3ceed6a99cbafcd961af7a1feedb6b3963a180f974b9103c33dd63c16abb79bd73f9e8b317973cab7fe5d2e6303a914f614d51175cfd4032e26dcb3abcd7c2f95dcef1a666093a797ac0c57b98d6ab018bc6e57fc77078ea8b454c060cef79256162a59c81a87fc5e1f3b2f8db0528a200c9d5d804ff4e49533e009f43e02e466d56202047aece1edf8488891876fa04a5302cc3a47091c9c7ac3f36bdc56a18efec58dd89a354370a9f10937584b94dc22906340e8cc5e52559df74bfdb3c09dc3bd3a249afd6e420799dbe170fc4e3e2fcedd94cb94dca8429349b48051086f113586aa44f7e85aaae0353fd12c61f7cdf10eda22d787654a277eb37c5149b7700fe1ceab69340822ed4deee913357e1866eb616b73102742669da52a3c6c4b6317cd86c5e0eea3e5c6c26fa8a8b213a79324aa070a376403568c9720bb84847f5207995f20eefe38bc0a9d271994d11c790140e88a6c8e7c096c797cc746c24cac926e3dd1153c3872a19c16439fe1c2c05908e7c86d1b70e345f67effa8363a7e293fe38c87395f7f512ed0e1e96314dc81de1d73649eb2ffdfd0fd5ed2cd780d1ffea0610714f1e0d2eeba6808e6e00bf1c79c2e297b70cdd8f8ec28b1a84e73ea587ae784390a8cdd173e60206aaa7d69c6706c20164545559a34ec0c11e752051f886b8962e54a024ec2a1c49bc5b58fc1315393420ef042d3ac9b082716224b90cfc3b20fffb966fb1954e9ce62fca1a145afef834898051b36e19da924b6da0438055db0c108adcc37844e0d182269d7ecca15267f87358169671110957810fe2bd590b9ba01aef1437c49117ead931fccff01a68d86298036740d53be7702dcf0b61077862e084a30306d70ea5c33edff3194430274895d53a22acf705df1c27cb2706b78af5649af93e5bd1b4bf3e913e6aabe06032b1e9b0077b6422f42e261c51b10ab0aa95d3bad778f2bdff987063f09bb79b24191e64cce1f0149d41c5f887c48b6905b994b7648be45abf42a5d5f7cb81904711b1a12d705dcbc81d4b3625a185edde6dcf9e5366f14b39c5c18a507f436d8b5de957430c361438e19f684c43d331837ab2f31673ac77963246d2e16179de6f554aed9e2ad7bad214c9eb3e1f71d14798617851fbd67f24b95a914bd90541abd2e2d4fe36f429eccbedfd514b006a4c706adcb6edf11a44233c5b34aead138b52b528d33b911606c3e88f0f72483cb7502a37bf225baa9e87e4000dd62de13d32276ac7bc098b7d309ceedd58a09c4e4220605c5c25294f7f8ccb41673b2053687052418651f22e5431a02e4d36a10a042282fd1842f53602b6cce43971a07842624827fc43bbe3e37581b6b322e1b5e67e5762e80ef6a42cbe4cca3fd3bfc96ca88e3ac833c6edbd7b6e498dc377a3351fd0385ebe25e9a9f5818010d182eaee42bdca2be6c24b23cbd1fb9f9e509b76036ae5b20df631b1a482000450b1c0123d3d0e9a5aeb1c1de1be15720947afe33c4df449d2ad573a1b8beca374c62bebe722396f71f7d11d401227792ea56598fdfe1ebb914c2500e02632723b059887391b5f275015d3501f777b33a944823de803c4ba6b5c301b1ee78744fbc98d6bbe4411516dc84ae20839dc1ae7b8be01ab6b4b993f2f28fbfc3d41455114f564d8917265b4a739323de6d6dc07561067a034e459702a232a2421ba962699390d6c63583900b323050d18d45c9c51251c45682035a106fac3d78fc6e6db6a768a20a0045aeeee12cbf7e55282c9c9246366e7ea0c7df2057ffce6192aedf5298ce6274b9d80b2540fc647338ac07c18bea81a36bce8e65bbb86bb6db23bc26abadacf4cd6c6aa38f6aa2b468b6d556b54c9a2c9f2f4192ec2f3d98a97025159618569bd52159acba270402d71915234fb893a882abbaabc93a790926ae6b9024fef400b54cfc92ec5692d6905a3bf7f4a7a508e0b9ee7481a2301d8f4121999cc2a872d9c743e71f9075d06f8154361efe4103fe7d19282a5735313e15b928ba0d6aaa140c32cfb16f94e8941af9d855f408e7f637ff8cb768d719484f093a8c58f7370766f77ee0cb9349403d3deea63442b86b4e39f3a07061bee023ed9844c860d2429c11e3696b2b5e7678329ad96eb7cfd29843d6e9f96394d8ea31c3294b5a86d3bfeab47361f2a3450cbf7f94c0fe3408e93b7b50bdcaa81a42b39be7b06d0167978cccad13d3d6f90") r2 = socket(0x10, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) set_mempolicy(0x4005, &(0x7f0000000080)=0x10000000004, 0xd) r4 = socket$can_j1939(0x1d, 0x2, 0x7) setsockopt$SO_J1939_FILTER(r4, 0x6b, 0x1, &(0x7f0000000000)=[{}], 0x4000) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="7c0000001000370425bd70000300000000000000", @ANYRES32=r3, @ANYBLOB="0b1b0500000000005c0012800b00010069703667726500004c00028008000100", @ANYRES32=r3, @ANYBLOB="14000600fe8000000000000000000000000000bb14000700fe8000000000000000000000000000bb08000d00ffffff7f06000e000100000006000f00"], 0x7c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000010) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f00000003c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000540)={0x4, 0x100000000, 0x3, 0x8, 0x6, 0x6, 0x20000000ffd, 0x6, 0xfffffffd}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_open_dev$tty20(0xc, 0x4, 0x1) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r5, 0x84, 0x5, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e23, @loopback}}}, 0x84) 14.624508415s ago: executing program 5 (id=839): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/sda\x00', 0x2, 0x0) ioctl$SG_SET_TIMEOUT(r1, 0x2201, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0xa040, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syz_tun\x00', 0x7c2}) bpf$PROG_LOAD(0x5, &(0x7f0000001d80)={0x11, 0x10, &(0x7f0000000080)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x8002}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0x7d}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x34, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 14.344039673s ago: executing program 5 (id=840): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xd, &(0x7f0000000000)=ANY=[], 0x0, 0x7fffffff, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb27}, 0x94) mlock2(&(0x7f0000751000/0x3000)=nil, 0x3000, 0x0) munlockall() openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x2d41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="8510000000000000181000", @ANYRES32, @ANYBLOB="0000000000000000950000000000000045"], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x89f2, &(0x7f0000000040)={'bond0\x00', @random='\x00\x00\x00\x00\x00 '}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0}, 0x94) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x48002}, 0x840) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483e0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_bp={0x0, 0xa}, 0x50, 0x2, 0xfffffffe, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x4e22, 0x5, 0x1, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {0x9, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in6=@private2, 0x4d3, 0x6c}, 0x2, @in6=@mcast1, 0x3507, 0x1, 0x3, 0x9, 0x2, 0x1, 0x4}]}]}, 0xfc}}, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x1, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x6, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r3 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890b, &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="db2a00fe1001000071101c0000000000"], &(0x7f0000000480)='syzkaller\x00', 0x5}, 0x94) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@migrate={0xcc, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@local, @in6=@empty, 0x4e23, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in=@multicast2=0xfc020000, @in6=@mcast1, @in6=@mcast2, @in=@broadcast, 0x6c, 0x1, 0x0, 0x0, 0x0, 0x2}]}, @user_kmaddress={0x2c, 0x13, {@in6=@remote, @in=@local, 0x0, 0x2}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000a80)={r4, r0, 0x5, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x4000000007fff, 0x0, 0x1}}, 0x40) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000001c0)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'syztnl2\x00', r6, 0x29, 0x3, 0x0, 0x4, 0x1, @private1, @mcast2, 0x10, 0xcf3f84fbccf9f44b, 0x1, 0xe9c}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) 14.278286691s ago: executing program 33 (id=840): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xd, &(0x7f0000000000)=ANY=[], 0x0, 0x7fffffff, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb27}, 0x94) mlock2(&(0x7f0000751000/0x3000)=nil, 0x3000, 0x0) munlockall() openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000080), 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x2d41, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000800)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="8510000000000000181000", @ANYRES32, @ANYBLOB="0000000000000000950000000000000045"], 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x89f2, &(0x7f0000000040)={'bond0\x00', @random='\x00\x00\x00\x00\x00 '}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x0}, 0x94) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x48002}, 0x840) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000011008188e6b62aa73f72cc9f0ba1f8483e0000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_bp={0x0, 0xa}, 0x50, 0x2, 0xfffffffe, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000c00)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x4e22, 0x5, 0x1, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, {0x9, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in6=@private2, 0x4d3, 0x6c}, 0x2, @in6=@mcast1, 0x3507, 0x1, 0x3, 0x9, 0x2, 0x1, 0x4}]}]}, 0xfc}}, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x1, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x6, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r3 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890b, &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB="db2a00fe1001000071101c0000000000"], &(0x7f0000000480)='syzkaller\x00', 0x5}, 0x94) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000500)=@migrate={0xcc, 0x21, 0x1, 0x0, 0xfffffffe, {{@in6=@local, @in6=@empty, 0x4e23, 0x0, 0x2, 0x0, 0xa, 0xe0, 0x80}, 0x2}, [@migrate={0x50, 0x11, [{@in=@multicast2=0xfc020000, @in6=@mcast1, @in6=@mcast2, @in=@broadcast, 0x6c, 0x1, 0x0, 0x0, 0x0, 0x2}]}, @user_kmaddress={0x2c, 0x13, {@in6=@remote, @in=@local, 0x0, 0x2}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xe, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000a80)={r4, r0, 0x5, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x4000000007fff, 0x0, 0x1}}, 0x40) r5 = socket$inet6_udp(0xa, 0x2, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000001c0)=0x14) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'syztnl2\x00', r6, 0x29, 0x3, 0x0, 0x4, 0x1, @private1, @mcast2, 0x10, 0xcf3f84fbccf9f44b, 0x1, 0xe9c}}) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000040), 0x8002) 3.884428253s ago: executing program 34 (id=800): syz_io_uring_setup(0x3bd4, &(0x7f0000000180)={0x0, 0x60bc, 0x130c8, 0x6, 0x30e}, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) unshare(0x6020400) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0200000004000000ff07000009"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xd, 0x6, 0x4, 0x7fff, 0x1, r0}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x9, r1, 0x900}, 0x38) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_STRSET_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x28, r2, 0xb589de7b26d064b1, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x16}]}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c811}, 0x4) 2.861509117s ago: executing program 0 (id=899): mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/tty/ttyS0/console\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000600)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, @perf_config_ext={0x1, 0xfffffffffffffff0}, 0x3930, 0x1, 0xb56, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r2, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r2, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r1) sendmsg$IEEE802154_ADD_IFACE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000080}, 0x4000000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/trace_clock\x00', 0x201, 0x0) writev(r4, &(0x7f0000000640)=[{0x0}], 0x1) write$eventfd(r0, &(0x7f0000000040)=0x774, 0x8) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r5, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e20, 0x8, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000400)='`', 0x1}], 0x1, &(0x7f0000000a80)=ANY=[@ANYBLOB="480000000000000029000000370000002b0500000000000007280000000308480400030000000000000008000000000000000104000000000000080000000000000004010300000014000000000000002900000043000000080000000000000050"], 0xb0}}], 0x1, 0x4000801) shutdown(r5, 0x1) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000080)={0x0, 0x4}, &(0x7f00000000c0)=0xffffffffffffffcb) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x552, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_bp={0x0, 0x7}, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x100000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000000180)={0x1, 0x3}) setns(0xc9, 0x0) r6 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$bt_hci(r6, 0x0, 0x60, &(0x7f00001e3000)=""/30, &(0x7f0000d23000)=0x44) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x200000, &(0x7f00000000c0)={[{@dioread_nolock}, {@grpquota}]}, 0xfe, 0x568, &(0x7f0000000680)="$eJzs3c9vFFUcAPDvbFsKFKUkhKgH04SDGGRLW39g4kGPRokkesdNOzSkW5Z0t4RWEuEgFy+GmBgjifEP8O6R+A/4V5AoCTGk0YMe1sx2FpZ2t122C63s55MMvDdvljdvZr6P9/btZgMYWBPZH4WIlyPimyTicEvZcOSFE+vHrT24NpttSdTrn/6ZRJLvax6f5H+P5ZmXIuLXryJOFjbXW11ZXSiVy+lSnp+sLV6erK6snrq4WJpP59NL0zMzZ96amX73nbc3v3i0t7a+fu7v7z+58+GZr4+vfffzvSO3kng/DuVlre3YgeutmYmYyK/JSH3jgVN9qGwvSXb7BOjJUB7nI5H1AYdjKI964Pn3ZUTUgQGViH8YUM1xQHNuv+U8uP78zfLuf7A+Adrc/mT9vZHY35gbHVxLHpsZZVdivA/1Z3X88sftW9kW/XsfAmBb129ExOnh4cf6vxejpf/r3ekujtlYh/4Pnp072fjnjdE245/Cw/FPtBn/jLWJ3V5sH/+Fe32opqNs/Pde2/Hvw0Wr8aE890JjzDeSXLhYTrO+LesmT8TIaJbfaj3nzNrdTes/Ta3jv2zL6m+OBfPzuDe8Yb1rrlQr7aTNre7fiHhlm/Fv0ub+Z9fjXJd1HEtvv9qpbPv2P131nyJea3v/H811kq3XJycbz8Nk86nY7K+bx37rVH/X7f+34yO0I9n9P7h1+8eT1vXa6pPX8eP+f9JOZRNJvmj6hM//vuSzRnpfvu9qqVZbmorYl3y8ef/0o9c2883js/afON4+/rd6/g9ExOddtv/m0ZsdD93t5z9r/9wT3f8OiXrSsejuR1/80Kn+7vq/NxupE/mebvq/Lc70scROrh0AAAAAAADsNYWIOBRJofgwXSgUi+uf7zgaBwvlSrV28kJl+dJcNL4rOx4jheZK91jL5yGm8s/DNvPTG/IzEXEkIr4dOtDIF2cr5bndbjwAAAAAAAAAAAAAAAAAAADsEWMdvv+f+X1ot88OeOr85DcMrm3jvx+/9ATsSf7/h8El/mFwiX8YXOIfBpf4h8El/mFwiX8YXOIfAAAAAAAAAAAAAAAAAAAAAAAAAAAA+urc2bPZVl97cG02y89dWVleqFw5NZdWF4qLy7PF2crS5eJ8pTJfTouzlcXt/r1ypXJ5ajqWr07W0qQ2WV1ZPb9YWb5UO39xsTSfnk9HnkmrAAAAAAAAAAAAAAAAAAAA4P+lurK6UCqX0yUJiZ4Sw3vjNCR6StRHI9oX7XbPBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACP/BcAAP//AgM4fw==") unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 2.626880482s ago: executing program 6 (id=902): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x4, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000008500000018000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0xf61cb000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'syz1\x00'}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x2}}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0x0, 0xffffff00], [], 'erspan0\x00', 'netdevsim0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'vcan0\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xf9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r2, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x40, 0x5}]}}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x400}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x19, r3, 0xffffffffffffffff, 0x274b) sched_setscheduler(r3, 0x0, &(0x7f0000000000)=0x6000) r4 = timerfd_create(0x8, 0x0) read(r4, &(0x7f0000002180)=""/262, 0x106) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x2f, 0xe, 0x0, &(0x7f0000000180)="e4e6abc9f494d44d5166a7ad6797", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.361721755s ago: executing program 35 (id=817): r0 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'ip6_vti0\x00', 0x0}) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000600)={&(0x7f0000000180)={0x24, @none={0x0, 0x2}}, 0x14, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x44090}, 0x80) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000000)) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000040)={0x7, 0x9, 0x5, 0x4, 0x1, 0x4, 0x7f, 0x26, 0x7, 0x8, 0x2, 0x6, 0x2}, 0xe) r4 = open_tree(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x9901) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r4, 0x89f0, &(0x7f0000000440)={'tunl0\x00', &(0x7f0000000380)={'sit0\x00', r1, 0x7, 0xd0, 0x37, 0xfffffffd, {{0x23, 0x4, 0x2, 0x2, 0x8c, 0x66, 0x0, 0xae, 0x4, 0x0, @multicast1, @remote, {[@noop, @timestamp_prespec={0x44, 0x2c, 0xfb, 0x3, 0x1, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1c000}, {@multicast2, 0x5}, {@broadcast, 0x6}, {@multicast1, 0x9c}, {@rand_addr=0x64010100, 0xa7}]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x1f, 0xb3, [@local, @local, @empty, @multicast2, @rand_addr=0x64010101, @local, @empty]}, @generic={0x88, 0x6, "bb4e7295"}, @generic={0x7, 0xe, "7e1d1e3eb84d691d94b63e5c"}, @timestamp={0x44, 0x14, 0xdd, 0x0, 0x8, [0x4, 0x81, 0xfffffd68, 0xfffff93e]}]}}}}}) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@bloom_filter={0x1e, 0xfffffffd, 0x800, 0x7, 0x2400, 0xffffffffffffffff, 0x4, '\x00', r1, 0xffffffffffffffff, 0x3, 0x2, 0x0, 0x1}, 0x50) 2.182137965s ago: executing program 4 (id=904): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r0, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {&(0x7f0000000080)}], 0x2) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f0000001340)={0x1, &(0x7f00000012c0)=[{0x4, 0x100, &(0x7f0000000080)="5f55f87688b4addd2b32e480e4cd993560795955b2b46e28fdc4c62e9bf2b6bbb6a9527cb32f61b04c7aabcb72a1589091afe7129c147dbe6c4cc467caeff8b0f31d6adefeaa8d93e79b160d6521ad4e4865a94debb91fbc4ef4362f99fbddad6aa3ebc39140fc40d92f2071a15e422b4bc0e06a04d67c778f253e380161697a13c2c338c2d5feaaac9d7ce1e857e818af5c80eb15b2d8b19b4ecbf8156e918b9774ed90c29ee55e6c7456bc02ec9b42d7031cf9864ad4524c7e1710338ab745dbf7c0369973239d0beb0a1e053e5408aeeb063e7aed768ce12767590f71f6dd3788ed92f00976da9d065bf2de187741aae0e8bf0af69ab30655fd2994a49407", 0x1}]}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 1.963640085s ago: executing program 4 (id=905): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(0x0, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400004, 0x0, @perf_config_ext={0x80000001}, 0x82, 0x0, 0x0, 0x1, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) mq_open(&(0x7f00000004c0)='bata`\xde_sla\x00\x00_1\x00x!\x98\x842\x01\xa3y=\x10\xec\xb9\xfa\xc8\x96\x8d\xd1\xde\x95\x8a\"B\xbdRE\x95jl\\\xcd\r\x13\x05\x9c\x1c\b\xf5\x9d\f\xf0\x99^x.\x0f\xc3l\x9a\x9e\xdd\xca\t\x91v\x9a\xc9\'O\xcf\xb2(\xe3\x89|\xf4;\r\xa999\fzM\xb0.wy\xd8\xe4\xa35q[(\xf2)\x02.\xc5\x960x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x5, 0x6}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x6}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000801}, 0x0) write(r4, 0x0, 0x0) openat$fault_inject(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/fail_make_request/times\x00', 0x1, 0x0) 1.759453392s ago: executing program 0 (id=907): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x8c, 0xfffffffffffff359}, 0x0, 0x80000000, 0x0, 0x9, 0x800000, 0x43, 0x4c7, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close(0x3) syz_clone3(&(0x7f0000000080)={0x180800400, 0x0, 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8c, 0xfffffffffffff359}, 0x0, 0x80000000, 0x0, 0x9, 0x800000, 0x43, 0x4c7, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x12, 0x1, 0x8, 0xb}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000001c0)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r2, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r0}, 0x20) r3 = eventfd2(0x5, 0x800) write$eventfd(r3, &(0x7f0000000000)=0xffffffffffffffff, 0x8) sendto$inet6(r0, 0x0, 0x0, 0x50, 0x0, 0x0) ioprio_set$uid(0x3, 0x0, 0x0) 1.708784246s ago: executing program 6 (id=908): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @log={{0x8}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x24000000, {0x1}}}, 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) 1.596351947s ago: executing program 6 (id=909): socket$nl_generic(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x4, @perf_config_ext={0x3, 0x5}, 0x4000, 0x2, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) r0 = fsopen(&(0x7f0000000000)='nfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source\x00', &(0x7f0000000080)='127.0.0.1:/export\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000000c0)='addr\x00', &(0x7f0000000100)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='vers\x00', &(0x7f0000000180)='3\x00', 0x0) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x2e, 0x1, 0x0, 0x0, 0x0, 0x7, 0x520, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, @perf_config_ext, 0xc224, 0x1224, 0x0, 0x3, 0x100000000008, 0x3, 0x0, 0x0, 0xf33, 0x0, 0x80000000}, 0x0, 0xd, 0xffffffffffffffff, 0x8) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events.local\x00', 0x26e1, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @cgroup_skb=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x2}) r4 = socket(0xf, 0x800, 0x0) r5 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r5, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x100) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) fallocate(r4, 0x7, 0x9, 0x10000) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000340)=0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00', @ANYRES32=r2], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYRESDEC=r3], &(0x7f00000002c0)='GPL\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedc0790700117df37538e486dd6317ce2200"], 0xfdef) perf_event_open(&(0x7f0000000740)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xecf5, 0x0, @perf_config_ext={0x1, 0xeaae}, 0x0, 0x0, 0x0, 0x8, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, 0x0, 0x24044010) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYRESOCT=r6], 0xfdef) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 1.527492576s ago: executing program 6 (id=910): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f0000000cc0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) socket$nl_route(0x10, 0x3, 0x0) socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x20080, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, @perf_config_ext={0x3, 0xffffffff}, 0x4000, 0x0, 0x0, 0x1, 0xc68d, 0x92, 0x3, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000f00)='./file1\x00', 0x0, &(0x7f0000000180), 0x1, 0x27e, &(0x7f0000000500)="$eJzs3T1oO2UcB/DfXZJ/34JWBRHFFxARLZS6CSLoolAQKSKCChURJ2mFanFrnFwcdFbp5FLEzeooLsVF6Fq1Q0UQsThYHHSIXC6RmCZaL82l/+TzgfTuubsnv0vJ97mH0lwCmFqLEfFYRFQiYikiahGRdB9wT/5YbDd35w7WI5rNZ35NWsfl7Vyn30JENCLi4YhqZ9/2/gsnvx89ef+7b9bu+3j/+bkSXlqld8PpyfFTZx89/c5nqw9tp+1t9fay+3Vcottv7LOxmkTcPIJiV0VSHfcZcBFrb336bRaSWyLi3lb+a5G2I/ve1rWvavHgh4P6vv/L4R1lnitw+ZrNWnYNbDSBqZO25sBJuhwR+XqaLi/nc/jvKvPpa5tbbyy9ulnZeKV71Chj+g6MSj3i+IkvZj5f6Mn/T5U8/8DkyvL/7Nre99n62bm/lAET6c58keV/6aWdB0L+YerIP0yG+QJ95B8mQr1gJ/mH613B7BbI/60/Hj5arBhwpVww/z+XeU5AOcz/YYLVOiuNvrvlH6bXhfPvX31h4nTy79IP06f7+g8ATJfmzLg/gQyMy7jHHwAAAAAAAAAAAAAAAAAA4LzduYP1ziMiKaXm1x9EnD4eEdXe+tH6YoO0tZxt/Zz/LckO+1uSd2u7Vqj+i3cPc/bD+2T0n76u9rRnuxs3/DDy+v/qm7tG87xv/7M58A6WOxsRjezglWr1/Psvab//irvpP/bXXh6ywP/Um+pHniuj6uDf4p97ZdQfbPUo4sts/FnpN/6kcVtr2X/8qXffYrmg1/8Y8gkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAozV8BAAD///BWbAI=") r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) sendmsg$nl_route_sched(r4, 0x0, 0x40000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) r5 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x30004091) r6 = socket$l2tp(0x2, 0x2, 0x73) chown(&(0x7f0000000000)='.\x00', 0x0, 0xffffffffffffffff) sendto$l2tp(r6, &(0x7f00000002c0)="e5786a0d000000000000003b", 0xc, 0x400c0c1, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x24}, 0x82004}, 0x10) setsockopt$inet_int(r6, 0x0, 0x12, 0x0, 0x0) perf_event_open(&(0x7f00000005c0)={0x2, 0x80, 0xf9, 0x1, 0x0, 0x0, 0x0, 0x800000001, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xc}, 0x9f50, 0xffffffffffffffff, 0x0, 0x5, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000140)={r5}) stat(0x0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_QUOTAOFF(0xffffffff80000301, 0x0, r7, 0x0) prctl$PR_SET_NAME(0xf, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x4, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x4, 0xd}, {}, {0x3, 0xfff1}}}, 0x24}}, 0x40004) sendmsg$nl_route_sched(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=@newtclass={0x58, 0x28, 0x8, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x9, 0xf}, {0xd, 0xf}, {0xa, 0xe}}, [@tclass_kind_options=@c_fq_codel={0xd}, @tclass_kind_options=@c_htb={{0x8}, {0x4}}, @tclass_kind_options=@c_fq_codel={0xd}, @tclass_kind_options=@c_sfb={0x8}]}, 0x58}}, 0x0) 1.44207881s ago: executing program 0 (id=911): capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x20002}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f00000001c0), 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffefffc}, 0x50) r0 = syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x2) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x85) 1.411977098s ago: executing program 4 (id=912): set_mempolicy(0x3, &(0x7f0000000040)=0xe3, 0x8) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x303a, 0xffffffffffffffff, 0xe80a0000) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x0, @perf_config_ext={0x4d5, 0x3ff}, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000005c0)={0xffffffffffffffff, 0x0, 0xc3, 0x0, &(0x7f0000000300)="cff72c72a33bc30a1198699d50939a54493ef6eda26df1f57fe2d30830fc6dc2b7f53135cb2b55860978e3e916e16e675653e35ab70770c6577762f0c53a9d8928159a7ce9488f1423f81c7efb9b6d9a587c73bc54835f8165836fc4d1d85f7b7c798ab174b5528c15c4ce75dc654807153abefb058e5d3f2ac8c2c10d6269a0e7eed3f3d438bbfea8df037b252125812d129206b2abdd629c5d474b74d7fa5184aa30912b31bf0d7c858e5834ee9c7af5b55b1d6e488c43485aeb7bac3a34d9572e0f", 0x0, 0xfffffe00, 0x0, 0x2d, 0x119, &(0x7f0000000240)="50fe4c04c3a92254375d801f70f8422de639f5134a1d6e261e5c2a7d650ad1470976b55fa70c3a649e9dc82510", &(0x7f0000001e00)="5b38c54c54f6f65139c530f10baa23530d18844a2c797cd61613000047676f71e8e8a4fcbf16bf57fc9bcffbdeeefa1a8a531bbbb6d541fa2e1785f9a511fcce32ba91b6b968a2a0a95759c8de8d022f6b5679d34b6ebf1ea6b2232f3b139d96315b9815e0a0e03878dbdd05f6bbff580a98283324c8a21d840892b20a163a92f502423e60eefc738c591e3607441b78a8a9ea74ca802bb99d0b422cee5e2df2d975b386775d6694f7588a8e4da61977593014eb8beceba0497685b9cd72ec5e6f9187a18561809815157dad4c4a4008cc70bef43ad48110d8aa2eb21eebdecb3531706fbaa6f128f29cfea22fc49edb4defcc45b3acf0fed71e8cf9f7f88f95791cf4e3434de1e03977a40a057cf73c7921b5cb49a838c91c", 0x2, 0x0, 0x8}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500), 0xc) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000400)={0xffffffffffffffff, &(0x7f0000000100), &(0x7f00000001c0)=""/5}, 0x20) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) futex_waitv(&(0x7f0000000780)=[{0x5, &(0x7f0000000080)=0x5, 0x2}], 0x1, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1) futex(0x0, 0x3, 0x2, 0x0, &(0x7f0000000140)=0x2, 0xfffffffd) 1.356941414s ago: executing program 0 (id=913): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) futex(0x0, 0x0, 0x0, 0x0, 0x0, 0x1) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000007111ae00000000008510000002000000850000000500000095000000000000009500a50500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r0, 0xe0, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x2000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff0000/0x2000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {&(0x7f0000000080)}], 0x2) sendmsg(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000000)=',', 0x1}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) io_uring_enter(r1, 0x2219, 0xcf74, 0x16, 0x0, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f0000001340)={0x1, &(0x7f00000012c0)=[{0x4, 0x100, &(0x7f0000000080)="5f55f87688b4addd2b32e480e4cd993560795955b2b46e28fdc4c62e9bf2b6bbb6a9527cb32f61b04c7aabcb72a1589091afe7129c147dbe6c4cc467caeff8b0f31d6adefeaa8d93e79b160d6521ad4e4865a94debb91fbc4ef4362f99fbddad6aa3ebc39140fc40d92f2071a15e422b4bc0e06a04d67c778f253e380161697a13c2c338c2d5feaaac9d7ce1e857e818af5c80eb15b2d8b19b4ecbf8156e918b9774ed90c29ee55e6c7456bc02ec9b42d7031cf9864ad4524c7e1710338ab745dbf7c0369973239d0beb0a1e053e5408aeeb063e7aed768ce12767590f71f6dd3788ed92f00976da9d065bf2de187741aae0e8bf0af69ab30655fd2994a49407", 0x1}]}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) 1.00946033s ago: executing program 0 (id=914): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x5607, 0x2d) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) ioctl$TIOCL_SETVESABLANK(r5, 0x560e, &(0x7f0000000140)) ioctl$TCSETSW2(0xffffffffffffffff, 0x402c542c, &(0x7f0000000040)={0x6, 0x7, 0xfff7fff7, 0x8, 0x12, "c63bf9e2f100", 0xef3, 0x3}) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x10001) ioctl$TIOCL_BLANKSCREEN(0xffffffffffffffff, 0x541c, &(0x7f0000000000)) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r6 = socket(0x8, 0x5, 0x7fff) ioctl$sock_SIOCOUTQNSD(r6, 0x40106150, &(0x7f0000000000)) 878.495976ms ago: executing program 6 (id=915): r0 = perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xf}, 0x0, 0x2df, 0x0, 0x0, 0x2, 0x7fffffff, 0xfffc, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='3', 0x4e) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty, 0x3}, 0x1c) setsockopt$inet6_tcp_int(r2, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) syz_emit_ethernet(0x1e, &(0x7f0000000380)={@local, @multicast, @void, {@can={0xc, {{0x3, 0x0, 0x0, 0x1}, 0x6, 0x0, 0x0, 0x0, "a2cea0dbe2efed00"}}}}, &(0x7f00000003c0)={0x1, 0x4, [0x84c, 0x993, 0x4fa, 0xc2b]}) shutdown(r2, 0x2) setsockopt$inet6_tcp_TCP_MD5SIG(r2, 0x6, 0xe, &(0x7f0000000880)={@in6={{0xa, 0x4e24, 0xf37, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8000}}, 0x0, 0x0, 0x1e, 0x0, "bb353738cb473fc7c9f1cf53b6a7b4e24740bd4c0b42a21d7214bff16d2ccd00"}, 0xd8) sendto$inet6(r2, 0x0, 0x0, 0x20008045, &(0x7f0000000340)={0xa, 0x2, 0x28, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000000308010400000000000000000a00000105000300840000001c00048008"], 0x38}, 0x1, 0x0, 0x0, 0x14}, 0x24008000) socket$kcm(0x2, 0x5, 0x84) ioctl$NILFS_IOCTL_GET_CPINFO(r0, 0x80186e82, &(0x7f0000000340)={&(0x7f0000000240)=[{0x2, 0x0, 0x3d25, 0x40, 0x8, 0x5, 0x2, 0xd}, {0x0, 0x0, 0xf22a, 0x9, 0x6, 0x9, 0xfffffffffffffffd, 0x4}, {0x2, 0x0, 0x8, 0x40, 0x7f, 0x5, 0x4, 0xe}, {0x2, 0x0, 0x800, 0x2, 0x1e318510, 0xb44, 0x3, 0x6}], 0x4, 0x38, 0x1, 0x10}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = dup(0xffffffffffffffff) ioctl$TIOCL_SETSEL(r4, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x300, 0xfffe, 0x101}}) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x1e8f7}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macsec={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACSEC_ICV_LEN={0x5, 0x3, 0xd}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x0) setsockopt$inet_buf(r5, 0x0, 0x10, &(0x7f0000000180)="e4e75afff58e521b791f2d8287e33eb8e7bc6a4033c28449f28664083c9d48dd468deeed52429d3d5712632734e71146903d7905282fc62c1e7e6267ad091327bf6083baf32a7ea472c1f7be48ff91384b1562f33acec2e6a94481022c3241ec7acba0e990bd4f70687fb84c95f87628279f7d53c188034bc40a03328957d41325d70f11aa8025effd17f4cadea82833aeb64b39585d00e863135318ea939f914d21", 0xa2) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000400)=@ethtool_flash={0x4c, 0x0, '.\x00'}}) 446.481646ms ago: executing program 4 (id=916): ioctl$XFS_IOC_AG_GEOMETRY(0xffffffffffffffff, 0xc080583d, &(0x7f0000000080)={0x7, 0x4, 0x1b, 0xc96, 0x1c41, 0x9, 0x348a, 0x8000}) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0xd3283d0368e269b3, 0x8031, 0xffffffffffffffff, 0xf61cb000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@uncond, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'syz1\x00'}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x2}}}, {{@ipv6={@remote, @private0={0xfc, 0x0, '\x00', 0x1}, [0x0, 0x0, 0xffffff00], [], 'erspan0\x00', 'netdevsim0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'vcan0\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0xfffffffe, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0xf9}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e22}, 0x1c) listen(r1, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x40, 0x5}]}}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000340)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x0, 0x0, 0x400}}}}}}}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x19, r2, 0xffffffffffffffff, 0x274b) sched_setscheduler(r2, 0x0, &(0x7f0000000000)=0x6000) r3 = timerfd_create(0x8, 0x0) read(r3, &(0x7f0000002180)=""/262, 0x106) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x2f, 0xe, 0x0, &(0x7f0000000180)="e4e6abc9f494d44d5166a7ad6797", 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 430.358481ms ago: executing program 6 (id=917): syz_mount_image$vfat(&(0x7f0000000440), &(0x7f0000000380)='./file1\x00', 0x844, &(0x7f0000000bc0)=ANY=[], 0x1, 0x267, &(0x7f0000000740)="$eJzs3b9rVFkUAOAzmcmvbSYsCwvLLjuwLGw1JIHtsyy7bNigYhgkIsGJmUjIhICBgBZJrAQrG0vLdBFBCzv9HwQbG7ERS9NZSJ4kL0xmzEQTMfMk833NPbx7znv33vDeyxRz5/LPiwuzS8tzW1uvY2AgF4Wxq9tJkouh6Il8pNYDADhN3iVJvE1SWY8FAOgM738A6D6Hvf//60nb3rQ5l8XYAICT8eWf/+9OPXlZrY39eYTUpL8Rvpg+/hgBgK9rcuri/9tPfx8cj0d3IhZvrVRWKmmb9v81F/NRj1oMRzHeRyQNafzv+MQ/w6UdgxGVxbW9+rWVSr61fiSKMRRx4czB+pFSqrW+N75rrh+NYvzQ/vqjbev74o/fmurLUYxnV2Ip6jG78y9JU/3qSKn099mJj+r7d/NiI5/p3wcAAAAAAAAAAAAAAAAAAAAAgNOpXGoYard/T7l8WH9af/T9gfb357m9W1+InwpxM9vZAwAAAAAAAAAAAAAAAAAAwLdh+fqNhWq9XrvWCGbOz3/feuRzQa5NV37v/Mc5T9cEOwtzgpf4NSJOehYPN2vPN6YvTWa/mB0M2q/qg8wHNvOJnJ6I2A1+vDdWfbz66s3BnFhvupcL6X1bradtX/PDotThhxMAAAAAAAAAAAAAAAAAAHSZ/a8BH5aRdHZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJCB/d//P3bQ1ziyOZierNH1y0Bzctp5v+W6ufUMJgsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQNf6EAAA//9rIKjm") write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x900, 0x12) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1000000201005) mkdir(0x0, 0x1ff) r3 = memfd_secret(0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r3, 0x0) ftruncate(r3, 0x51a9497) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./pipefs\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x80, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount$nfs4(&(0x7f00000005c0)='127.0.0.1:/root\x00\x80z\xc3\xb4rO\x82\xda|7\xd3\x86+\x0f\xb7\x7fI\xdb\x8a\xed\xa4\xb25D\xa2\xc6\xb1>x\n\xa4>}4\xac6z>? /ht>\xd0%\xc9\x1a\x86\xaa\xee\x9c\xfb\xc6x|\xe6\xf7\xcav\xb5\x85\xb0\xfa\xe3\xb6\xae\x9bl\xf7\t\xcc\xd4\xda~\x05\xfaG7\xbd\t\xae\xba\xb8?\xf0\a\xff\xf6 ?\xacV\xfa-\xeb\xb1\x17^\xa5\xe1%\xbe\xf0.\x820\xa3dP\x86H\x06\xb1\x91\xcb\x89M \xb8\xc4\x10 [ 76.942850][ T4928] __dump_stack+0x1d/0x30 [ 76.942926][ T4928] dump_stack_lvl+0x95/0xd0 [ 76.942954][ T4928] dump_stack+0x15/0x1b [ 76.942979][ T4928] should_fail_ex+0x262/0x280 [ 76.943013][ T4928] should_fail+0xb/0x20 [ 76.943045][ T4928] should_fail_usercopy+0x1a/0x20 [ 76.943080][ T4928] _copy_to_user+0x20/0xa0 [ 76.943116][ T4928] bpf_verifier_vlog+0x455/0x5a0 [ 76.943146][ T4928] __btf_verifier_log_type+0x2db/0x330 [ 76.943227][ T4928] btf_datasec_check_meta+0x26f/0x640 [ 76.943376][ T4928] ? __pfx_btf_sec_info_cmp+0x10/0x10 [ 76.943402][ T4928] ? sort+0x6c/0xa0 [ 76.943436][ T4928] ? __pfx_btf_sec_info_cmp+0x10/0x10 [ 76.943531][ T4928] btf_parse_type_sec+0x291/0x1520 [ 76.943557][ T4928] ? __kvmalloc_node_noprof+0x326/0x5c0 [ 76.943589][ T4928] ? btf_parse_hdr+0x43a/0x440 [ 76.943616][ T4928] ? btf_parse_str_sec+0x1ae/0x1b0 [ 76.943640][ T4928] btf_new_fd+0x2ec/0x6a0 [ 76.943684][ T4928] bpf_btf_load+0x116/0x130 [ 76.943719][ T4928] __sys_bpf+0xbce/0xc30 [ 76.943751][ T4928] ? do_futex+0x380/0x460 [ 76.943951][ T4928] __x64_sys_bpf+0x69/0x80 [ 76.943979][ T4928] x64_sys_call+0xf26/0x2550 [ 76.944010][ T4928] do_syscall_64+0x112/0x360 [ 76.944051][ T4928] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 76.944136][ T4928] RIP: 0033:0x7ff4d31ae159 [ 76.944155][ T4928] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 76.944174][ T4928] RSP: 002b:00007ff4d1c07028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 76.944255][ T4928] RAX: ffffffffffffffda RBX: 00007ff4d3435fa0 RCX: 00007ff4d31ae159 [ 76.944273][ T4928] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 76.944289][ T4928] RBP: 00007ff4d324506b R08: 0000000000000000 R09: 0000000000000000 [ 76.944306][ T4928] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 76.944388][ T4928] R13: 00007ff4d3436038 R14: 00007ff4d3435fa0 R15: 00007ffc9f4df078 [ 76.944409][ T4928] [ 77.007735][ T4932] program syz.3.502 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 77.045467][ T4934] loop3: detected capacity change from 0 to 512 [ 77.090793][ T4934] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.503: corrupted in-inode xattr: invalid ea_ino [ 77.091332][ T4934] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 77.102611][ T4934] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.503: couldn't read orphan inode 15 (err -117) [ 77.102698][ T4934] fserror_report: 2 callbacks suppressed [ 77.102709][ T4934] loop3: lost filesystem error report for type 5 error -117 [ 77.102840][ C0] EXT4-fs (loop3): error count since last fsck: 2 [ 77.102859][ C0] EXT4-fs (loop3): initial error at time 1790784618: ext4_iget_extra_inode:5210: inode 15 [ 77.102906][ C0] EXT4-fs (loop3): last error at time 1790784618: ext4_orphan_get:1408 [ 77.116751][ T4934] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 77.165991][ T3303] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.295974][ T4942] loop4: detected capacity change from 0 to 512 [ 77.317866][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.317895][ T4942] FAT-fs (loop4): Filesystem has been set read-only [ 77.318113][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.318306][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.318606][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.318896][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.319216][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.319380][ T4942] FAT-fs (loop4): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 77.319441][ T4942] FAT-fs (loop4): error, fat_free: invalid cluster chain (i_pos 548) [ 77.324778][ T4942] netlink: 32 bytes leftover after parsing attributes in process `syz.4.505'. [ 77.398793][ T4947] Failure starting scanning (-16) [ 77.549488][ T4952] Failure starting scanning (-16) [ 78.095429][ T4956] loop4: detected capacity change from 0 to 8192 [ 78.201077][ T4962] Failure starting scanning (-16) [ 78.948126][ T4981] Failure starting scanning (-16) [ 79.002425][ T4983] Failure starting scanning (-16) [ 79.834328][ T5001] Failure starting scanning (-16) [ 79.897372][ T5004] Failure starting scanning (-16) [ 80.058995][ T5006] loop3: detected capacity change from 0 to 8192 [ 80.660407][ T5019] Failure starting scanning (-16) [ 80.802183][ T5021] program syz.2.526 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 81.005643][ T5023] loop2: detected capacity change from 0 to 8192 [ 81.214499][ T29] audit: type=1400 audit(1790784622.895:340): avc: denied { write } for pid=5030 comm="syz.2.530" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 81.265817][ T29] audit: type=1400 audit(1790784622.945:341): avc: denied { write } for pid=5030 comm="syz.2.530" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 81.512853][ T5036] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.512967][ T5036] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.574265][ T5034] loop4: detected capacity change from 0 to 512 [ 81.590748][ T5034] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.529: corrupted in-inode xattr: invalid ea_ino [ 81.590794][ T5034] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 81.591884][ T5034] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.529: couldn't read orphan inode 15 (err -117) [ 81.591912][ T5034] loop4: lost filesystem error report for type 5 error -117 [ 81.596817][ T5034] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 81.620946][ T5034] netlink: 8 bytes leftover after parsing attributes in process `syz.4.529'. [ 81.659528][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 81.673932][ T5039] loop2: detected capacity change from 0 to 8192 [ 81.863395][ T5053] Failure starting scanning (-16) [ 81.879950][ T5055] program syz.1.537 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 81.926874][ T5059] loop1: detected capacity change from 0 to 512 [ 81.933908][ T5059] ext3: Unknown parameter 'pcr' [ 81.969651][ T5060] Failure starting scanning (-16) [ 81.992938][ T5059] loop1: detected capacity change from 0 to 512 [ 82.015014][ T5059] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 82.018475][ T5059] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=a842c018, mo2=0102] [ 82.018537][ T5059] System zones: 0-2, 18-18, 34-34 [ 82.018982][ T5059] EXT4-fs (loop1): orphan cleanup on readonly fs [ 82.020211][ T5059] EXT4-fs error (device loop1): ext4_validate_block_bitmap:445: comm syz.1.538: bg 0: block 248: padding at end of block bitmap is not set [ 82.020325][ T5059] loop1: lost filesystem error report for type 5 error -117 [ 82.020717][ T5059] Quota error (device loop1): write_blk: dquota write failed [ 82.020746][ T5059] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 82.020780][ T5059] EXT4-fs error (device loop1): ext4_acquire_dquot:7069: comm syz.1.538: Failed to acquire dquot type 1 [ 82.020811][ T5059] loop1: lost filesystem error report for type 5 error -117 [ 82.022078][ T5059] EXT4-fs (loop1): 1 truncate cleaned up [ 82.024874][ T5059] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 82.366050][ T5071] Failure starting scanning (-16) [ 82.552530][ T5077] Failure starting scanning (-16) [ 82.886823][ T3298] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 83.353427][ T5095] program syz.4.548 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 83.373885][ T5097] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 83.374010][ T5097] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 83.523233][ T5102] Failure starting scanning (-16) [ 84.161019][ T5121] program syz.1.559 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 84.215737][ T5125] FAULT_INJECTION: forcing a failure. [ 84.215737][ T5125] name fail_futex, interval 1, probability 0, space 0, times 0 [ 84.215765][ T5125] CPU: 0 UID: 0 PID: 5125 Comm: syz.2.561 Not tainted syzkaller #0 PREEMPT(lazy) [ 84.215885][ T5125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 84.215898][ T5125] Call Trace: [ 84.215906][ T5125] [ 84.215915][ T5125] __dump_stack+0x1d/0x30 [ 84.215947][ T5125] dump_stack_lvl+0x95/0xd0 [ 84.215994][ T5125] dump_stack+0x15/0x1b [ 84.216019][ T5125] should_fail_ex+0x262/0x280 [ 84.216118][ T5125] should_fail+0xb/0x20 [ 84.216197][ T5125] get_futex_key+0x12d/0xb10 [ 84.216234][ T5125] futex_wake+0x89/0x400 [ 84.216267][ T5125] do_futex+0x3f8/0x460 [ 84.216335][ T5125] __se_sys_futex+0x2f6/0x370 [ 84.216376][ T5125] __x64_sys_futex+0x78/0x90 [ 84.216475][ T5125] x64_sys_call+0x22e2/0x2550 [ 84.216507][ T5125] do_syscall_64+0x112/0x360 [ 84.216582][ T5125] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 84.216612][ T5125] RIP: 0033:0x7ff4d31ae159 [ 84.216628][ T5125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 84.216705][ T5125] RSP: 002b:00007ff4d1c070e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 84.216729][ T5125] RAX: ffffffffffffffda RBX: 00007ff4d3435fa8 RCX: 00007ff4d31ae159 [ 84.216746][ T5125] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff4d3435fac [ 84.216762][ T5125] RBP: 00007ff4d3435fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 84.216819][ T5125] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 84.216834][ T5125] R13: 00007ff4d3436038 R14: 00007ffc9f4def90 R15: 00007ffc9f4df078 [ 84.216856][ T5125] [ 84.250254][ T5117] loop0: detected capacity change from 0 to 512 [ 84.339505][ T5117] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.557: corrupted in-inode xattr: invalid ea_ino [ 84.339595][ T5117] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 84.343663][ T5117] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.557: couldn't read orphan inode 15 (err -117) [ 84.343731][ T5117] loop0: lost filesystem error report for type 5 error -117 [ 84.370808][ T5117] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 84.420391][ T5129] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.420469][ T5129] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.469838][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.820140][ T5147] syzkaller0: entered promiscuous mode [ 84.820162][ T5147] syzkaller0: entered allmulticast mode [ 84.962098][ T29] audit: type=1400 audit(1790784626.635:342): avc: denied { write } for pid=5161 comm="syz.2.574" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 85.007596][ T29] audit: type=1400 audit(1790784626.685:343): avc: denied { write } for pid=5161 comm="syz.2.574" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 85.115578][ T5165] loop2: detected capacity change from 0 to 512 [ 85.121734][ T5158] Failure starting scanning (-16) [ 85.149253][ T5165] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.575: corrupted in-inode xattr: invalid ea_ino [ 85.149401][ T5165] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 85.149787][ T5165] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.575: couldn't read orphan inode 15 (err -117) [ 85.149816][ T5165] loop2: lost filesystem error report for type 5 error -117 [ 85.150780][ T5165] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 85.204237][ T5165] netlink: 8 bytes leftover after parsing attributes in process `syz.2.575'. [ 85.206223][ T5151] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.206252][ T5151] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.206393][ T5151] bridge_slave_0: entered allmulticast mode [ 85.206911][ T5151] bridge_slave_0: entered promiscuous mode [ 85.209535][ T5151] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.209588][ T5151] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.209731][ T5151] bridge_slave_1: entered allmulticast mode [ 85.210180][ T5151] bridge_slave_1: entered promiscuous mode [ 85.242702][ T5151] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.245542][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 85.252001][ T5151] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.299483][ T5151] team0: Port device team_slave_0 added [ 85.304597][ T5151] team0: Port device team_slave_1 added [ 85.328478][ T5151] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.328492][ T5151] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.328530][ T5151] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 85.329497][ T5151] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 85.329508][ T5151] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 85.329532][ T5151] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 85.350186][ T5151] hsr_slave_0: entered promiscuous mode [ 85.350561][ T5151] hsr_slave_1: entered promiscuous mode [ 85.350968][ T5151] debugfs: 'hsr0' already exists in 'hsr' [ 85.350982][ T5151] Cannot create hsr debugfs directory [ 85.409931][ T5181] Failure starting scanning (-16) [ 85.437552][ T5183] program syz.0.578 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 85.479003][ T4327] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.671083][ T5151] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 85.689334][ T5151] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 85.689870][ T5151] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 85.693932][ T5151] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 86.154688][ T4327] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.160259][ T5151] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 86.162620][ T5151] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 86.190627][ T5209] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.190760][ T5209] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.212615][ T5199] Failure starting scanning (-16) [ 86.218270][ T5151] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 86.227420][ T5151] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 86.246878][ T4327] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.297507][ T4327] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.318456][ T5151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.331542][ T5151] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.341813][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.341848][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.416717][ T4327] team0: left allmulticast mode [ 86.416737][ T4327] team_slave_0: left allmulticast mode [ 86.416751][ T4327] team_slave_1: left allmulticast mode [ 86.416924][ T4327] team0: left promiscuous mode [ 86.416938][ T4327] team_slave_0: left promiscuous mode [ 86.416998][ T4327] team_slave_1: left promiscuous mode [ 86.421187][ T4327] bridge0: port 3(team0) entered disabled state [ 86.429595][ T4327] bridge_slave_1: left allmulticast mode [ 86.429617][ T4327] bridge_slave_1: left promiscuous mode [ 86.429739][ T4327] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.438172][ T4327] bridge_slave_0: left allmulticast mode [ 86.438195][ T4327] bridge_slave_0: left promiscuous mode [ 86.438372][ T4327] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.603162][ T4327] team0: Port device bridge1 removed [ 86.608316][ T4327] team0: Port device bridge2 removed [ 86.626596][ T4327] team0: Port device bridge3 removed [ 86.634237][ T5224] loop2: detected capacity change from 0 to 512 [ 86.642993][ T4327] team0: Port device bridge4 removed [ 86.652400][ T4327] team0: Port device bridge5 removed [ 86.667952][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.667990][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.709533][ T4327] hsr_slave_0: left promiscuous mode [ 86.710812][ T4327] hsr_slave_1: left promiscuous mode [ 86.711222][ T4327] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.711239][ T4327] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.717877][ T4327] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.717979][ T4327] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.734667][ T4327] veth1_macvtap: left promiscuous mode [ 86.734698][ T4327] veth0_macvtap: left promiscuous mode [ 86.734797][ T4327] veth1_vlan: left promiscuous mode [ 86.734854][ T4327] veth0_vlan: left promiscuous mode [ 86.756393][ T5224] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.586: corrupted in-inode xattr: invalid ea_ino [ 86.766884][ T5224] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 86.769519][ T5224] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.586: couldn't read orphan inode 15 (err -117) [ 86.769639][ T5224] loop2: lost filesystem error report for type 5 error -117 [ 86.800295][ T5224] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 86.821912][ T29] audit: type=1400 audit(1790784628.495:344): avc: denied { read } for pid=5230 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.822020][ T29] audit: type=1400 audit(1790784628.495:345): avc: denied { read open } for pid=5230 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.822104][ T29] audit: type=1400 audit(1790784628.495:346): avc: denied { getattr } for pid=5230 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.831500][ T5232] program syz.4.588 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 86.971240][ T29] audit: type=1400 audit(1790784628.645:347): avc: denied { write } for pid=5229 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 86.971287][ T29] audit: type=1400 audit(1790784628.645:348): avc: denied { add_name } for pid=5229 comm="dhcpcd-run-hook" name="resolv.conf.eth3.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.030040][ T29] audit: type=1400 audit(1790784628.705:349): avc: denied { write } for pid=5245 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.030137][ T29] audit: type=1400 audit(1790784628.705:350): avc: denied { remove_name } for pid=5245 comm="rm" name="resolv.conf.eth3.link" dev="tmpfs" ino=2306 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.030983][ T4327] team0 (unregistering): Port device team_slave_1 removed [ 87.088749][ T4327] team0 (unregistering): Port device team_slave_0 removed [ 87.137858][ T3021] 8021q: adding VLAN 0 to HW filter on device eth3 [ 87.177820][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.210195][ T29] audit: type=1400 audit(1790784628.885:351): avc: denied { module_request } for pid=5151 comm="syz-executor" kmod="netdev-nicvf0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 87.374866][ T29] audit: type=1400 audit(1790784629.055:352): avc: denied { write } for pid=5253 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.434584][ T29] audit: type=1400 audit(1790784629.115:353): avc: denied { write } for pid=5278 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 87.441047][ T5274] loop0: detected capacity change from 0 to 512 [ 87.478870][ T3021] 8021q: adding VLAN 0 to HW filter on device eth2 [ 87.495084][ T5274] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.592: corrupted in-inode xattr: invalid ea_ino [ 87.495122][ T5274] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 87.495376][ T5274] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.592: couldn't read orphan inode 15 (err -117) [ 87.495401][ T5274] loop0: lost filesystem error report for type 5 error -117 [ 87.500552][ T5151] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.556948][ T5274] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 87.562681][ T5274] netlink: 12 bytes leftover after parsing attributes in process `syz.0.592'. [ 87.607278][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.614783][ T5287] syzkaller0: entered promiscuous mode [ 87.614833][ T5287] syzkaller0: entered allmulticast mode [ 87.710265][ T5301] FAULT_INJECTION: forcing a failure. [ 87.710265][ T5301] name fail_futex, interval 1, probability 0, space 0, times 0 [ 87.710319][ T5301] CPU: 1 UID: 0 PID: 5301 Comm: syz.3.597 Not tainted syzkaller #0 PREEMPT(lazy) [ 87.710344][ T5301] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 87.710386][ T5301] Call Trace: [ 87.710393][ T5301] [ 87.710400][ T5301] __dump_stack+0x1d/0x30 [ 87.710499][ T5301] dump_stack_lvl+0x95/0xd0 [ 87.710522][ T5301] dump_stack+0x15/0x1b [ 87.710542][ T5301] should_fail_ex+0x262/0x280 [ 87.710570][ T5301] should_fail+0xb/0x20 [ 87.710679][ T5301] get_futex_key+0x12d/0xb10 [ 87.710708][ T5301] futex_wake+0x89/0x400 [ 87.710731][ T5301] do_futex+0x3f8/0x460 [ 87.710770][ T5301] __se_sys_futex+0x2f6/0x370 [ 87.710855][ T5301] __x64_sys_futex+0x78/0x90 [ 87.710885][ T5301] x64_sys_call+0x22e2/0x2550 [ 87.711011][ T5301] do_syscall_64+0x112/0x360 [ 87.711037][ T5301] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.711059][ T5301] RIP: 0033:0x7fdb0f9be159 [ 87.711075][ T5301] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 87.711163][ T5301] RSP: 002b:00007fdb0e4170e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 87.711187][ T5301] RAX: ffffffffffffffda RBX: 00007fdb0fc45fa8 RCX: 00007fdb0f9be159 [ 87.711204][ T5301] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fdb0fc45fac [ 87.711259][ T5301] RBP: 00007fdb0fc45fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 87.711273][ T5301] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 87.711286][ T5301] R13: 00007fdb0fc46038 R14: 00007ffc83f5a520 R15: 00007ffc83f5a608 [ 87.711317][ T5301] [ 87.823530][ T5301] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 87.823630][ T5301] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 87.892291][ T5309] loop2: detected capacity change from 0 to 512 [ 88.845237][ T5309] netlink: 32 bytes leftover after parsing attributes in process `syz.2.599'. [ 88.898829][ T3021] 8021q: adding VLAN 0 to HW filter on device eth1 [ 88.967615][ T5151] veth0_vlan: entered promiscuous mode [ 88.969702][ T5151] veth1_vlan: entered promiscuous mode [ 88.974545][ T5334] program syz.2.601 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 88.990237][ T5336] program syz.0.602 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 89.061882][ T5151] veth0_macvtap: entered promiscuous mode [ 89.067614][ T5151] veth1_macvtap: entered promiscuous mode [ 89.079547][ T5151] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.088933][ T5151] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.135537][ T5343] loop4: detected capacity change from 0 to 512 [ 89.183712][ T5348] FAULT_INJECTION: forcing a failure. [ 89.183712][ T5348] name failslab, interval 1, probability 0, space 0, times 0 [ 89.183747][ T5348] CPU: 0 UID: 0 PID: 5348 Comm: syz.3.606 Not tainted syzkaller #0 PREEMPT(lazy) [ 89.183882][ T5348] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 89.183896][ T5348] Call Trace: [ 89.183902][ T5348] [ 89.183910][ T5348] __dump_stack+0x1d/0x30 [ 89.183940][ T5348] dump_stack_lvl+0x95/0xd0 [ 89.183968][ T5348] dump_stack+0x15/0x1b [ 89.184056][ T5348] should_fail_ex+0x262/0x280 [ 89.184083][ T5348] ? __alloc_skb+0x2e0/0x6f0 [ 89.184168][ T5348] should_failslab+0x8c/0xb0 [ 89.184206][ T5348] kmem_cache_alloc_node_noprof+0x82/0x400 [ 89.184248][ T5348] ? __alloc_skb+0x2e0/0x6f0 [ 89.184320][ T5348] __alloc_skb+0x2e0/0x6f0 [ 89.184340][ T5348] ? __alloc_skb+0x209/0x6f0 [ 89.184362][ T5348] alloc_uevent_skb+0x5c/0x120 [ 89.184401][ T5348] kobject_uevent_net_broadcast+0x23b/0x410 [ 89.184513][ T5348] kobject_uevent_env+0x424/0x560 [ 89.184559][ T5348] kobject_uevent+0x1d/0x30 [ 89.184600][ T5348] driver_register+0x1e2/0x220 [ 89.184639][ T5348] usb_gadget_register_driver_owner+0x92/0x1a0 [ 89.184730][ T5348] raw_ioctl+0xc5b/0x1df0 [ 89.184767][ T5348] ? ioctl_has_perm+0x273/0x2c0 [ 89.184795][ T5348] ? do_vfs_ioctl+0x848/0xe50 [ 89.184857][ T5348] ? selinux_file_ioctl+0x33c/0x3c0 [ 89.184960][ T5348] ? __fget_files+0x184/0x1c0 [ 89.184991][ T5348] ? __pfx_raw_ioctl+0x10/0x10 [ 89.185126][ T5348] __se_sys_ioctl+0xce/0x140 [ 89.185165][ T5348] __x64_sys_ioctl+0x43/0x50 [ 89.185234][ T5348] x64_sys_call+0x239d/0x2550 [ 89.185270][ T5348] do_syscall_64+0x112/0x360 [ 89.185314][ T5348] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 89.185341][ T5348] RIP: 0033:0x7fdb0f9bddeb [ 89.185360][ T5348] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 89.185383][ T5348] RSP: 002b:00007fdb0e414f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 89.185423][ T5348] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fdb0f9bddeb [ 89.185441][ T5348] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 89.185455][ T5348] RBP: 00007fdb0e415fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 89.185469][ T5348] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 89.185485][ T5348] R13: 00002000000000c0 R14: 0000000000000000 R15: 0000000000000000 [ 89.185586][ T5348] [ 89.185703][ T5343] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.605: corrupted in-inode xattr: invalid ea_ino [ 89.185733][ T5343] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 89.189988][ T5343] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.605: couldn't read orphan inode 15 (err -117) [ 89.190022][ T5343] loop4: lost filesystem error report for type 5 error -117 [ 89.192898][ T5343] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 89.193429][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.193471][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.193599][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.193636][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.199008][ T5348] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 89.199129][ T5348] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 89.221911][ T5343] netlink: 12 bytes leftover after parsing attributes in process `syz.4.605'. [ 89.243445][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.600098][ T3021] 8021q: adding VLAN 0 to HW filter on device eth4 [ 90.062115][ T5386] program syz.0.613 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 90.541060][ T5394] FAULT_INJECTION: forcing a failure. [ 90.541060][ T5394] name fail_futex, interval 1, probability 0, space 0, times 0 [ 90.541159][ T5394] CPU: 0 UID: 0 PID: 5394 Comm: syz.2.615 Not tainted syzkaller #0 PREEMPT(lazy) [ 90.541184][ T5394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 90.541200][ T5394] Call Trace: [ 90.541211][ T5394] [ 90.541262][ T5394] __dump_stack+0x1d/0x30 [ 90.541288][ T5394] dump_stack_lvl+0x95/0xd0 [ 90.541312][ T5394] dump_stack+0x15/0x1b [ 90.541401][ T5394] should_fail_ex+0x262/0x280 [ 90.541433][ T5394] should_fail+0xb/0x20 [ 90.541464][ T5394] get_futex_key+0x12d/0xb10 [ 90.541492][ T5394] futex_wake+0x89/0x400 [ 90.541514][ T5394] ? update_cfs_rq_load_avg+0x1e3/0x200 [ 90.541563][ T5394] do_futex+0x3f8/0x460 [ 90.541593][ T5394] ? finish_task_switch+0x121/0x340 [ 90.541688][ T5394] __se_sys_futex+0x2f6/0x370 [ 90.541796][ T5394] __x64_sys_futex+0x78/0x90 [ 90.541879][ T5394] x64_sys_call+0x22e2/0x2550 [ 90.541905][ T5394] do_syscall_64+0x112/0x360 [ 90.542008][ T5394] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.542031][ T5394] RIP: 0033:0x7ff4d31ae159 [ 90.542127][ T5394] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 90.542146][ T5394] RSP: 002b:00007ff4d1c070e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 90.542165][ T5394] RAX: ffffffffffffffda RBX: 00007ff4d3435fa8 RCX: 00007ff4d31ae159 [ 90.542203][ T5394] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007ff4d3435fac [ 90.542220][ T5394] RBP: 00007ff4d3435fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 90.542296][ T5394] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 90.542310][ T5394] R13: 00007ff4d3436038 R14: 00007ffc9f4def90 R15: 00007ffc9f4df078 [ 90.542345][ T5394] [ 90.593528][ T5394] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 90.593674][ T5394] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 90.633924][ T5396] loop3: detected capacity change from 0 to 512 [ 90.679998][ T5396] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.616: corrupted in-inode xattr: invalid ea_ino [ 90.680031][ T5396] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 90.680656][ T5396] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.616: couldn't read orphan inode 15 (err -117) [ 90.680988][ T5396] loop3: lost filesystem error report for type 5 error -117 [ 90.682935][ T5396] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 90.702478][ T5396] netlink: 12 bytes leftover after parsing attributes in process `syz.3.616'. [ 90.728168][ T3303] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 90.994894][ T5414] loop0: detected capacity change from 0 to 8192 [ 91.329559][ T5434] loop0: detected capacity change from 0 to 8192 [ 91.663852][ T5444] Failure starting scanning (-16) [ 91.966545][ T5446] FAULT_INJECTION: forcing a failure. [ 91.966545][ T5446] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 91.966580][ T5446] CPU: 0 UID: 0 PID: 5446 Comm: syz.3.631 Not tainted syzkaller #0 PREEMPT(lazy) [ 91.966724][ T5446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 91.966739][ T5446] Call Trace: [ 91.966746][ T5446] [ 91.966756][ T5446] __dump_stack+0x1d/0x30 [ 91.966785][ T5446] dump_stack_lvl+0x95/0xd0 [ 91.966811][ T5446] dump_stack+0x15/0x1b [ 91.966834][ T5446] should_fail_ex+0x262/0x280 [ 91.966934][ T5446] should_fail+0xb/0x20 [ 91.966958][ T5446] should_fail_usercopy+0x1a/0x20 [ 91.967056][ T5446] _copy_from_user+0x1c/0xb0 [ 91.967091][ T5446] bpf_vlog_reverse_ubuf+0x9f/0x360 [ 91.967139][ T5446] bpf_vlog_finalize+0x11a/0x200 [ 91.967163][ T5446] bpf_log_attr_finalize+0x33/0x100 [ 91.967190][ T5446] btf_new_fd+0x34a/0x6a0 [ 91.967217][ T5446] bpf_btf_load+0x116/0x130 [ 91.967315][ T5446] __sys_bpf+0xbce/0xc30 [ 91.967348][ T5446] ? do_futex+0x380/0x460 [ 91.967384][ T5446] __x64_sys_bpf+0x69/0x80 [ 91.967426][ T5446] x64_sys_call+0xf26/0x2550 [ 91.967500][ T5446] do_syscall_64+0x112/0x360 [ 91.967612][ T5446] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.967639][ T5446] RIP: 0033:0x7fdb0f9be159 [ 91.967657][ T5446] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 91.967760][ T5446] RSP: 002b:00007fdb0e417028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 91.967784][ T5446] RAX: ffffffffffffffda RBX: 00007fdb0fc45fa0 RCX: 00007fdb0f9be159 [ 91.967871][ T5446] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 91.967886][ T5446] RBP: 00007fdb0fa5506b R08: 0000000000000000 R09: 0000000000000000 [ 91.968038][ T5446] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 91.968053][ T5446] R13: 00007fdb0fc46038 R14: 00007fdb0fc45fa0 R15: 00007ffc83f5a608 [ 91.968074][ T5446] [ 92.167541][ T5452] syzkaller0: entered promiscuous mode [ 92.167565][ T5452] syzkaller0: entered allmulticast mode [ 92.207102][ T5454] loop4: detected capacity change from 0 to 512 [ 92.239688][ T5454] netlink: 32 bytes leftover after parsing attributes in process `syz.4.635'. [ 92.311376][ T5456] FAULT_INJECTION: forcing a failure. [ 92.311376][ T5456] name fail_futex, interval 1, probability 0, space 0, times 0 [ 92.311462][ T5456] CPU: 0 UID: 0 PID: 5456 Comm: syz.5.636 Not tainted syzkaller #0 PREEMPT(lazy) [ 92.311493][ T5456] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 92.311508][ T5456] Call Trace: [ 92.311516][ T5456] [ 92.311525][ T5456] __dump_stack+0x1d/0x30 [ 92.311553][ T5456] dump_stack_lvl+0x95/0xd0 [ 92.311577][ T5456] dump_stack+0x15/0x1b [ 92.311665][ T5456] should_fail_ex+0x262/0x280 [ 92.311697][ T5456] should_fail+0xb/0x20 [ 92.311784][ T5456] get_futex_key+0x12d/0xb10 [ 92.311818][ T5456] futex_wake+0x89/0x400 [ 92.311851][ T5456] do_futex+0x3f8/0x460 [ 92.311923][ T5456] __se_sys_futex+0x2f6/0x370 [ 92.311998][ T5456] __x64_sys_futex+0x78/0x90 [ 92.312027][ T5456] x64_sys_call+0x22e2/0x2550 [ 92.312063][ T5456] do_syscall_64+0x112/0x360 [ 92.312106][ T5456] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.312132][ T5456] RIP: 0033:0x7fd847b0e159 [ 92.312153][ T5456] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.312182][ T5456] RSP: 002b:00007fd8465670e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 92.312205][ T5456] RAX: ffffffffffffffda RBX: 00007fd847d95fa8 RCX: 00007fd847b0e159 [ 92.312246][ T5456] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd847d95fac [ 92.312310][ T5456] RBP: 00007fd847d95fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 92.312325][ T5456] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 92.312340][ T5456] R13: 00007fd847d96038 R14: 00007ffcd121f9e0 R15: 00007ffcd121fac8 [ 92.312359][ T5456] [ 92.363304][ T5456] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.363449][ T5456] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.440862][ T29] kauditd_printk_skb: 6 callbacks suppressed [ 92.440879][ T29] audit: type=1400 audit(1790784634.115:360): avc: denied { write } for pid=5457 comm="syz.2.637" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 92.489242][ T29] audit: type=1400 audit(1790784634.165:361): avc: denied { write } for pid=5457 comm="syz.2.637" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 92.617096][ T5467] program syz.2.641 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 93.004144][ T5479] loop5: detected capacity change from 0 to 512 [ 93.031986][ T5479] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.645: corrupted in-inode xattr: invalid ea_ino [ 93.032024][ T5479] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 93.032515][ T5479] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.645: couldn't read orphan inode 15 (err -117) [ 93.032606][ T5479] loop5: lost filesystem error report for type 5 error -117 [ 93.032817][ C0] EXT4-fs (loop5): error count since last fsck: 2 [ 93.032838][ C0] EXT4-fs (loop5): initial error at time 1790784634: ext4_iget_extra_inode:5210: inode 15 [ 93.032880][ C0] EXT4-fs (loop5): last error at time 1790784634: ext4_orphan_get:1408 [ 93.034521][ T5479] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.041328][ T5479] netlink: 12 bytes leftover after parsing attributes in process `syz.5.645'. [ 93.070479][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.469780][ T5483] loop5: detected capacity change from 0 to 512 [ 93.546152][ T5483] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.646: corrupted in-inode xattr: invalid ea_ino [ 93.546262][ T5483] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 93.546652][ T5483] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.646: couldn't read orphan inode 15 (err -117) [ 93.546753][ T5483] loop5: lost filesystem error report for type 5 error -117 [ 93.553920][ T5483] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.622363][ T5483] netlink: 8 bytes leftover after parsing attributes in process `syz.5.646'. [ 93.654054][ T5490] program syz.2.648 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 93.681650][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.729664][ T5494] loop5: detected capacity change from 0 to 512 [ 93.768833][ T5494] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.649: corrupted in-inode xattr: invalid ea_ino [ 93.768876][ T5494] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 93.769111][ T5494] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.649: couldn't read orphan inode 15 (err -117) [ 93.769193][ T5494] loop5: lost filesystem error report for type 5 error -117 [ 93.783234][ T5494] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.802968][ T5498] program syz.3.651 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 93.812042][ T5494] netlink: 12 bytes leftover after parsing attributes in process `syz.5.649'. [ 93.891692][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.955671][ T5507] FAULT_INJECTION: forcing a failure. [ 93.955671][ T5507] name fail_futex, interval 1, probability 0, space 0, times 0 [ 93.955706][ T5507] CPU: 0 UID: 0 PID: 5507 Comm: syz.5.653 Not tainted syzkaller #0 PREEMPT(lazy) [ 93.955733][ T5507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 93.955776][ T5507] Call Trace: [ 93.955783][ T5507] [ 93.955792][ T5507] __dump_stack+0x1d/0x30 [ 93.955824][ T5507] dump_stack_lvl+0x95/0xd0 [ 93.955859][ T5507] dump_stack+0x15/0x1b [ 93.955936][ T5507] should_fail_ex+0x262/0x280 [ 93.956028][ T5507] should_fail+0xb/0x20 [ 93.956054][ T5507] get_futex_key+0x12d/0xb10 [ 93.956089][ T5507] futex_wake+0x89/0x400 [ 93.956149][ T5507] do_futex+0x3f8/0x460 [ 93.956192][ T5507] __se_sys_futex+0x2f6/0x370 [ 93.956309][ T5507] __x64_sys_futex+0x78/0x90 [ 93.956346][ T5507] x64_sys_call+0x22e2/0x2550 [ 93.956378][ T5507] do_syscall_64+0x112/0x360 [ 93.956469][ T5507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.956550][ T5507] RIP: 0033:0x7fd847b0e159 [ 93.956569][ T5507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.956592][ T5507] RSP: 002b:00007fd8465670e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 93.956615][ T5507] RAX: ffffffffffffffda RBX: 00007fd847d95fa8 RCX: 00007fd847b0e159 [ 93.956632][ T5507] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd847d95fac [ 93.956649][ T5507] RBP: 00007fd847d95fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 93.956686][ T5507] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 93.956771][ T5507] R13: 00007fd847d96038 R14: 00007ffcd121f9e0 R15: 00007ffcd121fac8 [ 93.956795][ T5507] [ 93.957529][ T5507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 93.957656][ T5507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 94.158771][ T5511] program syz.2.656 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 94.350676][ T5523] Failure starting scanning (-16) [ 94.521004][ T29] audit: type=1400 audit(1790784636.195:362): avc: denied { write } for pid=5527 comm="syz.4.662" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 94.572836][ T29] audit: type=1400 audit(1790784636.245:363): avc: denied { write } for pid=5527 comm="syz.4.662" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 95.501740][ T5543] loop4: detected capacity change from 0 to 512 [ 95.549038][ T5543] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.665: corrupted in-inode xattr: invalid ea_ino [ 95.549075][ T5543] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 95.550791][ T5543] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.665: couldn't read orphan inode 15 (err -117) [ 95.550842][ T5543] loop4: lost filesystem error report for type 5 error -117 [ 95.589602][ T5543] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.637056][ T5543] netlink: 8 bytes leftover after parsing attributes in process `syz.4.665'. [ 95.670888][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 95.756932][ T5567] loop2: detected capacity change from 0 to 512 [ 95.790103][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.790133][ T5567] FAT-fs (loop2): Filesystem has been set read-only [ 95.790489][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.790751][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.791021][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.791278][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.791548][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.791650][ T5567] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 95.791801][ T5567] FAT-fs (loop2): error, fat_free: invalid cluster chain (i_pos 548) [ 95.799792][ T5564] loop5: detected capacity change from 0 to 512 [ 95.848312][ T5564] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.672: corrupted in-inode xattr: invalid ea_ino [ 95.848348][ T5564] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 95.852812][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 95.852832][ C0] EXT4-fs (loop5): initial error at time 1790784637: ext4_iget_extra_inode:5210: inode 15 [ 95.852863][ C0] EXT4-fs (loop5): last error at time 1790784637: ext4_iget_extra_inode:5210: inode 15 [ 95.855898][ T5564] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.672: couldn't read orphan inode 15 (err -117) [ 95.855928][ T5564] loop5: lost filesystem error report for type 5 error -117 [ 95.861059][ T5564] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 95.865961][ T5576] Failure starting scanning (-16) [ 95.870659][ T29] audit: type=1400 audit(1790784637.545:364): avc: denied { write } for pid=5575 comm="syz.3.675" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 95.892533][ T5564] netlink: 8 bytes leftover after parsing attributes in process `syz.5.672'. [ 95.906461][ T5578] Failure starting scanning (-16) [ 95.920197][ T29] audit: type=1400 audit(1790784637.595:365): avc: denied { write } for pid=5575 comm="syz.3.675" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 96.040679][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 96.357400][ T5591] program syz.2.680 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 96.449525][ T5594] netlink: 32 bytes leftover after parsing attributes in process `syz.2.681'. [ 96.546640][ T5596] FAULT_INJECTION: forcing a failure. [ 96.546640][ T5596] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 96.546674][ T5596] CPU: 0 UID: 0 PID: 5596 Comm: syz.5.682 Not tainted syzkaller #0 PREEMPT(lazy) [ 96.546764][ T5596] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.546781][ T5596] Call Trace: [ 96.546788][ T5596] [ 96.546797][ T5596] __dump_stack+0x1d/0x30 [ 96.546826][ T5596] dump_stack_lvl+0x95/0xd0 [ 96.546852][ T5596] dump_stack+0x15/0x1b [ 96.546919][ T5596] should_fail_ex+0x262/0x280 [ 96.546989][ T5596] should_fail+0xb/0x20 [ 96.547018][ T5596] should_fail_usercopy+0x1a/0x20 [ 96.547048][ T5596] _copy_from_user+0x1c/0xb0 [ 96.547113][ T5596] bpf_vlog_reverse_ubuf+0x9f/0x360 [ 96.547144][ T5596] bpf_vlog_finalize+0x11a/0x200 [ 96.547239][ T5596] bpf_log_attr_finalize+0x33/0x100 [ 96.547268][ T5596] btf_new_fd+0x34a/0x6a0 [ 96.547296][ T5596] bpf_btf_load+0x116/0x130 [ 96.547356][ T5596] __sys_bpf+0xbce/0xc30 [ 96.547388][ T5596] ? do_futex+0x380/0x460 [ 96.547479][ T5596] __x64_sys_bpf+0x69/0x80 [ 96.547506][ T5596] x64_sys_call+0xf26/0x2550 [ 96.547537][ T5596] do_syscall_64+0x112/0x360 [ 96.547623][ T5596] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 96.547652][ T5596] RIP: 0033:0x7fd847b0e159 [ 96.547671][ T5596] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.547744][ T5596] RSP: 002b:00007fd846567028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 96.547769][ T5596] RAX: ffffffffffffffda RBX: 00007fd847d95fa0 RCX: 00007fd847b0e159 [ 96.547787][ T5596] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 96.547803][ T5596] RBP: 00007fd847ba506b R08: 0000000000000000 R09: 0000000000000000 [ 96.547818][ T5596] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.547834][ T5596] R13: 00007fd847d96038 R14: 00007fd847d95fa0 R15: 00007ffcd121fac8 [ 96.547880][ T5596] [ 96.993019][ T5601] loop5: detected capacity change from 0 to 512 [ 97.025644][ T5601] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.684: corrupted in-inode xattr: invalid ea_ino [ 97.026008][ T5601] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 97.029572][ T5601] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.684: couldn't read orphan inode 15 (err -117) [ 97.029658][ T5601] loop5: lost filesystem error report for type 5 error -117 [ 97.032817][ C0] EXT4-fs (loop5): error count since last fsck: 2 [ 97.032841][ C0] EXT4-fs (loop5): initial error at time 1790784638: ext4_iget_extra_inode:5210: inode 15 [ 97.032892][ C0] EXT4-fs (loop5): last error at time 1790784638: ext4_orphan_get:1408 [ 97.038340][ T5601] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 97.134802][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.207933][ T5609] program syz.0.687 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 97.356880][ T5616] Failure starting scanning (-16) [ 97.458584][ T5622] loop2: detected capacity change from 0 to 512 [ 97.491555][ T5622] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.688: corrupted in-inode xattr: invalid ea_ino [ 97.491594][ T5622] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 97.492749][ T5622] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.688: couldn't read orphan inode 15 (err -117) [ 97.492778][ T5622] loop2: lost filesystem error report for type 5 error -117 [ 97.493051][ C1] EXT4-fs (loop2): error count since last fsck: 2 [ 97.493171][ C1] EXT4-fs (loop2): initial error at time 1790784639: ext4_iget_extra_inode:5210: inode 15 [ 97.493311][ C1] EXT4-fs (loop2): last error at time 1790784639: ext4_orphan_get:1408 [ 97.495195][ T5622] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 97.597535][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 97.659842][ T5628] Failure starting scanning (-16) [ 98.130254][ T5634] program syz.3.695 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 98.352816][ T5644] program syz.2.699 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 98.411305][ T5652] Failure starting scanning (-16) [ 98.521059][ T29] audit: type=1400 audit(1790784640.195:366): avc: denied { write } for pid=5646 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.597133][ T29] audit: type=1400 audit(1790784640.275:367): avc: denied { write } for pid=5665 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 98.642816][ T29] audit: type=1400 audit(1790784640.315:368): avc: denied { write } for pid=5668 comm="syz.3.703" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 98.693276][ T29] audit: type=1400 audit(1790784640.375:369): avc: denied { write } for pid=5668 comm="syz.3.703" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 99.053453][ T5679] Failure starting scanning (-16) [ 99.181716][ T5681] loop0: detected capacity change from 0 to 512 [ 99.201963][ T5681] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.706: corrupted in-inode xattr: invalid ea_ino [ 99.202002][ T5681] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 99.202399][ T5681] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.706: couldn't read orphan inode 15 (err -117) [ 99.202429][ T5681] loop0: lost filesystem error report for type 5 error -117 [ 99.202989][ T5681] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 99.269629][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 99.310867][ T5687] FAULT_INJECTION: forcing a failure. [ 99.310867][ T5687] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 99.310897][ T5687] CPU: 0 UID: 0 PID: 5687 Comm: syz.2.708 Not tainted syzkaller #0 PREEMPT(lazy) [ 99.310927][ T5687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.310942][ T5687] Call Trace: [ 99.310950][ T5687] [ 99.310957][ T5687] __dump_stack+0x1d/0x30 [ 99.311051][ T5687] dump_stack_lvl+0x95/0xd0 [ 99.311079][ T5687] dump_stack+0x15/0x1b [ 99.311103][ T5687] should_fail_ex+0x262/0x280 [ 99.311199][ T5687] should_fail+0xb/0x20 [ 99.311228][ T5687] should_fail_usercopy+0x1a/0x20 [ 99.311266][ T5687] _copy_from_user+0x1c/0xb0 [ 99.311363][ T5687] bpf_vlog_reverse_ubuf+0x9f/0x360 [ 99.311394][ T5687] bpf_vlog_finalize+0x11a/0x200 [ 99.311421][ T5687] bpf_log_attr_finalize+0x33/0x100 [ 99.311462][ T5687] btf_new_fd+0x34a/0x6a0 [ 99.311486][ T5687] bpf_btf_load+0x116/0x130 [ 99.311594][ T5687] __sys_bpf+0xbce/0xc30 [ 99.311633][ T5687] ? do_futex+0x380/0x460 [ 99.311678][ T5687] __x64_sys_bpf+0x69/0x80 [ 99.311711][ T5687] x64_sys_call+0xf26/0x2550 [ 99.311742][ T5687] do_syscall_64+0x112/0x360 [ 99.311772][ T5687] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 99.311795][ T5687] RIP: 0033:0x7ff4d31ae159 [ 99.311816][ T5687] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 99.311839][ T5687] RSP: 002b:00007ff4d1c07028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 99.311944][ T5687] RAX: ffffffffffffffda RBX: 00007ff4d3435fa0 RCX: 00007ff4d31ae159 [ 99.312025][ T5687] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 99.312042][ T5687] RBP: 00007ff4d324506b R08: 0000000000000000 R09: 0000000000000000 [ 99.312056][ T5687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 99.312115][ T5687] R13: 00007ff4d3436038 R14: 00007ff4d3435fa0 R15: 00007ffc9f4df078 [ 99.312137][ T5687] [ 99.528769][ T5692] Failure starting scanning (-16) [ 99.613263][ T5689] loop2: detected capacity change from 0 to 8192 [ 99.709770][ T5695] program syz.2.710 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 99.734572][ T29] audit: type=1400 audit(1790784641.415:370): avc: denied { write } for pid=5697 comm="syz.5.711" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 99.788414][ T29] audit: type=1400 audit(1790784641.465:371): avc: denied { write } for pid=5697 comm="syz.5.711" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 99.940421][ T5709] program syz.2.713 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 100.033777][ T29] audit: type=1400 audit(1790784641.705:372): avc: denied { write } for pid=5696 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.131046][ T29] audit: type=1400 audit(1790784641.805:373): avc: denied { write } for pid=5723 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.163747][ T5720] loop2: detected capacity change from 0 to 512 [ 100.200912][ T5720] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.717: corrupted in-inode xattr: invalid ea_ino [ 100.200999][ T5720] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 100.201708][ T5720] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.717: couldn't read orphan inode 15 (err -117) [ 100.201897][ T5720] loop2: lost filesystem error report for type 5 error -117 [ 100.203979][ T5720] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 100.232707][ T5720] netlink: 12 bytes leftover after parsing attributes in process `syz.2.717'. [ 100.262321][ T5720] netlink: 20 bytes leftover after parsing attributes in process `syz.2.717'. [ 100.313545][ T5734] Failure starting scanning (-16) [ 100.322732][ T5735] FAULT_INJECTION: forcing a failure. [ 100.322732][ T5735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 100.322762][ T5735] CPU: 0 UID: 0 PID: 5735 Comm: syz.5.719 Not tainted syzkaller #0 PREEMPT(lazy) [ 100.322792][ T5735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.322805][ T5735] Call Trace: [ 100.322812][ T5735] [ 100.322896][ T5735] __dump_stack+0x1d/0x30 [ 100.322976][ T5735] dump_stack_lvl+0x95/0xd0 [ 100.322999][ T5735] dump_stack+0x15/0x1b [ 100.323059][ T5735] should_fail_ex+0x262/0x280 [ 100.323090][ T5735] should_fail+0xb/0x20 [ 100.323113][ T5735] should_fail_usercopy+0x1a/0x20 [ 100.323148][ T5735] _copy_from_user+0x1c/0xb0 [ 100.323284][ T5735] bpf_vlog_reverse_ubuf+0x9f/0x360 [ 100.323311][ T5735] bpf_vlog_finalize+0x11a/0x200 [ 100.323336][ T5735] bpf_log_attr_finalize+0x33/0x100 [ 100.323442][ T5735] btf_new_fd+0x34a/0x6a0 [ 100.323468][ T5735] bpf_btf_load+0x116/0x130 [ 100.323500][ T5735] __sys_bpf+0xbce/0xc30 [ 100.323526][ T5735] ? do_futex+0x380/0x460 [ 100.323576][ T5735] __x64_sys_bpf+0x69/0x80 [ 100.323599][ T5735] x64_sys_call+0xf26/0x2550 [ 100.323625][ T5735] do_syscall_64+0x112/0x360 [ 100.323650][ T5735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.323674][ T5735] RIP: 0033:0x7fd847b0e159 [ 100.323739][ T5735] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.323760][ T5735] RSP: 002b:00007fd846567028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 100.323859][ T5735] RAX: ffffffffffffffda RBX: 00007fd847d95fa0 RCX: 00007fd847b0e159 [ 100.323877][ T5735] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 100.323893][ T5735] RBP: 00007fd847ba506b R08: 0000000000000000 R09: 0000000000000000 [ 100.323949][ T5735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 100.323965][ T5735] R13: 00007fd847d96038 R14: 00007fd847d95fa0 R15: 00007ffcd121fac8 [ 100.323987][ T5735] [ 100.336542][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.492112][ T5740] loop2: detected capacity change from 0 to 512 [ 100.541834][ T5740] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.720: corrupted in-inode xattr: invalid ea_ino [ 100.541880][ T5740] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 100.542831][ C0] EXT4-fs (loop2): error count since last fsck: 1 [ 100.542850][ C0] EXT4-fs (loop2): initial error at time 1790784642: ext4_iget_extra_inode:5210: inode 15 [ 100.542881][ C0] EXT4-fs (loop2): last error at time 1790784642: ext4_iget_extra_inode:5210: inode 15 [ 100.548844][ T5740] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.720: couldn't read orphan inode 15 (err -117) [ 100.548874][ T5740] loop2: lost filesystem error report for type 5 error -117 [ 100.550210][ T5740] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 100.619899][ T5740] netlink: 8 bytes leftover after parsing attributes in process `syz.2.720'. [ 100.659609][ T29] audit: type=1400 audit(1790784642.335:374): avc: denied { write } for pid=5728 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.666486][ T5743] loop5: detected capacity change from 0 to 512 [ 100.695902][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.717251][ T5743] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.721: corrupted in-inode xattr: invalid ea_ino [ 100.717301][ T5743] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 100.719279][ T5743] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.721: couldn't read orphan inode 15 (err -117) [ 100.719312][ T5743] loop5: lost filesystem error report for type 5 error -117 [ 100.720521][ T5743] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 100.753740][ T29] audit: type=1400 audit(1790784642.435:375): avc: denied { write } for pid=5753 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 100.762147][ T5743] netlink: 8 bytes leftover after parsing attributes in process `syz.5.721'. [ 100.811536][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 100.860541][ T5749] loop0: detected capacity change from 0 to 8192 [ 100.942216][ T5776] FAULT_INJECTION: forcing a failure. [ 100.942216][ T5776] name failslab, interval 1, probability 0, space 0, times 0 [ 100.942250][ T5776] CPU: 1 UID: 0 PID: 5776 Comm: syz.3.726 Not tainted syzkaller #0 PREEMPT(lazy) [ 100.942328][ T5776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.942342][ T5776] Call Trace: [ 100.942349][ T5776] [ 100.942357][ T5776] __dump_stack+0x1d/0x30 [ 100.942385][ T5776] dump_stack_lvl+0x95/0xd0 [ 100.942408][ T5776] dump_stack+0x15/0x1b [ 100.942472][ T5776] should_fail_ex+0x262/0x280 [ 100.942500][ T5776] ? skb_clone+0x151/0x1f0 [ 100.942524][ T5776] should_failslab+0x8c/0xb0 [ 100.942559][ T5776] kmem_cache_alloc_noprof+0x7c/0x3f0 [ 100.942668][ T5776] ? skb_clone+0x151/0x1f0 [ 100.942700][ T5776] skb_clone+0x151/0x1f0 [ 100.942727][ T5776] __netlink_deliver_tap+0x2be/0x510 [ 100.942790][ T5776] netlink_unicast+0x656/0x680 [ 100.942831][ T5776] netlink_sendmsg+0x5be/0x6f0 [ 100.942855][ T5776] ? __pfx_netlink_sendmsg+0x10/0x10 [ 100.942878][ T5776] ____sys_sendmsg+0x532/0x580 [ 100.942958][ T5776] ___sys_sendmsg+0x195/0x1e0 [ 100.942996][ T5776] __x64_sys_sendmsg+0xd4/0x160 [ 100.943026][ T5776] x64_sys_call+0x22ab/0x2550 [ 100.943088][ T5776] do_syscall_64+0x112/0x360 [ 100.943116][ T5776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 100.943142][ T5776] RIP: 0033:0x7fdb0f9be159 [ 100.943160][ T5776] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 100.943196][ T5776] RSP: 002b:00007fdb0e417028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 100.943218][ T5776] RAX: ffffffffffffffda RBX: 00007fdb0fc45fa0 RCX: 00007fdb0f9be159 [ 100.943233][ T5776] RDX: 0000000000000000 RSI: 00002000000018c0 RDI: 0000000000000003 [ 100.943304][ T5776] RBP: 00007fdb0e417090 R08: 0000000000000000 R09: 0000000000000000 [ 100.943318][ T5776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 100.943333][ T5776] R13: 00007fdb0fc46038 R14: 00007fdb0fc45fa0 R15: 00007ffc83f5a608 [ 100.943355][ T5776] [ 101.100054][ T5782] Failure starting scanning (-16) [ 101.147169][ T5778] loop5: detected capacity change from 0 to 8192 [ 101.264355][ T5787] nfs4: Unknown parameter 'ad.0.uۄ' [ 101.285348][ T5787] loop4: detected capacity change from 0 to 512 [ 101.285788][ T5787] EXT4-fs: Ignoring removed nobh option [ 101.299350][ T5787] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -13 [ 101.299715][ T5787] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #13: comm syz.4.730: attempt to clear invalid blocks 1 len 1 [ 101.299753][ T5787] loop4: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 101.299933][ T5787] EXT4-fs (loop4): Remounting filesystem read-only [ 101.300104][ T5787] EXT4-fs (loop4): 1 truncate cleaned up [ 101.300427][ T5787] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 101.319121][ T5787] netlink: 16 bytes leftover after parsing attributes in process `syz.4.730'. [ 101.351829][ T5792] program syz.5.729 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 101.366771][ T5789] loop3: detected capacity change from 0 to 512 [ 101.393497][ T5789] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.731: corrupted in-inode xattr: invalid ea_ino [ 101.393535][ T5789] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 101.395410][ T5789] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.731: couldn't read orphan inode 15 (err -117) [ 101.395436][ T5789] loop3: lost filesystem error report for type 5 error -117 [ 101.403727][ T5789] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 101.427732][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.471974][ T5789] netlink: 12 bytes leftover after parsing attributes in process `syz.3.731'. [ 101.498666][ T5789] netlink: 20 bytes leftover after parsing attributes in process `syz.3.731'. [ 101.546177][ T3303] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 101.834487][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.834589][ T5826] FAT-fs (loop5): Filesystem has been set read-only [ 101.834842][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.835172][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.835652][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.835904][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.836124][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.836309][ T5826] FAT-fs (loop5): error, fat_get_cluster: invalid cluster chain (i_pos 548) [ 101.836456][ T5826] FAT-fs (loop5): error, fat_free: invalid cluster chain (i_pos 548) [ 101.857749][ T5826] netlink: 32 bytes leftover after parsing attributes in process `syz.5.739'. [ 101.947060][ T5829] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.740: corrupted in-inode xattr: invalid ea_ino [ 101.947095][ T5829] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 101.947668][ T5829] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.740: couldn't read orphan inode 15 (err -117) [ 101.947699][ T5829] loop0: lost filesystem error report for type 5 error -117 [ 101.949640][ T5829] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.018228][ T5834] program syz.4.741 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 102.046105][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 102.116553][ T5849] Illegal XDP return value 4291448832 on prog (id 77) dev syz_tun, expect packet loss! [ 102.285863][ T5861] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.747: corrupted in-inode xattr: invalid ea_ino [ 102.285894][ T5861] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 102.288578][ T5861] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.747: couldn't read orphan inode 15 (err -117) [ 102.288610][ T5861] loop2: lost filesystem error report for type 5 error -117 [ 102.291125][ T5861] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.307944][ T5861] netlink: 12 bytes leftover after parsing attributes in process `syz.2.747'. [ 102.336656][ T5861] netlink: 20 bytes leftover after parsing attributes in process `syz.2.747'. [ 102.386729][ T5869] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.748: corrupted in-inode xattr: invalid ea_ino [ 102.386760][ T5869] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 102.387617][ T5869] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.748: couldn't read orphan inode 15 (err -117) [ 102.387643][ T5869] loop5: lost filesystem error report for type 5 error -117 [ 102.395212][ T5869] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.395714][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 102.480539][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 102.520875][ T5875] set_capacity_and_notify: 4 callbacks suppressed [ 102.520893][ T5875] loop2: detected capacity change from 0 to 2048 [ 102.553025][ T5875] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 102.553195][ T5875] ext4 filesystem being mounted at /148/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 102.604480][ T5885] program syz.3.754 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 102.636427][ T5886] EXT4-fs error (device loop2): ext4_validate_block_bitmap:445: comm syz.2.751: bg 0: block 345: padding at end of block bitmap is not set [ 102.636664][ T5886] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 15 with max blocks 113 with error 117 [ 102.636688][ T5886] EXT4-fs (loop2): This should not happen!! Data will be lost [ 102.636688][ T5886] [ 102.801288][ T4327] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 15 with error 28 [ 102.801317][ T4327] EXT4-fs (loop2): This should not happen!! Data will be lost [ 102.801317][ T4327] [ 102.801332][ T4327] EXT4-fs (loop2): Total free blocks count 0 [ 102.801346][ T4327] EXT4-fs (loop2): Free/Dirty block details [ 102.801359][ T4327] EXT4-fs (loop2): free_blocks=0 [ 102.801373][ T4327] EXT4-fs (loop2): dirty_blocks=432 [ 102.801400][ T4327] EXT4-fs (loop2): Block reservation details [ 102.969503][ T5901] loop2: detected capacity change from 0 to 512 [ 102.995758][ T5901] bridge0: port 3(team0) entered disabled state [ 102.995846][ T5901] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.996006][ T5901] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.996297][ T5901] bridge0: entered allmulticast mode [ 103.011484][ T5901] team0: left allmulticast mode [ 103.011507][ T5901] team_slave_0: left allmulticast mode [ 103.011543][ T5901] team_slave_1: left allmulticast mode [ 103.011614][ T5901] team0: left promiscuous mode [ 103.011628][ T5901] team_slave_0: left promiscuous mode [ 103.011840][ T5901] team_slave_1: left promiscuous mode [ 103.012156][ T5901] bridge0: port 3(team0) entered disabled state [ 103.024437][ T5901] bridge_slave_1: left allmulticast mode [ 103.024532][ T5901] bridge_slave_1: left promiscuous mode [ 103.024818][ T5901] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.035110][ T5901] bridge_slave_0: left allmulticast mode [ 103.035132][ T5901] bridge_slave_0: left promiscuous mode [ 103.035267][ T5901] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.305218][ T5919] loop2: detected capacity change from 0 to 512 [ 103.361771][ T5919] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.766: corrupted in-inode xattr: invalid ea_ino [ 103.361842][ T5919] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 103.362491][ T5919] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.766: couldn't read orphan inode 15 (err -117) [ 103.362593][ T5919] loop2: lost filesystem error report for type 5 error -117 [ 103.362872][ C0] EXT4-fs (loop2): error count since last fsck: 2 [ 103.362912][ C0] EXT4-fs (loop2): initial error at time 1790784645: ext4_iget_extra_inode:5210: inode 15 [ 103.363023][ C0] EXT4-fs (loop2): last error at time 1790784645: ext4_orphan_get:1408 [ 103.402946][ T5919] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 103.549878][ T5925] Failure starting scanning (-16) [ 103.569707][ T29] kauditd_printk_skb: 34 callbacks suppressed [ 103.569727][ T29] audit: type=1400 audit(1790784645.245:410): avc: denied { ioctl } for pid=5918 comm="syz.2.766" path="socket:[16213]" dev="sockfs" ino=16213 ioctlcmd=0x48c8 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 103.753896][ T29] audit: type=1400 audit(1790784645.435:411): avc: denied { write } for pid=5918 comm="syz.2.766" name="001" dev="devtmpfs" ino=168 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 104.065586][ T29] audit: type=1400 audit(1790784645.735:412): avc: denied { write } for pid=5929 comm="syz.0.769" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 104.094222][ T29] audit: type=1400 audit(1790784645.755:413): avc: denied { write } for pid=5929 comm="syz.0.769" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 104.168594][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 104.169456][ T5937] FAULT_INJECTION: forcing a failure. [ 104.169456][ T5937] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 104.169502][ T5937] CPU: 1 UID: 0 PID: 5937 Comm: syz.3.770 Not tainted syzkaller #0 PREEMPT(lazy) [ 104.169532][ T5937] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 104.169548][ T5937] Call Trace: [ 104.169604][ T5937] [ 104.169657][ T5937] __dump_stack+0x1d/0x30 [ 104.169689][ T5937] dump_stack_lvl+0x95/0xd0 [ 104.169715][ T5937] dump_stack+0x15/0x1b [ 104.169813][ T5937] should_fail_ex+0x262/0x280 [ 104.169843][ T5937] should_fail+0xb/0x20 [ 104.169870][ T5937] should_fail_usercopy+0x1a/0x20 [ 104.169903][ T5937] _copy_from_user+0x1c/0xb0 [ 104.169993][ T5937] bpf_vlog_reverse_ubuf+0x9f/0x360 [ 104.170021][ T5937] bpf_vlog_finalize+0x11a/0x200 [ 104.170119][ T5937] bpf_log_attr_finalize+0x33/0x100 [ 104.170143][ T5937] btf_new_fd+0x34a/0x6a0 [ 104.170170][ T5937] bpf_btf_load+0x116/0x130 [ 104.170244][ T5937] __sys_bpf+0xbce/0xc30 [ 104.170277][ T5937] ? do_futex+0x380/0x460 [ 104.170320][ T5937] __x64_sys_bpf+0x69/0x80 [ 104.170392][ T5937] x64_sys_call+0xf26/0x2550 [ 104.170423][ T5937] do_syscall_64+0x112/0x360 [ 104.170450][ T5937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 104.170473][ T5937] RIP: 0033:0x7fdb0f9be159 [ 104.170557][ T5937] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 104.170594][ T5937] RSP: 002b:00007fdb0e417028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 104.170618][ T5937] RAX: ffffffffffffffda RBX: 00007fdb0fc45fa0 RCX: 00007fdb0f9be159 [ 104.170636][ T5937] RDX: 0000000000000028 RSI: 0000200000001b40 RDI: 0000000000000012 [ 104.170652][ T5937] RBP: 00007fdb0fa5506b R08: 0000000000000000 R09: 0000000000000000 [ 104.170668][ T5937] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 104.170727][ T5937] R13: 00007fdb0fc46038 R14: 00007fdb0fc45fa0 R15: 00007ffc83f5a608 [ 104.170746][ T5937] [ 104.245241][ T29] audit: type=1400 audit(1790784645.925:414): avc: denied { write } for pid=5940 comm="syz.0.772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 104.262312][ T29] audit: type=1400 audit(1790784645.935:415): avc: denied { setopt } for pid=5940 comm="syz.0.772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 104.263315][ T29] audit: type=1400 audit(1790784645.945:416): avc: denied { connect } for pid=5940 comm="syz.0.772" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 104.511686][ T29] audit: type=1400 audit(1790784646.185:417): avc: denied { write } for pid=5949 comm="syz.2.775" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 104.549469][ T5941] loop0: detected capacity change from 0 to 512 [ 104.561366][ T29] audit: type=1400 audit(1790784646.235:418): avc: denied { write } for pid=5949 comm="syz.2.775" name="instances" dev="tracefs" ino=2107 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=dir permissive=1 [ 104.782402][ T29] audit: type=1400 audit(1790784646.455:419): avc: denied { execute } for pid=5956 comm="syz.2.777" name="file0" dev="tmpfs" ino=855 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 105.825627][ T5969] netlink: 28 bytes leftover after parsing attributes in process `syz.0.782'. [ 105.825655][ T5969] netlink: 28 bytes leftover after parsing attributes in process `syz.0.782'. [ 105.839015][ T5969] bond0: peer notification delay (14) is not a multiple of miimon (100), value rounded to 0 ms [ 105.840191][ T5969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 105.940685][ T5994] loop5: detected capacity change from 0 to 512 [ 105.950397][ T5994] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.787: corrupted in-inode xattr: invalid ea_ino [ 105.950476][ T5994] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 105.950901][ T5994] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.787: couldn't read orphan inode 15 (err -117) [ 105.950987][ T5994] loop5: lost filesystem error report for type 5 error -117 [ 105.951750][ T5994] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.340904][ T6006] netlink: 'syz.3.789': attribute type 4 has an invalid length. [ 106.495780][ T5994] netlink: 12 bytes leftover after parsing attributes in process `syz.5.787'. [ 106.499420][ T5999] netlink: 20 bytes leftover after parsing attributes in process `syz.5.787'. [ 106.575680][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 106.772290][ T6021] loop5: detected capacity change from 0 to 512 [ 106.811377][ T6021] EXT4-fs error (device loop5): ext4_iget_extra_inode:5210: inode #15: comm syz.5.796: corrupted in-inode xattr: invalid ea_ino [ 106.811411][ T6021] loop5: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 106.812815][ C0] EXT4-fs (loop5): error count since last fsck: 1 [ 106.812832][ C0] EXT4-fs (loop5): initial error at time 1790784648: ext4_iget_extra_inode:5210: inode 15 [ 106.812862][ C0] EXT4-fs (loop5): last error at time 1790784648: ext4_iget_extra_inode:5210: inode 15 [ 106.866869][ T6021] EXT4-fs error (device loop5): ext4_orphan_get:1408: comm syz.5.796: couldn't read orphan inode 15 (err -117) [ 106.867067][ T6021] loop5: lost filesystem error report for type 5 error -117 [ 106.889167][ T6021] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 106.920014][ T6021] netlink: 12 bytes leftover after parsing attributes in process `syz.5.796'. [ 106.930325][ T6021] netlink: 20 bytes leftover after parsing attributes in process `syz.5.796'. [ 107.397421][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.669380][ T6042] loop2: detected capacity change from 0 to 512 [ 107.682635][ T6047] program syz.5.804 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 107.735850][ T6042] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.803: corrupted in-inode xattr: invalid ea_ino [ 107.736175][ T6042] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 107.736439][ T6042] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.803: couldn't read orphan inode 15 (err -117) [ 107.736676][ T6042] loop2: lost filesystem error report for type 5 error -117 [ 107.745744][ T6042] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 107.765510][ T6042] netlink: 12 bytes leftover after parsing attributes in process `syz.2.803'. [ 107.829827][ T6053] loop5: detected capacity change from 0 to 128 [ 107.841732][ T6042] netlink: 20 bytes leftover after parsing attributes in process `syz.2.803'. [ 107.845201][ T6053] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: writeback. [ 107.845412][ T6053] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 107.910386][ T3302] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 107.988838][ T6053] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=6053 comm=syz.5.807 [ 108.069395][ T6066] lo speed is unknown, defaulting to 1000 [ 108.070255][ T6066] lo speed is unknown, defaulting to 1000 [ 108.070528][ T6066] lo speed is unknown, defaulting to 1000 [ 108.217780][ T6066] infiniband syz0: set active [ 108.217800][ T6066] infiniband syz0: added lo [ 108.218421][ T37] lo speed is unknown, defaulting to 1000 [ 108.238371][ T6066] RDS/IB: syz0: added [ 108.238447][ T6066] smc: adding ib device syz0 with port count 1 [ 108.238460][ T6066] smc: ib device syz0 port 1 has no pnetid [ 108.238537][ T37] lo speed is unknown, defaulting to 1000 [ 108.242557][ T5151] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 108.243296][ T6066] lo speed is unknown, defaulting to 1000 [ 108.328092][ T6066] lo speed is unknown, defaulting to 1000 [ 108.434021][ T6066] lo speed is unknown, defaulting to 1000 [ 108.556131][ T6066] lo speed is unknown, defaulting to 1000 [ 108.608171][ T6080] loop5: detected capacity change from 0 to 512 [ 108.705081][ T6066] lo speed is unknown, defaulting to 1000 [ 108.714002][ T6080] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 108.715003][ T6080] ext4 filesystem being mounted at /55/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 108.751802][ T29] kauditd_printk_skb: 90 callbacks suppressed [ 108.751818][ T29] audit: type=1400 audit(1790784650.425:510): avc: denied { write } for pid=6079 comm="syz.5.815" name="/" dev="loop5" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 108.758084][ T29] audit: type=1400 audit(1790784650.435:511): avc: denied { remove_name } for pid=6079 comm="syz.5.815" name="file1" dev="loop5" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 108.762809][ T29] audit: type=1400 audit(1790784650.435:512): avc: denied { unlink } for pid=6079 comm="syz.5.815" name="file1" dev="loop5" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 108.882699][ T29] audit: type=1400 audit(1790784650.555:513): avc: denied { create } for pid=6085 comm="syz.0.816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 108.889899][ T29] audit: type=1400 audit(1790784650.565:514): avc: denied { setopt } for pid=6085 comm="syz.0.816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 108.893796][ T29] audit: type=1400 audit(1790784650.575:515): avc: denied { read } for pid=6085 comm="syz.0.816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 108.946809][ T29] audit: type=1400 audit(1790784650.615:516): avc: denied { write } for pid=6085 comm="syz.0.816" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 109.802123][ T6103] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.808548][ T6103] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.910362][ T6104] syzkaller0: entered promiscuous mode [ 109.910385][ T6104] syzkaller0: entered allmulticast mode [ 110.025391][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 110.075919][ T29] audit: type=1400 audit(1790784651.755:517): avc: denied { create } for pid=6105 comm="syz.5.822" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 110.200475][ T6108] loop4: detected capacity change from 0 to 8192 [ 110.245565][ T6108] loop4: p1 < > p3 < p5 > p4 [ 110.247120][ T6108] loop4: p4 size 33557760 extends beyond EOD, truncated [ 110.249251][ T6108] loop4: p5 size 33557760 extends beyond EOD, truncated [ 110.321441][ T29] audit: type=1400 audit(1790784651.995:518): avc: denied { read } for pid=6106 comm="syz.4.825" name="rtc0" dev="devtmpfs" ino=244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 110.321472][ T29] audit: type=1400 audit(1790784651.995:519): avc: denied { open } for pid=6106 comm="syz.4.825" path="/dev/rtc0" dev="devtmpfs" ino=244 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 110.325454][ T6109] ip_tables: iptables: counters copy to user failed while replacing table [ 110.413794][ T6107] loop5: detected capacity change from 0 to 512 [ 110.586398][ T6107] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 110.586907][ T6107] ext4 filesystem being mounted at /56/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 110.615183][ T6107] GUP no longer grows the stack in syz.5.822 (6107): 200000005000-200000008000 (200000004000) [ 110.618131][ T6107] CPU: 1 UID: 0 PID: 6107 Comm: syz.5.822 Not tainted syzkaller #0 PREEMPT(lazy) [ 110.618160][ T6107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.618174][ T6107] Call Trace: [ 110.618183][ T6107] [ 110.618192][ T6107] __dump_stack+0x1d/0x30 [ 110.618221][ T6107] dump_stack_lvl+0x95/0xd0 [ 110.618304][ T6107] dump_stack+0x15/0x1b [ 110.618343][ T6107] fixup_user_fault+0x4fe/0x550 [ 110.618372][ T6107] fault_in_user_writeable+0x5c/0xc0 [ 110.618444][ T6107] futex_lock_pi+0x5ea/0x7c0 [ 110.618468][ T6107] ? __pfx_futex_wake_mark+0x10/0x10 [ 110.618499][ T6107] do_futex+0x2ea/0x460 [ 110.618596][ T6107] __se_sys_futex+0x2f6/0x370 [ 110.618629][ T6107] ? xfd_validate_state+0x45/0xf0 [ 110.618697][ T6107] __x64_sys_futex+0x78/0x90 [ 110.618731][ T6107] x64_sys_call+0x22e2/0x2550 [ 110.618760][ T6107] do_syscall_64+0x112/0x360 [ 110.618792][ T6107] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 110.618827][ T6107] RIP: 0033:0x7fd847b0e159 [ 110.618845][ T6107] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.618865][ T6107] RSP: 002b:00007fd846567028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 110.618888][ T6107] RAX: ffffffffffffffda RBX: 00007fd847d95fa0 RCX: 00007fd847b0e159 [ 110.618984][ T6107] RDX: 0000000000000001 RSI: 000000000000008d RDI: 0000200000004000 [ 110.618999][ T6107] RBP: 00007fd847ba506b R08: 0000000000000000 R09: 0000000000000001 [ 110.619036][ T6107] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.619050][ T6107] R13: 00007fd847d96038 R14: 00007fd847d95fa0 R15: 00007ffcd121fac8 [ 110.619072][ T6107] [ 110.728193][ T6107] tipc: Started in network mode [ 110.728454][ T6107] tipc: Node identity 7f000001, cluster identity 4711 [ 110.736189][ T6107] tipc: New replicast peer: 127.0.0.2 [ 110.748413][ T6107] tipc: Enabled bearer , priority 10 [ 110.869336][ T5151] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 111.321431][ T6130] syzkaller0: entered promiscuous mode [ 111.321451][ T6130] syzkaller0: entered allmulticast mode [ 111.426643][ T6136] program syz.4.836 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 111.524370][ T6138] loop5: detected capacity change from 0 to 512 [ 111.581325][ T6138] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 111.581478][ T6138] ext4 filesystem being mounted at /63/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 111.619177][ T6140] loop4: detected capacity change from 0 to 128 [ 111.668486][ T6140] FAT-fs (loop4): bogus logical sector size 0 [ 111.668663][ T6140] FAT-fs (loop4): This doesn't look like a DOS 1.x volume; no bootstrapping code [ 111.668796][ T6140] FAT-fs (loop4): Can't find a valid FAT filesystem [ 111.674501][ T6138] ip6gre1: entered promiscuous mode [ 111.674554][ T6138] ip6gre1: entered allmulticast mode [ 111.723074][ T24] tipc: Node number set to 2130706433 [ 111.750539][ T5151] EXT4-fs error (device loop5): ext4_lookup:1787: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 111.750766][ T5151] EXT4-fs error (device loop5): ext4_lookup:1787: inode #12: comm syz-executor: iget: bad i_size value: 2533274857506816 [ 112.057406][ T6143] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 112.084942][ T4327] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.132596][ T4327] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.191662][ T4327] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.254244][ T4327] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.360364][ T6140] loop4: detected capacity change from 0 to 1024 [ 112.410463][ T6140] EXT4-fs: Ignoring removed nomblk_io_submit option [ 112.502192][ T4327] bridge_slave_1: left allmulticast mode [ 112.502217][ T4327] bridge_slave_1: left promiscuous mode [ 112.502363][ T4327] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.503142][ T4327] bridge_slave_0: left allmulticast mode [ 112.503158][ T4327] bridge_slave_0: left promiscuous mode [ 112.503320][ T4327] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.565801][ T6140] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 112.799081][ T4327] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 112.815198][ T4327] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 112.818654][ T4327] bond0 (unregistering): Released all slaves [ 112.835235][ T6153] netlink: 'syz.0.843': attribute type 12 has an invalid length. [ 112.845905][ T6140] netlink: 28 bytes leftover after parsing attributes in process `syz.4.838'. [ 112.846027][ T6140] netlink: 28 bytes leftover after parsing attributes in process `syz.4.838'. [ 112.958339][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.047498][ T3021] 8021q: adding VLAN 0 to HW filter on device eth5 [ 113.086374][ T6149] lo speed is unknown, defaulting to 1000 [ 113.096482][ T4327] hsr_slave_0: left promiscuous mode [ 113.103910][ T4327] hsr_slave_1: left promiscuous mode [ 113.105841][ T4327] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 113.105860][ T4327] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 113.111043][ T4327] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 113.111060][ T4327] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 113.112063][ T6182] loop4: detected capacity change from 0 to 512 [ 113.131687][ T4327] veth1_macvtap: left promiscuous mode [ 113.131780][ T4327] veth0_macvtap: left promiscuous mode [ 113.131863][ T4327] veth1_vlan: left promiscuous mode [ 113.137807][ T4327] veth0_vlan: left promiscuous mode [ 113.178918][ T6182] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.845: corrupted in-inode xattr: invalid ea_ino [ 113.178996][ T6182] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 113.182802][ C1] EXT4-fs (loop4): error count since last fsck: 1 [ 113.182823][ C1] EXT4-fs (loop4): initial error at time 1790784654: ext4_iget_extra_inode:5210: inode 15 [ 113.182852][ C1] EXT4-fs (loop4): last error at time 1790784654: ext4_iget_extra_inode:5210: inode 15 [ 113.184527][ T6182] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.845: couldn't read orphan inode 15 (err -117) [ 113.184557][ T6182] loop4: lost filesystem error report for type 5 error -117 [ 113.199924][ T6182] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 113.407717][ T4327] team0 (unregistering): Port device team_slave_1 removed [ 113.420311][ T4327] team0 (unregistering): Port device team_slave_0 removed [ 113.509045][ T6182] netlink: 12 bytes leftover after parsing attributes in process `syz.4.845'. [ 113.552518][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 113.732891][ T6191] netlink: 16 bytes leftover after parsing attributes in process `syz.4.847'. [ 113.732914][ T6191] netlink: 8 bytes leftover after parsing attributes in process `syz.4.847'. [ 113.857941][ T6204] program syz.0.848 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 113.889532][ T29] kauditd_printk_skb: 18 callbacks suppressed [ 113.889583][ T29] audit: type=1400 audit(1790784655.565:538): avc: denied { write } for pid=6186 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 113.946925][ T6213] loop0: detected capacity change from 0 to 512 [ 113.947246][ T6213] ext4: Bad value for 'errors' [ 113.982420][ T29] audit: type=1400 audit(1790784655.655:539): avc: denied { write } for pid=6215 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 114.005079][ T29] audit: type=1400 audit(1790784655.685:540): avc: denied { create } for pid=6209 comm="syz.0.849" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 114.021720][ T6149] bridge0: port 1(bridge_slave_0) entered blocking state [ 114.021756][ T6149] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.021828][ T6149] bridge_slave_0: entered allmulticast mode [ 114.027609][ T6149] bridge_slave_0: entered promiscuous mode [ 114.032681][ T6149] bridge0: port 2(bridge_slave_1) entered blocking state [ 114.032723][ T6149] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.032906][ T6149] bridge_slave_1: entered allmulticast mode [ 114.034989][ T6149] bridge_slave_1: entered promiscuous mode [ 114.096055][ T6149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 114.097046][ T6149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 114.134698][ T3021] 8021q: adding VLAN 0 to HW filter on device eth6 [ 114.156234][ T6219] loop0: detected capacity change from 0 to 512 [ 114.187296][ T6219] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.850: corrupted in-inode xattr: invalid ea_ino [ 114.187327][ T6219] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 114.191711][ T6219] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.850: couldn't read orphan inode 15 (err -117) [ 114.191741][ T6219] loop0: lost filesystem error report for type 5 error -117 [ 114.192796][ C1] EXT4-fs (loop0): error count since last fsck: 2 [ 114.192816][ C1] EXT4-fs (loop0): initial error at time 1790784655: ext4_iget_extra_inode:5210: inode 15 [ 114.192864][ C1] EXT4-fs (loop0): last error at time 1790784655: ext4_orphan_get:1408 [ 114.274381][ T6149] team0: Port device team_slave_0 added [ 114.275450][ T6219] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 114.283044][ T6149] team0: Port device team_slave_1 added [ 114.343658][ T6149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 114.343672][ T6149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.343704][ T6149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.344288][ T6149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.344301][ T6149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.344343][ T6149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.366526][ T6219] netlink: 8 bytes leftover after parsing attributes in process `syz.0.850'. [ 114.442426][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 114.474767][ T6149] hsr_slave_0: entered promiscuous mode [ 114.475112][ T6149] hsr_slave_1: entered promiscuous mode [ 114.480246][ T6149] debugfs: 'hsr0' already exists in 'hsr' [ 114.480262][ T6149] Cannot create hsr debugfs directory [ 114.560522][ T29] audit: type=1400 audit(1790784656.235:541): avc: denied { write } for pid=6222 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 114.653836][ T29] audit: type=1400 audit(1790784656.335:542): avc: denied { write } for pid=6239 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 114.798395][ T3021] 8021q: adding VLAN 0 to HW filter on device eth7 [ 114.849785][ T29] audit: type=1400 audit(1790784656.525:543): avc: denied { listen } for pid=6243 comm="syz.0.853" lport=20003 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 114.963648][ T6149] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 114.996441][ T6149] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 114.996977][ T6149] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 115.023401][ T6149] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 115.030519][ T6149] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 115.049358][ T6149] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 115.050023][ T6149] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 115.074618][ T6149] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 115.151481][ T29] audit: type=1400 audit(1790784656.825:544): avc: denied { write } for pid=6248 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 115.247909][ T29] audit: type=1400 audit(1790784656.925:545): avc: denied { write } for pid=6267 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 115.286741][ T6149] 8021q: adding VLAN 0 to HW filter on device bond0 [ 115.311761][ T6149] 8021q: adding VLAN 0 to HW filter on device team0 [ 115.313054][ T3021] 8021q: adding VLAN 0 to HW filter on device eth8 [ 115.328096][ T42] bridge0: port 1(bridge_slave_0) entered blocking state [ 115.328126][ T42] bridge0: port 1(bridge_slave_0) entered forwarding state [ 115.337869][ T4327] bridge0: port 2(bridge_slave_1) entered blocking state [ 115.337904][ T4327] bridge0: port 2(bridge_slave_1) entered forwarding state [ 115.564742][ T6149] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 115.570656][ T6284] program syz.4.855 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 115.632736][ T6289] syz.0.857 uses obsolete (PF_INET,SOCK_PACKET) [ 115.642284][ T29] audit: type=1400 audit(1790784657.315:546): avc: denied { ioctl } for pid=6288 comm="syz.0.857" path="socket:[17237]" dev="sockfs" ino=17237 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 115.753359][ T6291] loop4: detected capacity change from 0 to 512 [ 115.780068][ T6297] program syz.0.858 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 115.810952][ T6291] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.856: corrupted in-inode xattr: invalid ea_ino [ 115.810984][ T6291] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 115.811803][ T6291] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.856: couldn't read orphan inode 15 (err -117) [ 115.811837][ T6291] loop4: lost filesystem error report for type 5 error -117 [ 115.812818][ C0] EXT4-fs (loop4): error count since last fsck: 2 [ 115.812835][ C0] EXT4-fs (loop4): initial error at time 1790784657: ext4_iget_extra_inode:5210: inode 15 [ 115.812864][ C0] EXT4-fs (loop4): last error at time 1790784657: ext4_orphan_get:1408 [ 115.829441][ T29] audit: type=1400 audit(1790784657.515:547): avc: denied { name_bind } for pid=6301 comm="syz.0.859" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 115.839540][ T6302] netlink: 16 bytes leftover after parsing attributes in process `syz.0.859'. [ 115.927308][ T6291] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 115.959956][ T6291] netlink: 12 bytes leftover after parsing attributes in process `syz.4.856'. [ 115.960006][ T6149] veth0_vlan: entered promiscuous mode [ 115.967204][ T6149] veth1_vlan: entered promiscuous mode [ 115.990566][ T6149] veth0_macvtap: entered promiscuous mode [ 115.997078][ T6149] veth1_macvtap: entered promiscuous mode [ 116.019696][ T6149] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 116.029549][ T6149] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 116.038542][ T3297] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 116.053633][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.053792][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.053880][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.053945][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 116.146496][ T6314] netlink: 8 bytes leftover after parsing attributes in process `syz.4.860'. [ 116.294307][ T6318] hsr0: entered allmulticast mode [ 116.294332][ T6318] hsr_slave_0: entered allmulticast mode [ 116.294355][ T6318] hsr_slave_1: entered allmulticast mode [ 116.294998][ T6318] netlink: 4 bytes leftover after parsing attributes in process `syz.6.861'. [ 116.295093][ T6318] hsr_slave_0: left promiscuous mode [ 116.295460][ T6318] hsr_slave_1: left promiscuous mode [ 116.304580][ T6318] hsr0 (unregistering): left allmulticast mode [ 116.639879][ T6314] loop4: detected capacity change from 0 to 1164 [ 116.706070][ T6314] ISOFS: primary root directory is empty. Disabling Rock Ridge and switching to Joliet. [ 116.758859][ T6310] netlink: 'syz.4.860': attribute type 2 has an invalid length. [ 116.800775][ T6310] team0: left allmulticast mode [ 116.800798][ T6310] team_slave_0: left allmulticast mode [ 116.800816][ T6310] team_slave_1: left allmulticast mode [ 116.800974][ T6310] team0: left promiscuous mode [ 116.800986][ T6310] team_slave_0: left promiscuous mode [ 116.801045][ T6310] team_slave_1: left promiscuous mode [ 116.801751][ T6310] bridge0: port 3(team0) entered disabled state [ 116.820444][ T6314] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1544 sclass=netlink_route_socket pid=6314 comm=syz.4.860 [ 116.845556][ T6310] bridge_slave_0: left allmulticast mode [ 116.845580][ T6310] bridge_slave_0: left promiscuous mode [ 116.845677][ T6310] bridge0: port 1(bridge_slave_0) entered disabled state [ 116.868502][ T6310] bridge_slave_1: left allmulticast mode [ 116.868524][ T6310] bridge_slave_1: left promiscuous mode [ 116.868628][ T6310] bridge0: port 2(bridge_slave_1) entered disabled state [ 116.898541][ T6310] team0: Port device team_slave_0 removed [ 116.908910][ T6310] team0: Port device team_slave_1 removed [ 116.914928][ T6310] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 116.914948][ T6310] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 116.920211][ T6310] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 116.920228][ T6310] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 116.929084][ T6310] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 116.929144][ T37] lo speed is unknown, defaulting to 1000 [ 117.057556][ T6325] sg_write: data in/out 483328/136 bytes for SCSI command 0x0-- guessing data in; [ 117.057556][ T6325] program syz.0.863 not setting count and/or reply_len properly [ 117.077221][ T6325] netlink: 'syz.0.863': attribute type 4 has an invalid length. [ 117.121641][ T6325] netlink: 'syz.0.863': attribute type 4 has an invalid length. [ 117.396844][ T6334] Failure starting scanning (-16) [ 117.553698][ T6339] loop4: detected capacity change from 0 to 128 [ 117.555824][ T6339] msdos: Bad value for 'gid' [ 117.555841][ T6339] msdos: Bad value for 'gid' [ 117.720124][ T6344] program syz.4.868 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 118.357867][ T6349] loop6: detected capacity change from 0 to 1024 [ 118.362302][ T6349] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 118.369292][ T6349] JBD2: no valid journal superblock found [ 118.369307][ T6349] EXT4-fs (loop6): Could not load journal inode [ 118.826954][ T6362] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 119.187199][ T6370] loop0: detected capacity change from 0 to 512 [ 119.226174][ T6370] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 119.226277][ T6370] ext4 filesystem being mounted at /199/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 119.357572][ T29] kauditd_printk_skb: 10 callbacks suppressed [ 119.357592][ T29] audit: type=1400 audit(1790784661.035:558): avc: denied { write } for pid=6369 comm="syz.0.874" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.357675][ T29] audit: type=1400 audit(1790784661.035:559): avc: denied { create } for pid=6369 comm="syz.0.874" name="tracing" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 119.434297][ T29] audit: type=1400 audit(1790784661.115:560): avc: denied { setattr } for pid=6369 comm="syz.0.874" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.436707][ T29] audit: type=1400 audit(1790784661.115:561): avc: denied { mounton } for pid=6369 comm="syz.0.874" path="/199/bus/file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.436738][ T29] audit: type=1400 audit(1790784661.115:562): avc: denied { mount } for pid=6369 comm="syz.0.874" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 119.562887][ T29] audit: type=1400 audit(1790784661.235:563): avc: denied { write } for pid=3304 comm="syz-executor" name="/" dev="loop0" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.562916][ T29] audit: type=1400 audit(1790784661.245:564): avc: denied { unmount } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 119.572089][ T29] audit: type=1400 audit(1790784661.245:565): avc: denied { write } for pid=3304 comm="syz-executor" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.572180][ T29] audit: type=1400 audit(1790784661.245:566): avc: denied { write } for pid=3304 comm="syz-executor" name="file0" dev="loop0" ino=12 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 119.572216][ T29] audit: type=1400 audit(1790784661.245:567): avc: denied { unlink } for pid=3304 comm="syz-executor" name="file1" dev="loop0" ino=14 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 119.595566][ T3304] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 120.483539][ T6389] program syz.0.879 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 121.078705][ T6399] bonding: no command found in bonding_masters - use +ifname or -ifname [ 121.383039][ T3387] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 121.417170][ T6399] loop6: detected capacity change from 0 to 512 [ 121.445691][ T6399] EXT4-fs: Ignoring removed nobh option [ 121.472945][ T6399] EXT4-fs (loop6): orphan cleanup on readonly fs [ 121.474096][ T6399] EXT4-fs error (device loop6): ext4_validate_block_bitmap:436: comm syz.6.883: bg 0: block 7: invalid block bitmap [ 121.474135][ T6399] loop6: lost filesystem error report for type 5 error -117 [ 121.479929][ T6399] EXT4-fs error (device loop6) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 121.480030][ T6399] loop6: lost filesystem error report for type 5 error -117 [ 121.482846][ C0] EXT4-fs (loop6): error count since last fsck: 2 [ 121.482871][ C0] EXT4-fs (loop6): initial error at time 1790784663: ext4_validate_block_bitmap:436 [ 121.482899][ C0] EXT4-fs (loop6): last error at time 1790784663: ext4_mb_clear_bb:6680 [ 121.563553][ T6399] EXT4-fs error (device loop6): ext4_xattr_delete_inode:2933: inode #11: comm syz.6.883: corrupted xattr block 95: invalid header [ 121.563732][ T6399] loop6: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 121.567027][ T6399] EXT4-fs warning (device loop6): ext4_evict_inode:288: xattr delete (err -117) [ 121.567396][ T6399] EXT4-fs (loop6): 1 orphan inode deleted [ 121.622741][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 121.623037][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 121.632412][ T6399] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 121.680741][ T6399] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 121.712931][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 121.885160][ T6447] program syz.4.890 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 122.647559][ T6472] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.765296][ T6472] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.795536][ T6482] Failure starting scanning (-16) [ 122.835944][ T6472] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.860640][ T6472] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.860987][ T6472] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.861333][ T6473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.861639][ T6473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.861782][ T6473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.861916][ T6473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 122.862065][ T6473] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 123.063093][ T6475] lo speed is unknown, defaulting to 1000 [ 123.601883][ T6475] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.601916][ T6475] bridge0: port 1(bridge_slave_0) entered disabled state [ 123.602038][ T6475] bridge_slave_0: entered allmulticast mode [ 123.605761][ T6475] bridge_slave_0: entered promiscuous mode [ 123.606672][ T6475] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.606703][ T6475] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.606757][ T6475] bridge_slave_1: entered allmulticast mode [ 123.612602][ T6475] bridge_slave_1: entered promiscuous mode [ 123.639587][ T6475] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 123.640796][ T6475] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 123.674533][ T6475] team0: Port device team_slave_0 added [ 123.675427][ T6475] team0: Port device team_slave_1 added [ 123.713503][ T6475] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 123.713518][ T6475] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 123.713586][ T6475] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 123.714102][ T6475] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 123.714116][ T6475] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 123.714150][ T6475] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 123.749294][ T6519] program syz.6.901 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 123.809884][ T6475] hsr_slave_0: entered promiscuous mode [ 123.810400][ T6475] hsr_slave_1: entered promiscuous mode [ 123.810673][ T6475] debugfs: 'hsr0' already exists in 'hsr' [ 123.810705][ T6475] Cannot create hsr debugfs directory [ 124.148821][ T6475] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 124.346123][ T6516] loop0: detected capacity change from 0 to 1024 [ 124.370095][ T6516] EXT4-fs warning (device loop0): read_mmp_block:110: Error -117 while reading MMP block 0 [ 124.668253][ T6475] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 124.713885][ T6475] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 124.719229][ T6475] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 124.721869][ T6475] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 124.736531][ T6475] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 124.746372][ T6475] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 124.759818][ T6475] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 124.860409][ T29] kauditd_printk_skb: 23 callbacks suppressed [ 124.860428][ T29] audit: type=1400 audit(1790784666.535:591): avc: denied { ioctl } for pid=6536 comm="syz.4.906" path="user:[4026531837]" dev="nsfs" ino=4026531837 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 124.875743][ T29] audit: type=1400 audit(1790784666.545:592): avc: denied { getopt } for pid=6536 comm="syz.4.906" lport=58 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 124.955342][ T6475] 8021q: adding VLAN 0 to HW filter on device bond0 [ 124.995244][ T6475] 8021q: adding VLAN 0 to HW filter on device team0 [ 125.002426][ T6527] lo speed is unknown, defaulting to 1000 [ 125.008075][ T70] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.008110][ T70] bridge0: port 1(bridge_slave_0) entered forwarding state [ 125.009747][ T6563] program syz.0.911 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 125.031633][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.031668][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 125.220653][ T6561] loop6: detected capacity change from 0 to 128 [ 125.267976][ T6561] EXT4-fs (loop6): mounting ext2 file system using the ext4 subsystem [ 125.345580][ T6561] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 125.348203][ T6561] ext2 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 125.456536][ T6475] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 125.539296][ T6149] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 125.606561][ T6527] bridge0: port 1(bridge_slave_0) entered blocking state [ 125.606883][ T6527] bridge0: port 1(bridge_slave_0) entered disabled state [ 125.607002][ T6527] bridge_slave_0: entered allmulticast mode [ 125.613544][ T6527] bridge_slave_0: entered promiscuous mode [ 125.658789][ T6527] bridge0: port 2(bridge_slave_1) entered blocking state [ 125.659662][ T6527] bridge0: port 2(bridge_slave_1) entered disabled state [ 125.660340][ T6527] bridge_slave_1: entered allmulticast mode [ 125.693256][ T6527] bridge_slave_1: entered promiscuous mode [ 125.711559][ T6601] netlink: 16 bytes leftover after parsing attributes in process `syz.6.915'. [ 125.857615][ T6527] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 125.883046][ T6527] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 126.000218][ T6527] team0: Port device team_slave_0 added [ 126.000896][ T6609] loop6: detected capacity change from 0 to 256 [ 126.012583][ T6527] team0: Port device team_slave_1 added [ 126.053432][ T6527] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 126.053477][ T6527] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.053513][ T6527] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 126.055137][ T6527] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 126.055150][ T6527] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 126.055231][ T6527] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 126.244305][ T6612] ================================================================== [ 126.244344][ T6612] BUG: KCSAN: data-race in fat16_ent_put / fat_mirror_bhs [ 126.244389][ T6612] [ 126.244395][ T6612] write to 0xffff888109501e2c of 2 bytes by task 6611 on cpu 1: [ 126.244411][ T6612] fat16_ent_put+0x28/0x60 [ 126.244442][ T6612] fat_ent_write+0x6c/0xe0 [ 126.244470][ T6612] fat_chain_add+0x170/0x4c0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 126.244492][ T6612] fat_get_block+0x468/0x5e0 [ 126.244507][ T6612] __block_write_begin_int+0x400/0xf90 [ 126.244539][ T6612] cont_write_begin+0x5bf/0x920 [ 126.244563][ T6613] syz.6.917: attempt to access beyond end of device [ 126.244563][ T6613] loop6: rw=1, sector=15496, nr_sectors = 32 limit=256 [ 126.244572][ T6612] fat_write_begin+0x52/0xe0 [ 126.244595][ T6612] generic_perform_write+0x186/0x490 [ 126.244627][ T6612] __generic_file_write_iter+0x9e/0x120 [ 126.244626][ T6613] syz.6.917: attempt to access beyond end of device [ 126.244626][ T6613] loop6: rw=1, sector=16744, nr_sectors = 32 limit=256 [ 126.244658][ T6612] generic_file_write_iter+0x77/0x1f0 [ 126.244686][ T6612] __kernel_write_iter+0x30f/0x590 [ 126.244717][ T6613] syz.6.917: attempt to access beyond end of device [ 126.244717][ T6613] loop6: rw=1, sector=17832, nr_sectors = 32 limit=256 [ 126.244722][ T6612] dump_user_range+0xa73/0xd00 [ 126.244770][ T6612] elf_core_dump+0x21c0/0x2340 [ 126.244790][ T6612] coredump_write+0xafb/0xdd0 [ 126.244821][ T6612] vfs_coredump+0x2762/0x3270 [ 126.244771][ T6613] syz.6.917: attempt to access beyond end of device [ 126.244771][ T6613] loop6: rw=1, sector=18664, nr_sectors = 32 limit=256 [ 126.244855][ T6612] get_signal+0xd33/0xf10 [ 126.244879][ T6613] syz.6.917: attempt to access beyond end of device [ 126.244879][ T6613] loop6: rw=1, sector=19560, nr_sectors = 32 limit=256 [ 126.244893][ T6612] arch_do_signal_or_restart+0x96/0x480 [ 126.244924][ T6612] irqentry_exit+0x14d/0x610 [ 126.244952][ T6612] asm_exc_page_fault+0x26/0x30 [ 126.244972][ T6612] [ 126.244978][ T6612] read to 0xffff888109501800 of 2048 bytes by task 6612 on cpu 0: [ 126.245001][ T6613] syz.6.917: attempt to access beyond end of device [ 126.245001][ T6613] loop6: rw=1, sector=20456, nr_sectors = 32 limit=256 [ 126.244997][ T6612] fat_mirror_bhs+0x1df/0x330 [ 126.245032][ T6612] fat_ent_write+0xd0/0xe0 [ 126.245060][ T6612] fat_chain_add+0x170/0x4c0 [ 126.245073][ T6613] syz.6.917: attempt to access beyond end of device [ 126.245073][ T6613] loop6: rw=1, sector=21192, nr_sectors = 32 limit=256 [ 126.245085][ T6612] fat_get_block+0x468/0x5e0 [ 126.245105][ T6612] __block_write_begin_int+0x400/0xf90 [ 126.245133][ T6612] cont_write_begin+0x5bf/0x920 [ 126.245161][ T6612] fat_write_begin+0x52/0xe0 [ 126.245183][ T6612] generic_perform_write+0x186/0x490 [ 126.245215][ T6612] __generic_file_write_iter+0x9e/0x120 [ 126.245222][ T6613] syz.6.917: attempt to access beyond end of device [ 126.245222][ T6613] loop6: rw=1, sector=21416, nr_sectors = 32 limit=256 [ 126.245248][ T6612] generic_file_write_iter+0x77/0x1f0 [ 126.245276][ T6612] vfs_write+0x57f/0x9a0 [ 126.245301][ T6612] ksys_write+0xdc/0x1a0 [ 126.245329][ T6612] __x64_sys_write+0x40/0x50 [ 126.245357][ T6613] syz.6.917: attempt to access beyond end of device [ 126.245357][ T6613] loop6: rw=1, sector=21896, nr_sectors = 32 limit=256 [ 126.245363][ T6612] x64_sys_call+0x154e/0x2550 [ 126.245393][ T6612] do_syscall_64+0x112/0x360 [ 126.245414][ T6612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 126.245434][ T6612] [ 126.245438][ T6612] Reported by Kernel Concurrency Sanitizer on: [ 126.245448][ T6612] CPU: 0 UID: 0 PID: 6612 Comm: syz.6.917 Not tainted syzkaller #0 PREEMPT(lazy) [ 126.245472][ T6612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 126.245484][ T6612] ================================================================== [ 126.245524][ T6613] syz.6.917: attempt to access beyond end of device [ 126.245524][ T6613] loop6: rw=1, sector=22760, nr_sectors = 32 limit=256 [ 126.446329][ T6527] hsr_slave_0: entered promiscuous mode [ 126.446749][ T6527] hsr_slave_1: entered promiscuous mode [ 126.458622][ T6527] debugfs: 'hsr0' already exists in 'hsr' [ 126.458638][ T6527] Cannot create hsr debugfs directory [ 126.939295][ T31] bridge_slave_1: left allmulticast mode [ 126.939397][ T31] bridge_slave_1: left promiscuous mode [ 126.957158][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 126.967698][ T31] bridge_slave_0: left allmulticast mode [ 126.967722][ T31] bridge_slave_0: left promiscuous mode [ 126.967979][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 126.983038][ T29] audit: type=1400 audit(1790784668.655:593): avc: denied { write } for pid=6618 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.009716][ T29] audit: type=1400 audit(1790784668.675:594): avc: denied { write } for pid=6636 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.033784][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 127.034881][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 127.035633][ T31] bond0 (unregistering): Released all slaves [ 127.154432][ T31] hsr_slave_0: left promiscuous mode [ 127.155692][ T31] hsr_slave_1: left promiscuous mode [ 127.156176][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 127.157988][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 127.186304][ T29] audit: type=1400 audit(1790784668.855:595): avc: denied { write } for pid=6640 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.188251][ T31] team0 (unregistering): Port device team_slave_1 removed [ 127.210967][ T29] audit: type=1400 audit(1790784668.875:596): avc: denied { write } for pid=6651 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.212546][ T31] team0 (unregistering): Port device team_slave_0 removed [ 127.509062][ T29] audit: type=1400 audit(1790784669.185:597): avc: denied { write } for pid=6654 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.527594][ T29] audit: type=1400 audit(1790784669.195:598): avc: denied { write } for pid=6665 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 127.736857][ T31] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.786976][ T31] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.846090][ T31] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.867251][ T31] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.937955][ T31] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.957538][ T31] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.008628][ T31] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.028940][ T29] audit: type=1400 audit(1790784669.705:599): avc: denied { write } for pid=6670 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.059636][ T31] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 128.079080][ T29] audit: type=1400 audit(1790784669.755:600): avc: denied { write } for pid=6681 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 128.164356][ T31] bridge_slave_1: left allmulticast mode [ 128.164380][ T31] bridge_slave_1: left promiscuous mode [ 128.164515][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.167732][ T31] bridge_slave_0: left allmulticast mode [ 128.167752][ T31] bridge_slave_0: left promiscuous mode [ 128.167851][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.170110][ T31] team0: left allmulticast mode [ 128.170127][ T31] team_slave_0: left allmulticast mode [ 128.170142][ T31] team_slave_1: left allmulticast mode [ 128.170302][ T31] team0: left promiscuous mode [ 128.170314][ T31] team_slave_0: left promiscuous mode [ 128.170370][ T31] team_slave_1: left promiscuous mode [ 128.170675][ T31] bridge0: port 3(team0) entered disabled state [ 128.171385][ T31] bridge_slave_1: left allmulticast mode [ 128.171401][ T31] bridge_slave_1: left promiscuous mode [ 128.171528][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 128.172217][ T31] bridge_slave_0: left allmulticast mode [ 128.172234][ T31] bridge_slave_0: left promiscuous mode [ 128.172416][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 128.328642][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 128.329780][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 128.330694][ T31] bond0 (unregistering): Released all slaves [ 128.379035][ T31] team0: Port device bridge1 removed [ 128.381765][ T31] bond0 (unregistering): Released all slaves [ 128.499020][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.499041][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.499564][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.499580][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.501101][ T31] hsr_slave_0: left promiscuous mode [ 128.501376][ T31] hsr_slave_1: left promiscuous mode [ 128.501756][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 128.501771][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 128.502115][ T31] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 128.502129][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 128.565942][ T31] veth1_macvtap: left promiscuous mode [ 128.565970][ T31] veth0_macvtap: left promiscuous mode [ 128.566082][ T31] veth1_vlan: left promiscuous mode [ 128.566118][ T31] veth0_vlan: left promiscuous mode [ 128.589199][ T31] veth1_macvtap: left promiscuous mode [ 128.589227][ T31] veth0_macvtap: left promiscuous mode [ 128.589276][ T31] veth1_vlan: left promiscuous mode [ 128.589310][ T31] veth0_vlan: left promiscuous mode [ 128.726593][ T31] team0 (unregistering): Port device team_slave_1 removed [ 128.729233][ T31] team0 (unregistering): Port device team_slave_0 removed [ 128.804234][ T31] team0 (unregistering): Port device team_slave_1 removed [ 128.806740][ T31] team0 (unregistering): Port device team_slave_0 removed [ 128.849485][ T3021] 8021q: adding VLAN 0 to HW filter on device eth9 [ 128.974933][ T3021] 8021q: adding VLAN 0 to HW filter on device eth10 [ 129.095331][ T3021] 8021q: adding VLAN 0 to HW filter on device eth11 [ 129.214984][ T3021] 8021q: adding VLAN 0 to HW filter on device eth12 [ 129.339534][ T3021] 8021q: adding VLAN 0 to HW filter on device eth13 [ 129.456839][ T31] bridge_slave_1: left allmulticast mode [ 129.456939][ T31] bridge_slave_1: left promiscuous mode [ 129.457063][ T31] bridge0: port 2(bridge_slave_1) entered disabled state [ 129.457878][ T31] bridge_slave_0: left allmulticast mode [ 129.457894][ T31] bridge_slave_0: left promiscuous mode [ 129.457995][ T31] bridge0: port 1(bridge_slave_0) entered disabled state [ 129.533515][ T31] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 129.537025][ T31] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 129.539101][ T31] bond0 (unregistering): Released all slaves [ 129.542001][ T3021] 8021q: adding VLAN 0 to HW filter on device eth14 [ 129.621897][ T31] hsr_slave_0: left promiscuous mode [ 129.631651][ T31] hsr_slave_1: left promiscuous mode [ 129.632065][ T31] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 129.632492][ T31] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 129.700629][ T31] team0 (unregistering): Port device team_slave_1 removed [ 129.716235][ T31] team0 (unregistering): Port device team_slave_0 removed [ 129.807630][ T3021] 8021q: adding VLAN 0 to HW filter on device eth15 [ 129.899275][ T29] kauditd_printk_skb: 14 callbacks suppressed [ 129.899373][ T29] audit: type=1400 audit(1790784671.575:615): avc: denied { write } for pid=6783 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.953387][ T29] audit: type=1400 audit(1790784671.635:616): avc: denied { write } for pid=6794 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 129.990212][ T3021] 8021q: adding VLAN 0 to HW filter on device eth16 [ 130.060271][ T29] audit: type=1400 audit(1790784671.735:617): avc: denied { write } for pid=6796 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.101807][ T29] audit: type=1400 audit(1790784671.775:618): avc: denied { write } for pid=6807 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.197775][ T29] audit: type=1400 audit(1790784671.875:619): avc: denied { write } for pid=6809 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.239582][ T29] audit: type=1400 audit(1790784671.915:620): avc: denied { write } for pid=6820 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.338224][ T29] audit: type=1400 audit(1790784672.015:621): avc: denied { write } for pid=6822 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.379978][ T29] audit: type=1400 audit(1790784672.055:622): avc: denied { write } for pid=6833 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.476720][ T29] audit: type=1400 audit(1790784672.155:623): avc: denied { write } for pid=6835 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.518506][ T29] audit: type=1400 audit(1790784672.195:624): avc: denied { write } for pid=6846 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 130.663923][ T3021] 8021q: adding VLAN 0 to HW filter on device eth17 [ 130.783109][ T3021] 8021q: adding VLAN 0 to HW filter on device eth18 [ 130.901896][ T3021] 8021q: adding VLAN 0 to HW filter on device eth19 [ 131.023223][ T3021] 8021q: adding VLAN 0 to HW filter on device eth20