last executing test programs: 1.009948236s ago: executing program 4 (id=5): quotactl$Q_QUOTAON(0xffffffff80000201, &(0x7f00000002c0)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000000)='.\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x4c, 0x2}, [@initr0]}, &(0x7f0000000080)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00}, 0xfffffffffffffeaf) 1.009611376s ago: executing program 0 (id=1): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="640000001a00010029bd70000000000002202000fd0100000030000006001d004e24000008000300", @ANYRES32, @ANYBLOB="05001b0001000000060015000100000008000f0001010000060015000000000008001e00000000000500e5273a000000080019"], 0x64}}, 0x4d840) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r5 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x700000b, 0x12, r5, 0x0) write$selinux_load(r4, &(0x7f0000000000)={0xf97cff8c, 0x8, 'SE Linux', "48006246439c220f6ffecc3531919a57bc772f628c9aa314640b40e6629fc30996b09fd5b156a534"}, 0x38) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x10012, &(0x7f0000000140)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) utimensat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) write$UHID_GET_REPORT_REPLY(r2, &(0x7f0000000000)={0xa, {0x8, 0x4, 0x9}}, 0xa) write(0xffffffffffffffff, &(0x7f00000002c0)="fc0000001c000704ab5b2509b868030002ab087a0100000001481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc", 0x41) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f000000040000000800000002"], 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000080)={r6, &(0x7f0000000300), 0x0}, 0x20) utimensat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000200), &(0x7f0000000340)=0xc) llistxattr(&(0x7f0000002300)='./file0\x00', 0x0, 0x0) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180), 0x480000, 0x0) pwritev2(r7, &(0x7f0000000200), 0x0, 0xc7b, 0x6, 0x3) 1.009230816s ago: executing program 2 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2400, 0x0) setpriority(0x0, 0x0, 0x200002a14b56) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$nl_route(0x10, 0x3, 0x0) userfaultfd(0x1) bpf$PROG_LOAD(0x5, 0x0, 0x38) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$FUSE(r2, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611862000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$x86(r3, &(0x7f0000bff000/0x400000)=nil) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r5 = syz_kvm_add_vcpu$x86(r4, &(0x7f0000000080)={0x0, 0x0}) ioctl$KVM_SET_SREGS(r5, 0x4138ae84, &(0x7f0000000200)={{0x50000, 0x41000, 0x9, 0x1, 0xcd, 0x9, 0x6, 0x1, 0x0, 0x7, 0x5, 0xeb}, {0xfec09000, 0x80a0000, 0x9, 0xe, 0x5, 0x4, 0x4, 0x6, 0x5, 0x5, 0x0, 0x1}, {0x8000000, 0x102f8000, 0x1e, 0x5, 0x16, 0x7f, 0x81, 0x3, 0x80, 0x1, 0xe, 0x78}, {0xdddd0000, 0x6000, 0xb, 0xfe, 0x6, 0x9, 0xc3, 0x0, 0x0, 0x0, 0x80, 0x2e}, {0x2, 0x2000, 0xa, 0xff, 0x8, 0xa, 0xb, 0x7, 0xfa, 0x6, 0x4, 0xfc}, {0x10d000, 0x0, 0x9, 0xb9, 0x6, 0x5, 0x55, 0x6, 0x5, 0x1, 0xd, 0x9}, {0xdddd1000, 0x0, 0x0, 0x1, 0xa, 0x8, 0x4, 0x63, 0x1c, 0x4, 0x1, 0xd}, {0xdddd1000, 0x4000, 0x0, 0x23, 0x2, 0x3, 0x9, 0x4a, 0x7, 0x8, 0x43, 0x94}, {0x4000, 0x5}, {0xffff1000}, 0x0, 0x0, 0xdddd0000, 0x152690, 0xf, 0x4000, 0xeeee0c00, [0x1, 0x1004, 0x6, 0x1000]}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000340)={0x2, 0x0, @ioapic={0x0, 0xfffffffe, 0x7ffffffd, 0xfffffff5, 0x0, [{0x86, 0x40, 0x3, '\x00', 0x2}, {0x2a, 0xff, 0xad, '\x00', 0x10}, {0x32, 0x23, 0xb, '\x00', 0xfe}, {0x0, 0x1, 0x82, '\x00', 0x72}, {0x2e, 0x1, 0x27, '\x00', 0xff}, {0x0, 0x8, 0xfd, '\x00', 0x7}, {0xcf, 0x20, 0xc5, '\x00', 0xe6}, {0x6, 0x9, 0x5, '\x00', 0xe}, {0x5, 0x7f, 0x7, '\x00', 0x4d}, {0xc, 0xd, 0x0, '\x00', 0x3b}, {0x0, 0x8, 0x0, '\x00', 0x8}, {0x7, 0x6, 0x0, '\x00', 0x3}, {0x2, 0xc0, 0xa, '\x00', 0x4}, {0x6, 0x7, 0x7, '\x00', 0xfe}, {0x8, 0x5, 0x9, '\x00', 0xa9}, {0x6, 0x6, 0x7}, {0xff, 0x5, 0x6, '\x00', 0xda}, {0x5, 0xfd, 0x6, '\x00', 0x8}, {0x45, 0x4, 0xff, '\x00', 0x6}, {0x9, 0x9, 0x7a, '\x00', 0x36}, {0x80, 0xa, 0x4, '\x00', 0x5}, {0x2, 0x9, 0x8, '\x00', 0xc4}, {0x3, 0xff, 0x12, '\x00', 0x6}, {0x4, 0xa9, 0x1c, '\x00', 0xa}]}}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_CAP_HYPERV_SEND_IPI(r3, 0x4068aea3, &(0x7f00000000c0)) 969.552557ms ago: executing program 4 (id=6): syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x3, &(0x7f0000000080)={[{@min_batch_time={'min_batch_time', 0x3d, 0x2}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@noblock_validity}, {@nomblk_io_submit}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}]}, 0xfe, 0x57c, &(0x7f0000001040)="$eJzs3d1rZGcZAPDnnMwkm93oRO1FFVoXW9gtuvno2jaIdFcQrywoVfBujdnZEHaSWZJJdxOKZPEPEES04I1eeSP4BwiyF95bhIK9FyvKolsFvdAeOXPObD52pplNMplt8vvBO/Oec95znuedSc53cgI4tc5HxNWIGImIFyKiVo5PyxJbRcnbvf/gzYW8JJFlr/89iaQclzdLypI7V852pnjram1j8+Z8o1FfLYenW8u3ptc2Ni8tLc8v1hfrK5cvz74898rcS3MzR9LPvF+vfvUvP/nhL7/26m+/cPtP1/528ft5vhPl9E4/jlrxmVTzz+KhSkSsDiLYEIyU/alG5wUAgCdZvo//yYj4XHv/vxbV9t5cb6M76snAswMAAACOQnZlIv6bRGQ7JJXdwwAAAMBHW9q+BzZJp8p7ASYiTaemint4n4qzaaO51vr8jeb6yvXiXtnJqKY3lhr1mYjztWI4yYdnH55RKIZfbE/LS7LrHuAf18bb06cWmo3rwzjhAQAAAKfQuT3H//+qFcf/j/j6EJIDAAAAjs7ksBMAAAAABs7xPwAAAJx8Bzj+Hx1EHgAAAMBAfOO11/KSdZ5/ff2NjfWbzTcuXa+v3ZxaXl+YWmiu3ppabDYXG9lYxPJ+y2s0m7e+GCvrd6Zb9bXW9NrG5rXl5vpK69rSrkdgAwAAAMfoE5+9924SEVtfGm+XiLS4tj/SYwZ/KwAnRtpnuyx/eW+wuQDHq9dmHjj5Kh8+2W2+cIJVi7dk2HkAw7PfCuBMrxZvR8T4IDICAACO2oVP33s3S3Ze/y9O+lW2zw0AJ1S/1/+Bk6fH9f+sdtyJAMdun+v/wAlWdQcgnHr7X//v4e3269X9I2TZvssCAAAGaqJdknSqvBY4Eel/skJMRjW5sdSoz0TExyPij7XqWD48254z8UcDAAAAAAAAAAAAAAAAAAAAAAAAANCnLEsiO4DKgeYCAAAAhiEi/WtSPv/rQu35iV0nB0a3qx9kWXb7Z6//9M58q7U6GzGa/KPWadJ6qxz/4rGfvgAAAAB26DzlvzhOrw45GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOqvcfvLnQKX3PdObwce9/JSImu8WvlIs/E9WIOPvPJCo75ksiYuTw4WPrbqTxdLf4SZ5WTJZZ7I2fRsR4O4tDx4994j+TZVnX+OcOHR1Ot3v5+ufqI79/o9stuv/+V4py5bDxe6//0ofrv5G98SvF+u9jfcb4zDu/nt4x+O3t6lgxvdJ9/dOJn/RY/z7XLVjl0VHf/dbmZq/csl9EXOi6/Ul2xZpuLd+aXtvYvLS0PL9YX6yvXL48+/LcK3Mvzc1M3xgrG9Znusb40TO/+aBX/Pu/izhbxu986Vm5YZks3r5c9n9+b/+fzyvVXkve9r937jz4VFEtWo9sd/D+3dG4+Fz37//p9nvXz//n/87a2tuBfPqFcpuQbBX1iDjfafzsr/7wbM/+3+1sxB//+7+4f9fbXvjmD/7cZ1MA4BisbWzenG806quDrHzvdkTjrSzL+psr353rP0QSsdUZk0ZRyXewjrgX4xHRY1L3WNHvkp/qmep74xGD/3YOVLnyOI2zscf6YUu2noAOnqJK5zxaZ8xo+wfy998Z5noJAAA4etuHAcPOBAAAAAAAAAAAAAAAAAAAAE6v4/gHY3tjbg2nqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH+r/AQAA//8LDsqy") syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000140)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x3, &(0x7f0000000080)={[{@min_batch_time={'min_batch_time', 0x3d, 0x2}}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}, {@noblock_validity}, {@nomblk_io_submit}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}]}, 0xfe, 0x57c, &(0x7f0000001040)="$eJzs3d1rZGcZAPDnnMwkm93oRO1FFVoXW9gtuvno2jaIdFcQrywoVfBujdnZEHaSWZJJdxOKZPEPEES04I1eeSP4BwiyF95bhIK9FyvKolsFvdAeOXPObD52pplNMplt8vvBO/Oec95znuedSc53cgI4tc5HxNWIGImIFyKiVo5PyxJbRcnbvf/gzYW8JJFlr/89iaQclzdLypI7V852pnjram1j8+Z8o1FfLYenW8u3ptc2Ni8tLc8v1hfrK5cvz74898rcS3MzR9LPvF+vfvUvP/nhL7/26m+/cPtP1/528ft5vhPl9E4/jlrxmVTzz+KhSkSsDiLYEIyU/alG5wUAgCdZvo//yYj4XHv/vxbV9t5cb6M76snAswMAAACOQnZlIv6bRGQ7JJXdwwAAAMBHW9q+BzZJp8p7ASYiTaemint4n4qzaaO51vr8jeb6yvXiXtnJqKY3lhr1mYjztWI4yYdnH55RKIZfbE/LS7LrHuAf18bb06cWmo3rwzjhAQAAAKfQuT3H//+qFcf/j/j6EJIDAAAAjs7ksBMAAAAABs7xPwAAAJx8Bzj+Hx1EHgAAAMBAfOO11/KSdZ5/ff2NjfWbzTcuXa+v3ZxaXl+YWmiu3ppabDYXG9lYxPJ+y2s0m7e+GCvrd6Zb9bXW9NrG5rXl5vpK69rSrkdgAwAAAMfoE5+9924SEVtfGm+XiLS4tj/SYwZ/KwAnRtpnuyx/eW+wuQDHq9dmHjj5Kh8+2W2+cIJVi7dk2HkAw7PfCuBMrxZvR8T4IDICAACO2oVP33s3S3Ze/y9O+lW2zw0AJ1S/1/+Bk6fH9f+sdtyJAMdun+v/wAlWdQcgnHr7X//v4e3269X9I2TZvssCAAAGaqJdknSqvBY4Eel/skJMRjW5sdSoz0TExyPij7XqWD48254z8UcDAAAAAAAAAAAAAAAAAAAAAAAAANCnLEsiO4DKgeYCAAAAhiEi/WtSPv/rQu35iV0nB0a3qx9kWXb7Z6//9M58q7U6GzGa/KPWadJ6qxz/4rGfvgAAAAB26DzlvzhOrw45GwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOqvcfvLnQKX3PdObwce9/JSImu8WvlIs/E9WIOPvPJCo75ksiYuTw4WPrbqTxdLf4SZ5WTJZZ7I2fRsR4O4tDx4994j+TZVnX+OcOHR1Ot3v5+ufqI79/o9stuv/+V4py5bDxe6//0ofrv5G98SvF+u9jfcb4zDu/nt4x+O3t6lgxvdJ9/dOJn/RY/z7XLVjl0VHf/dbmZq/csl9EXOi6/Ul2xZpuLd+aXtvYvLS0PL9YX6yvXL48+/LcK3Mvzc1M3xgrG9Znusb40TO/+aBX/Pu/izhbxu986Vm5YZks3r5c9n9+b/+fzyvVXkve9r937jz4VFEtWo9sd/D+3dG4+Fz37//p9nvXz//n/87a2tuBfPqFcpuQbBX1iDjfafzsr/7wbM/+3+1sxB//+7+4f9fbXvjmD/7cZ1MA4BisbWzenG806quDrHzvdkTjrSzL+psr353rP0QSsdUZk0ZRyXewjrgX4xHRY1L3WNHvkp/qmep74xGD/3YOVLnyOI2zscf6YUu2noAOnqJK5zxaZ8xo+wfy998Z5noJAAA4etuHAcPOBAAAAAAAAAAAAAAAAAAAAE6v4/gHY3tjbg2nqwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH+r/AQAA//8LDsqy") (async) 915.186528ms ago: executing program 1 (id=2): syz_clone3(&(0x7f0000000bc0)={0x5000180, &(0x7f0000000140), &(0x7f00000002c0), &(0x7f0000000340)=0x0, {0x27}, &(0x7f00000009c0)=""/195, 0xc3, &(0x7f0000000ac0)=""/181, &(0x7f0000000b80)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0x4}, 0x58) sched_setscheduler(r0, 0x3, &(0x7f0000000c40)) syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x2008002, &(0x7f00000000c0)={[{@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x1000}}, {@nobh}, {@quota}]}, 0x1, 0x560, &(0x7f0000000440)="$eJzs3c9vI1cdAPDvTH42u212oQeogF2gsKDV2htvu6p6abmAUFWpouLEYRsSbxTWXi+xU5oQifRvAAkkTvAncEDigNQTB24ckTgAohyQCkSgDRIHoxlPEjdxWLN2bDb+fKTZ+fFm5vuevTPv+dmZF8DEuhoRuxExGxFvRcRisT0ppni1M2X7PdzbWdnf21lJot1+829Jnp5ti65jMheKc85HxNe+EvHN5GTc5tb2veVarbpRrJdb9Qfl5tb2jfX68lp1rXq/Urm9dPvmS7derAytrFfqP/vgy+uvff2Xv/jk+7/Z/eJ3s2xdLNK6yzFMnaLPHMbJTEfEa2cRbAymivnsmPPB40kj4iMR8Zn8+l+Mqfx/JwBwnrXbi9Fe7F4HAM67NO8DS9JSRKRp0Qgodfrwno2FtNZotq7fbWzeX+30lV2KmfTueq168/Lc776d7zyTZOtLeVqenq9Xjq3fiojLEfGDuafy9dJKo7Y6niYPAEy8C931f0T8cy5NS6W+Du3xrR4A8MSYH3cGAICRU/8DwORR/wPA5Omj/i++7N8987wAAKPh8z8ATB71PwBMHvU/AEyUN15/PZva+8Xzr1ff3tq813j7xmq1ea9U31wprTQ2HpTWGo21/Jk99Uedr9ZoPFh6ITbfKbeqzVa5ubV9p97YvN+6kz/X+051ZiSlAgD+m8tX3vttEhG7Lz+VT9E1loO6Gs63dIh7AU+WqUEO1kCAJ5rRvmBy9VWF542EX595XoDx6Pkw7/meix/2o/8hiN8Zwf+Vax/vv//fGM9wvujZh8n1eP3/rww9H8DoPXb//x+Gmw9g9Nrt5PiY/7OHSd3eGOWoxADAWRrgJ3zt7w2rEQKM1aMG8x7K9/8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwzlyMiG9FkpbyscDT7N+0VIp4OiIuxUxyd71WvRkRz8SViJiZy9aXxp1pAGBA6V+SYvyva4vPXzyeOpv8ay6fR8R3fvzmD99ZbrU2lrLtfz/cPncwfFjl6LgBxhUEAPr3p352yuvvSjHv+iD/cG9n5WA6wzye8MGXDgcfXdnf28mnTsp0tNvtdsR83pZY+EcS08Ux8xHxXERMDSH+7rsR8bFe5U/yvpFLxcin3fGjiP30SOOnH4qf5mmdefbyfXQIeYFJ8152/3m11/WXxtV83vv6n8/vUIPL73/zEQf3vv2u+NNFpKke8bNr/mq/MV741VdPbGwvdtLejXhuulf85DB+ckr85/uM//tPfOr7r5yS1v5JxLXoHb87VrlVf1Bubm3fWK8vr1XXqvcrldtLt2++dOvFSjnvoy4f9FSf9NeXrz9zWt6y8i+cEr/zzl84Vv7Zw2M/12f5f/rvt77x6aPVuePxv/DZ3u//s/m89+uf1Ymf7zP+8sLPTx2+O4u/ekr5H/X+X+8z/vt/3l7tc1cAYASaW9v3lmu16sZAC9mn0GGc58RClsX+dj5oLg4W9I+RLxy9LEkkMexyZY2xfnaeOatX9cwXpg/bisM44VRnYaE45YiLkw6pFIMtxKVi4eGogo7nfgSMztFFP+6cAAAAAAAAAAAAAAAApxnF3zCNu4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcX/8JAAD//7a0vsc=") syz_mount_image$ext4(0x0, &(0x7f00000001c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x2800040, 0x0, 0x1, 0x0, &(0x7f0000000140)) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000000), &(0x7f0000000100)=0xc) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000300)=0x20) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="f40000000001010400000000141a00000200ffff0800074000000001240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e02010c000280050001000000000090000d"], 0xf4}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001600)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac14143208000200e00000020c0002800500010000000000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007400000000020000680080001"], 0x84}}, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) 896.388879ms ago: executing program 3 (id=4): syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000500)='./bus\x00', 0x1000c40, &(0x7f00000002c0), 0x5, 0x51c, &(0x7f0000000700)="$eJzs3cFvI1cZAPBvZjebNE2bFCoVENClFBa0WjvxtlHVU7mAUFUJUXHikIbEG0Vx4ih2ShNWavI/IFGJA4ITZyQQHCr1xBHBDW69lANSgRWoQeJgNONx1t3YG3c3awv795NGM29mMt97Y8178RfHL4CJdTUijiLiSkS8ERHzxf6kWOKV9pKd99Gd22snd26vJdFqvf6PJD+e7Yuun8k8XlxzJiK++62IHyRn4zYODrdWa7XqXlEuN7d3y42Dwxub26sb1Y3qTqWyvLS8+NLNFysDtWNmgHOe3f7Vh9/cfPV77/7uCx/86ejrP8qqNVcc627HRWo3feo0TuZyRLz6KIKNwKWiPVdGXREeSBoRn4qI5/Lnfz4u5a/mYHo81gDA/4FWaz5a891lAGDcpXkOLElLRS5gLtK0VGrn8J6O2bRWbzSv36rv76y3c2ULMZXe2qxVF4tc4UJMJVl56e1s+265Eh8v34yIpyLix9OP5eXS2uB5BgDgYj1+z/j/7+n2+A8AjLmeH57pfn++Mry6AADDMciHZwGA8WL8B4DJc3f8nx1pPQCA4fH+HwAmj/EfACbN+53x/9KoawIADMV3XnstW1onxfdfr795sL9Vf/PGerWxVdreXyut1fd2Sxv1+katWlqrb593vVq9vrv0Quy/VW5WG81y4+BwZbu+v9Ncyb/Xe6U6NZRWAQD389Sz7/0liYijlx/Ll+iay8FYDeMtHXUFgJGR84fJ5Vu4YXJ5jw+T69fFf/yeN5dn348Iv/MAQVtvP8APARft2mfl/2FSyf/D5JL/h8kl/w+Tq9VK+s35n56eAgCMlU+Y4/cnARhDQ/37PwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIyJuXxZ6CqnaakU8URELMRUcmuzVl2MiCcj4s/TU9NZeWmkNQYAHl76t6SY/+va/PNz9x69kvxnOl9HxA9/+vpP3lptNveWsv3/PN3ffKfYXxlF/QGA83TG6c443vHRndtrnWWY9fnwG+3JRbO4J8XSPnI5LmerP87kkw7P/itplwvZ7yuXLiD+0XFEfKZX+5M8N7JQzHx6b/ws9hNDjZ9+LH6aH2uvs3vx6TNXnu4b87y5XmFSvJf1P6/0ev7SuJqvZ3pOfjyT91APr9P/nZzp/zrP+0ze1/Tq/64OGuOF33+777HjiM9d7hU/OY2f9In//IDx3//8F5/rd6z184hr0Tt+d6xyc3u33Dg4vJHd+OpGdadSWV5aXnzp5ouVcp6jLncy1d3aI8TfX77+ZN/2//K3RUd5Nv7MOe3/yn1b3TrtgH/x3ze+/6V+8Y8jvvbl3q//0/eJn42JXy22+/f0bauzv+k7fXcWf719/48/6et//Zy4HR/89XB9wFMBgCFoHBxurdZq1b0L3ZiKC75g10byiOpsYwQbMcRY2a/JD3udZ4qU2Wrn+ek+5w8/e/eZbN/I7+qFbIyuTwKG4+5DP+qaAAAAAAAAAAAAAAAA/TzyfydKR91CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxtn/AgAA//8LKMVX") keyctl$update(0x2, 0x0, 0x0, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000400000851000000600000018020000", @ANYRES32, @ANYBLOB="0000000000000002000000000000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000cfa10000f9ffffff07010000f8ffffffb702000008000000b50a00000000000085000000060000009500"/120], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94) chdir(&(0x7f00000001c0)='./bus\x00') sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000000)='.\x00', &(0x7f0000000080)='ext4\x00', 0x1000040, 0x0) llistxattr(&(0x7f0000000140)='./bus\x00', &(0x7f0000000240)=""/108, 0x6c) 815.967601ms ago: executing program 0 (id=7): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/locks\x00', 0x0, 0x0) pread64(r1, &(0x7f00000024c0)=""/209, 0xd1, 0x8) r2 = open(&(0x7f00000001c0)='./file0\x00', 0x108843, 0x55) munmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000) msync(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3) fcntl$setlease(r2, 0x400, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r4, &(0x7f0000000200)={0xa, 0x4e20, 0x40007, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x3}, 0x1c) r5 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f0000000180)=0x2, 0x4) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bind$inet6(r5, &(0x7f0000000200)={0xa, 0x4e20, 0x9, @mcast1, 0x8}, 0x1c) close_range(r3, 0xffffffffffffffff, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r8, 0x4008ae90, &(0x7f0000005f00)={0x2, 0x0, [{0x40000001, 0x5, 0x3, 0x3, 0xcffd, 0x6, 0x8}, {0xd, 0x5e03, 0x4, 0x6, 0x10000, 0x40000004, 0x42}]}) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200040010000800014004000000", 0x58}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000100)={0x10003, 0x5, 0x1, 0x2000, &(0x7f00001f0000/0x2000)=nil}) r10 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0x1, 0x16, 0x8, 0x9, 0x89}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0x5, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@map_fd={0x18, 0x0, 0x1, 0x0, r10}], {0x95, 0x0, 0x0, 0x7100}}, &(0x7f0000000040)='syzkaller\x00', 0x5, 0xee, &(0x7f0000000340)=""/238, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1e}, 0x22) 665.646024ms ago: executing program 0 (id=8): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$packet(0x11, 0x2, 0x300) r3 = inotify_init1(0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000240)={'fscrypt:', @auto=[0x38, 0x32, 0x33, 0x36, 0x31, 0x66, 0x32, 0x30, 0x39, 0x32, 0x2, 0x39, 0x63, 0x66, 0x31, 0x64]}, &(0x7f0000000300)={0x0, "a386cc67f453e3426b06cf0ba72ccfc78d1de2058de4b1e0a2c2acc61ef01829280692c15770d5d88c6fc8e23db902a0b40ad5ab7c2a43892cc6f63c93483fc4", 0x33}, 0x48, 0x0) setns(0xc9, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r5, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) close_range(r4, 0xffffffffffffffff, 0x0) inotify_add_watch(r3, &(0x7f00000006c0)='.\x00', 0x40001a2) r6 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r6, &(0x7f0000000180)={0xa0, 0xffffffffffffffda, 0x0, {{0x3, 0x0, 0x8000000200007, 0x282b, 0x20103, 0x80001, {0x200004, 0x10005c62, 0x203, 0x1000000000, 0x83, 0x4, 0x10000006, 0x6, 0x0, 0x0, 0x0, 0xee00, 0xee00, 0x8, 0x1}}, {0x0, 0xa}}}, 0xa0) sendfile(r6, r6, &(0x7f0000000100)=0x4, 0x8112) syz_emit_ethernet(0x46, &(0x7f0000000440)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x33}, @void, {@ipv4={0x800, @igmp={{0xc, 0x4, 0x3, 0x7, 0x38, 0x64, 0x0, 0x1, 0x2, 0x0, @private=0xa010101, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@noop, @cipso={0x86, 0x1b, 0x3, [{0x6, 0x2}, {0x0, 0xfffffffffffffe7a, "bd32"}, {0x4, 0x2}, {0x5, 0xd, "fd4a747643b2cfbd494d08"}]}]}}, {0x17, 0x6, 0x0, @broadcast}}}}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r7, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xd0, r8, 0x20, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x13, 0x28}}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010101}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x1c}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x3}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x6}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sed\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x200}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x101}]}, 0xd0}, 0x1, 0x0, 0x0, 0x40000}, 0x5) 215.783025ms ago: executing program 3 (id=9): r0 = creat(&(0x7f0000000240)='./bus\x00', 0xc2) io_setup(0x5, &(0x7f0000000100)=0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0e00000004000000040000000200000000000000", @ANYRES8=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYRESOCT=r0, @ANYBLOB="0000000000000000000000000000000000000000000000000000000016d88b549695beb02378392edac922c77a45654025df5881a3"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, 0x0, &(0x7f0000000240)='GPL\x00', 0xea, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x2400, 0x0) socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000840)={0x3f47}, 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r0, 0x0, 0x25, 0x7, @val=@kprobe_multi=@syms={0x0, 0x2, &(0x7f0000000440)=[&(0x7f0000000180)='\x00', &(0x7f0000000300)='\x00'], 0x0, 0x9}}, 0x30) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x6, &(0x7f0000000400)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x9, 0x1}, 0x20) setsockopt$inet6_int(r5, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) sendmsg$inet6(r5, &(0x7f0000000340)={&(0x7f00000001c0)={0xa, 0x4e1e, 0x80002, @dev={0xfe, 0x80, '\x00', 0x1c}, 0x5}, 0x1c, 0x0, 0xffffffffffffff8b}, 0x8000) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0xdd, 0x3, 0x80000000}]}) close_range(r6, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) 0s ago: executing program 2 (id=10): r0 = creat(&(0x7f0000000140)='./file0\x00', 0x7a) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$XFS_IOC_BULKSTAT(r1, 0x8040587f, 0x0) write$binfmt_elf32(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c46000000000000000000000000030006"], 0x69) r2 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x329180) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000180)=0x1, 0x15000002) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r4 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0xfffd, 0x0, 0x9, 0x5}, {0x12, 0x2, 0x0, 0x401, 0x8001, 0x1400}, 0xa5, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2b, 0x25dfdbfb, {0x60, 0x0, 0x0, r6, {}, {0x4, 0xa}, {0x1, 0x5}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x14, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}, @TCA_CODEL_LIMIT={0x8, 0x2, 0x10000}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x55}, 0xc010) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYRES64=r2, @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000300"/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x15, 0xb, 0x1, 0x1, 0x40001, 0xffffffffffffffff, 0x2, '\x00', r6, 0xffffffffffffffff, 0x3, 0x0, 0x1}, 0x50) r7 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010002000000406a053b03000000000001090222000101008032090400000103000000092111010001221700070581034000"], 0x0) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000280)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd608a37f200142cfefe8000000000000000000000000000aa0600000300"/58, @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000"], 0x0) r8 = inotify_init() ftruncate(0xffffffffffffffff, 0x8800000) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendfile(r9, 0xffffffffffffffff, 0x0, 0x578410eb) close_range(r8, 0xffffffffffffffff, 0x0) syz_usb_control_io$hid(r7, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0022170000000600ff0901a10185020901150026ff00750895098102c0"], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000200), 0x0, 0x0) syz_open_dev$evdev(0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.151' (ED25519) to the list of known hosts. [ 21.604701][ T30] audit: type=1400 audit(1787388115.615:64): avc: denied { mounton } for pid=277 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.605803][ T277] cgroup: Unknown subsys name 'net' [ 21.627369][ T30] audit: type=1400 audit(1787388115.615:65): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.655060][ T30] audit: type=1400 audit(1787388115.645:66): avc: denied { unmount } for pid=277 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.655236][ T277] cgroup: Unknown subsys name 'devices' [ 21.802571][ T277] cgroup: Unknown subsys name 'hugetlb' [ 21.808172][ T277] cgroup: Unknown subsys name 'rlimit' [ 21.944926][ T30] audit: type=1400 audit(1787388115.955:67): avc: denied { setattr } for pid=277 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=254 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.966274][ T279] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 21.968111][ T30] audit: type=1400 audit(1787388115.955:68): avc: denied { mounton } for pid=277 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 21.998881][ T277] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.001312][ T30] audit: type=1400 audit(1787388115.955:69): avc: denied { mount } for pid=277 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.033102][ T30] audit: type=1400 audit(1787388115.995:70): avc: denied { relabelto } for pid=279 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.058553][ T30] audit: type=1400 audit(1787388115.995:71): avc: denied { write } for pid=279 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.084165][ T30] audit: type=1400 audit(1787388116.005:72): avc: denied { read } for pid=277 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.109902][ T30] audit: type=1400 audit(1787388116.005:73): avc: denied { open } for pid=277 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.979685][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.986838][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.994370][ T289] device bridge_slave_0 entered promiscuous mode [ 23.001286][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.008310][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.015748][ T289] device bridge_slave_1 entered promiscuous mode [ 23.042593][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.049620][ T286] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.057052][ T286] device bridge_slave_0 entered promiscuous mode [ 23.072055][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.079091][ T286] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.086472][ T286] device bridge_slave_1 entered promiscuous mode [ 23.117630][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.124745][ T287] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.132118][ T287] device bridge_slave_0 entered promiscuous mode [ 23.138690][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.145781][ T285] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.153081][ T285] device bridge_slave_0 entered promiscuous mode [ 23.159831][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.166997][ T285] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.174340][ T285] device bridge_slave_1 entered promiscuous mode [ 23.203215][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.210367][ T287] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.217810][ T287] device bridge_slave_1 entered promiscuous mode [ 23.296878][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.303967][ T288] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.311401][ T288] device bridge_slave_0 entered promiscuous mode [ 23.318139][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.325342][ T288] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.332664][ T288] device bridge_slave_1 entered promiscuous mode [ 23.426820][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.433891][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.449472][ T287] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.456539][ T287] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.463815][ T287] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.470987][ T287] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.481514][ T286] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.488558][ T286] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.495834][ T286] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.502861][ T286] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.511665][ T285] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.518694][ T285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.526003][ T285] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.533037][ T285] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.549324][ T288] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.556383][ T288] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.563660][ T288] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.570692][ T288] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.595488][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.603180][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.610332][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.617683][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.625066][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.632370][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.639568][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.647128][ T45] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.654305][ T45] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.661786][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.669133][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.693762][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.701781][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.709980][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.718256][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.725285][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.732801][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.741042][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.748064][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.755602][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.775520][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.783699][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.791906][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.798915][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.806387][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.814978][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.822011][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.829314][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.836791][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.845939][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.854139][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.861166][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.884768][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.893036][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.902006][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.910252][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.917307][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.925237][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.933440][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.940447][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.947812][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.955825][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.963984][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.971969][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.980150][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.987294][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.017162][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 24.025206][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 24.032879][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 24.042862][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 24.051175][ T45] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.058210][ T45] bridge0: port 1(bridge_slave_0) entered forwarding state [ 24.065679][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 24.074120][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 24.082316][ T45] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.089320][ T45] bridge0: port 2(bridge_slave_1) entered forwarding state [ 24.096680][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.104819][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.113387][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.121611][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.129489][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.137943][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.146348][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.154254][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.162361][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.169776][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.177364][ T289] device veth0_vlan entered promiscuous mode [ 24.187040][ T285] device veth0_vlan entered promiscuous mode [ 24.195225][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.203217][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.211643][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.219145][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.227102][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.235444][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.250571][ T287] device veth0_vlan entered promiscuous mode [ 24.257309][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.265672][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.274208][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 24.282409][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 24.290271][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 24.298492][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 24.306502][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.314421][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.325983][ T286] device veth0_vlan entered promiscuous mode [ 24.338424][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.345916][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.353426][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.362095][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.369990][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.378260][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.386509][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.394063][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.401884][ T289] device veth1_macvtap entered promiscuous mode [ 24.416199][ T288] device veth0_vlan entered promiscuous mode [ 24.425251][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.433158][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 24.441806][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 24.450333][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 24.458440][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 24.466576][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.474859][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.483160][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 24.490593][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 24.505410][ T285] device veth1_macvtap entered promiscuous mode [ 24.512503][ T286] device veth1_macvtap entered promiscuous mode [ 24.520471][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.528262][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.536736][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.545029][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.552631][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.560757][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.569210][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.577590][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.586050][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 24.594286][ T45] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.603947][ T287] device veth1_macvtap entered promiscuous mode [ 24.616596][ T288] device veth1_macvtap entered promiscuous mode [ 24.626260][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 24.634872][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 24.642666][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.651251][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.659548][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.667931][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.688513][ T289] request_module fs-gadgetfs succeeded, but still no fs? [ 24.703738][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.712788][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.721306][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.729563][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.738048][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.746382][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.754809][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.763204][ T8] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.789665][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 24.801274][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 24.840115][ T319] loop4: detected capacity change from 0 to 512 [ 24.843160][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 24.856730][ T319] SELinux: security_context_str_to_sid(system_u) failed for (dev ?, type ?) errno=-22 [ 24.862742][ T316] SELinux: failed to load policy [ 24.871683][ T306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 24.912469][ T319] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 24.920015][ T319] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 24.925197][ T321] loop1: detected capacity change from 0 to 512 [ 24.939454][ T322] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 24.958886][ T319] EXT4-fs (loop4): orphan cleanup on readonly fs [ 24.960001][ T324] loop3: detected capacity change from 0 to 512 [ 24.965742][ T319] EXT4-fs error (device loop4): ext4_orphan_get:1432: comm syz.4.6: bad orphan inode 15 [ 24.982611][ T319] ext4_test_bit(bit=14, block=18) = 1 [ 24.988014][ T319] is_bad_inode(inode)=0 [ 24.992505][ T319] NEXT_ORPHAN(inode)=1023 [ 24.996830][ T319] max_ino=32 [ 25.000014][ T319] i_nlink=0 [ 25.003399][ T319] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.6: bg 0: block 161: padding at end of block bitmap is not set [ 25.017650][ T319] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 25.030980][ T321] EXT4-fs (loop1): Ignoring removed nobh option [ 25.034501][ T319] EXT4-fs (loop4): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000002,mb_optimize_scan=0x0000000000000001,noblock_validity,nomblk_io_submit,,errors=continue. Quota mode: none. [ 25.057090][ T324] ======================================================= [ 25.057090][ T324] WARNING: The mand mount option has been deprecated and [ 25.057090][ T324] and is ignored by this kernel. Remove the mand [ 25.057090][ T324] option from the mount to silence this warning. [ 25.057090][ T324] ======================================================= [ 25.092066][ T319] SELinux: security_context_str_to_sid(system_u) failed for (dev loop4, type ext2) errno=-22 [ 25.214663][ T319] loop4: detected capacity change from 0 to 512 [ 25.239999][ T321] EXT4-fs (loop1): mounted filesystem without journal. Opts: max_dir_size_kb=0x0000000000001000,nobh,quota,,errors=continue. Quota mode: writeback. [ 25.256104][ T324] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 25.265457][ T321] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 25.272263][ T324] ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 25.292243][ T319] SELinux: security_context_str_to_sid(system_u) failed for (dev ?, type ?) errno=-22 [ 25.548633][ T319] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 25.561702][ T319] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 25.574634][ T321] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #2: comm syz.1.2: corrupted inode contents [ 25.587211][ T319] EXT4-fs (loop4): orphan cleanup on readonly fs [ 25.593983][ T321] EXT4-fs error (device loop1): ext4_dirty_inode:6108: inode #2: comm syz.1.2: mark_inode_dirty error [ 25.605998][ T319] EXT4-fs error (device loop4): ext4_orphan_get:1432: comm syz.4.6: bad orphan inode 15 [ 25.616738][ T319] ext4_test_bit(bit=14, block=18) = 1 [ 25.622362][ T319] is_bad_inode(inode)=0 [ 25.626880][ T321] EXT4-fs error (device loop1): ext4_do_update_inode:5260: inode #2: comm syz.1.2: corrupted inode contents [ 25.643288][ T319] NEXT_ORPHAN(inode)=1023 [ 25.647643][ T319] max_ino=32 [ 25.650897][ T319] i_nlink=0 [ 25.654298][ T321] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #2: comm syz.1.2: mark_inode_dirty error [ 25.670963][ T319] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.6: bg 0: block 161: padding at end of block bitmap is not set [ 25.718909][ T319] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 25.727943][ T319] EXT4-fs (loop4): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000002,mb_optimize_scan=0x0000000000000001,noblock_validity,nomblk_io_submit,,errors=continue. Quota mode: none. [ 25.747797][ T319] SELinux: security_context_str_to_sid(system_u) failed for (dev loop4, type ext2) errno=-22 [ 25.761253][ T321] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2'. [ 25.778164][ T343] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 25.828549][ T350] capability: warning: `syz.1.13' uses deprecated v2 capabilities in a way that may be insecure [ 25.869343][ T350] loop1: detected capacity change from 0 to 2048 [ 25.967606][ T350] EXT4-fs (loop1): mounted filesystem without journal. Opts: mb_optimize_scan=0x0000000000000000,grpid,,errors=continue. Quota mode: none. [ 26.050558][ T356] loop0: detected capacity change from 0 to 512 [ 26.065652][ T285] EXT4-fs error (device loop1): ext4_lookup:1862: inode #2: comm syz-executor: deleted inode referenced: 11 [ 26.077282][ T60] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 26.077492][ T285] EXT4-fs error (device loop1): ext4_lookup:1862: inode #2: comm syz-executor: deleted inode referenced: 11 [ 26.100917][ T26] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 26.127789][ T356] EXT4-fs (loop0): mounted filesystem without journal. Opts: abort,barrier=0x0000000000010001,,errors=continue. Quota mode: writeback. [ 26.142032][ T356] ext4 filesystem being mounted at /3/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 26.162199][ T8] ================================================================== [ 26.170285][ T8] BUG: KASAN: out-of-bounds in ext4_xattr_set_entry+0x11db/0x3a80 [ 26.178116][ T8] Read of size 18446744073709551600 at addr ffff88812c13aeb8 by task kworker/u4:0/8 [ 26.187553][ T8] [ 26.189896][ T8] CPU: 0 PID: 8 Comm: kworker/u4:0 Not tainted syzkaller #0 [ 26.197181][ T8] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 26.207238][ T8] Workqueue: writeback wb_workfn (flush-7:1) [ 26.213255][ T8] Call Trace: [ 26.216537][ T8] [ 26.219476][ T8] __dump_stack+0x21/0x30 [ 26.223815][ T8] dump_stack_lvl+0x110/0x170 [ 26.228504][ T8] ? show_regs_print_info+0x20/0x20 [ 26.233711][ T8] ? load_image+0x3f0/0x3f0 [ 26.238223][ T8] print_address_description+0x7f/0x2c0 [ 26.243775][ T8] ? ext4_xattr_set_entry+0x11db/0x3a80 [ 26.249330][ T8] kasan_report+0x10f/0x150 [ 26.253852][ T8] ? ext4_xattr_set_entry+0x11db/0x3a80 [ 26.259411][ T8] ? ext4_xattr_set_entry+0x11db/0x3a80 [ 26.264970][ T8] kasan_check_range+0x249/0x2a0 [ 26.269908][ T8] ? ext4_xattr_set_entry+0x11db/0x3a80 [ 26.275450][ T8] memmove+0x2d/0x70 [ 26.279332][ T8] ext4_xattr_set_entry+0x11db/0x3a80 [ 26.284690][ T8] ? __getblk_gfp+0x42/0x7d0 [ 26.289275][ T8] ? ext4_xattr_ibody_set+0x330/0x330 [ 26.294632][ T8] ? ext4_get_inode_loc+0x130/0x130 [ 26.299818][ T8] ? __ext4_journal_get_write_access+0x2d7/0x6d0 [ 26.306134][ T8] ext4_xattr_ibody_set+0x114/0x330 [ 26.311317][ T8] ext4_destroy_inline_data_nolock+0x234/0x5e0 [ 26.317456][ T8] ? ext4_destroy_inline_data+0xe0/0xe0 [ 26.323004][ T8] ? clear_nonspinnable+0x60/0x60 [ 26.328103][ T8] ext4_destroy_inline_data+0x84/0xe0 [ 26.333460][ T8] ext4_writepages+0x64c/0x30a0 [ 26.338306][ T8] ? rcu_preempt_deferred_qs_irqrestore+0x1e9/0x960 [ 26.344890][ T8] ? __activate_page+0x11e0/0x11e0 [ 26.349991][ T8] ? put_prev_entity+0x470/0x470 [ 26.354919][ T8] ? ext4_readpage+0x220/0x220 [ 26.359669][ T8] ? pick_next_task_fair+0x725/0x930 [ 26.364950][ T8] ? __update_idle_core+0x280/0x280 [ 26.370132][ T8] ? _raw_spin_unlock+0x4d/0x70 [ 26.374966][ T8] ? ext4_readpage+0x220/0x220 [ 26.379717][ T8] do_writepages+0x476/0x6d0 [ 26.384294][ T8] ? __kasan_check_read+0x11/0x20 [ 26.389303][ T8] ? preempt_schedule_common+0xbe/0xf0 [ 26.394803][ T8] ? preempt_schedule+0xbc/0xd0 [ 26.399677][ T8] ? schedule_preempt_disabled+0x20/0x20 [ 26.405319][ T8] ? enqueue_task_fair+0xaf1/0x2130 [ 26.410586][ T8] ? __writepage+0x130/0x130 [ 26.415159][ T8] ? preempt_schedule_thunk+0x16/0x18 [ 26.420519][ T8] __writeback_single_inode+0xd9/0x9e0 [ 26.425963][ T8] ? wbc_attach_and_unlock_inode+0x194/0x5f0 [ 26.431928][ T8] ? inode_io_list_move_locked+0x366/0x3d0 [ 26.437721][ T8] writeback_sb_inodes+0x9f3/0x1610 [ 26.442905][ T8] ? queue_io+0x4b0/0x4b0 [ 26.447218][ T8] ? wb_writeback+0x3db/0x990 [ 26.451878][ T8] wb_writeback+0x3eb/0x990 [ 26.456366][ T8] ? inode_cgwb_move_to_attached+0x3b0/0x3b0 [ 26.462327][ T8] ? set_worker_desc+0x1ba/0x1f0 [ 26.467250][ T8] ? __kasan_check_write+0x14/0x20 [ 26.472396][ T8] ? __update_load_avg_cfs_rq+0xb1/0x2e0 [ 26.478015][ T8] wb_workfn+0x3ac/0xf30 [ 26.482241][ T8] ? inode_wait_for_writeback+0x220/0x220 [ 26.487942][ T8] ? compat_start_thread+0x20/0x20 [ 26.493039][ T8] ? _raw_spin_unlock+0x4d/0x70 [ 26.497874][ T8] ? finish_task_switch+0x16b/0x790 [ 26.503056][ T8] ? __schedule+0xbd7/0x14a0 [ 26.507656][ T8] process_one_work+0x6c8/0xbb0 [ 26.512491][ T8] worker_thread+0xaa0/0x1250 [ 26.517159][ T8] kthread+0x3f5/0x4f0 [ 26.521476][ T8] ? worker_clr_flags+0x190/0x190 [ 26.526483][ T8] ? kthread_blkcg+0xd0/0xd0 [ 26.531057][ T8] ret_from_fork+0x1f/0x30 [ 26.535453][ T8] [ 26.538462][ T8] [ 26.540766][ T8] The buggy address belongs to the page: [ 26.546387][ T8] page:ffffea0004b04e80 refcount:2 mapcount:0 mapping:ffff88810930d358 index:0x2 pfn:0x12c13a [ 26.556615][ T8] memcg:ffff88810e14b3c0 [ 26.560845][ T8] aops:def_blk_aops ino:700001 [ 26.565588][ T8] flags: 0x400000000000203e(referenced|uptodate|dirty|lru|active|private|zone=1) [ 26.574693][ T8] raw: 400000000000203e ffffea000481a488 ffff88810e144cb0 ffff88810930d358 [ 26.583346][ T8] raw: 0000000000000002 ffff88812a060498 00000002ffffffff ffff88810e14b3c0 [ 26.591906][ T8] page dumped because: kasan: bad access detected [ 26.598292][ T8] page_owner tracks the page as allocated [ 26.603989][ T8] page last allocated via order 0, migratetype Movable, gfp_mask 0x108c48(GFP_NOFS|__GFP_NOFAIL|__GFP_HARDWALL|__GFP_MOVABLE), pid 350, ts 25967023671, free_ts 0 [ 26.620115][ T8] post_alloc_hook+0x192/0x1b0 [ 26.624894][ T8] prep_new_page+0x1c/0x110 [ 26.629398][ T8] get_page_from_freelist+0x2c3a/0x2cd0 [ 26.634925][ T8] __alloc_pages+0x1a2/0x460 [ 26.639496][ T8] pagecache_get_page+0xacc/0xdd0 [ 26.644525][ T8] __getblk_gfp+0x231/0x7d0 [ 26.649026][ T8] __ext4_get_inode_loc+0x45b/0xcb0 [ 26.654209][ T8] __ext4_iget+0x448/0x3e80 [ 26.658721][ T8] ext4_fill_super+0x6b8f/0x8bf0 [ 26.663637][ T8] mount_bdev+0x28d/0x3c0 [ 26.667947][ T8] ext4_mount+0x34/0x40 [ 26.672079][ T8] legacy_get_tree+0xed/0x190 [ 26.676736][ T8] vfs_get_tree+0x89/0x260 [ 26.681132][ T8] do_new_mount+0x251/0xb40 [ 26.685615][ T8] path_mount+0x640/0xff0 [ 26.689925][ T8] __se_sys_mount+0x320/0x390 [ 26.694581][ T8] page_owner free stack trace missing [ 26.699924][ T8] [ 26.702227][ T8] Memory state around the buggy address: [ 26.707830][ T8] ffff88812c13ad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.715894][ T8] ffff88812c13ae00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.724313][ T8] >ffff88812c13ae80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.732359][ T8] ^ [ 26.738234][ T8] ffff88812c13af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 26.746276][ T8] ffff88812c13af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 26.754314][ T8] ================================================================== [ 26.762350][ T8] Disabling lock debugging due to kernel taint [ 26.770600][ T30] kauditd_printk_skb: 80 callbacks suppressed [ 26.770612][ T30] audit: type=1400 audit(1787388120.785:154): avc: denied { write } for pid=277 comm="syz-executor" path="pipe:[15041]" dev="pipefs" ino=15041 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 26.824673][ T277] syz-executor (277) used greatest stack depth: 22272 bytes left [ 26.840905][ T8] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm kworker/u4:0: bg 0: block 2: invalid block bitmap [ 26.847421][ T30] audit: type=1400 audit(1787388120.825:155): avc: denied { read } for pid=83 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 26.860852][ T356] syz.0.14 (356) used greatest stack depth: 19872 bytes left [ 26.875460][ T30] audit: type=1400 audit(1787388120.825:156): avc: denied { search } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.889832][ T8] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 1 with error 28 [ 26.914343][ T30] audit: type=1400 audit(1787388120.825:157): avc: denied { write } for pid=83 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.916034][ T8] EXT4-fs (loop1): This should not happen!! Data will be lost [ 26.916034][ T8] [ 26.939004][ T30] audit: type=1400 audit(1787388120.825:158): avc: denied { add_name } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.947239][ T8] EXT4-fs (loop1): Total free blocks count 0 [ 26.973377][ T8] EXT4-fs (loop1): Free/Dirty block details [ 26.979280][ T8] EXT4-fs (loop1): free_blocks=0 [ 26.979348][ T30] audit: type=1400 audit(1787388120.825:159): avc: denied { create } for pid=83 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 26.984426][ T8] EXT4-fs (loop1): dirty_blocks=32 [ 27.005113][ T30] audit: type=1400 audit(1787388120.825:160): avc: denied { append open } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.034385][ T30] audit: type=1400 audit(1787388120.825:161): avc: denied { getattr } for pid=83 comm="syslogd" path="/tmp/messages" dev="tmpfs" ino=5 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 27.040834][ T8] EXT4-fs (loop1): Block reservation details [ 27.077753][ T8] EXT4-fs (loop1): i_reserved_data_blocks=2 [ 27.084356][ T8] EXT4-fs (loop1): Delayed block allocation failed for inode 15 at logical offset 65537 with max blocks 1 with error 28 [ 27.097252][ T8] EXT4-fs (loop1): This should not happen!! Data will be lost [ 27.097252][ T8] [ 27.180854][ T60] usb 3-1: device descriptor read/all, error -71 [ 27.187305][ T26] usb 5-1: device descriptor read/all, error -71 [ 27.661436][ T306] device bridge_slave_1 left promiscuous mode [ 27.667657][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.675158][ T306] device bridge_slave_0 left promiscuous mode [ 27.681285][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.688892][ T306] device veth1_macvtap left promiscuous mode [ 27.694932][ T306] device veth0_vlan left promiscuous mode [ 28.831712][ T306] device bridge_slave_1 left promiscuous mode [ 28.837829][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.845355][ T306] device bridge_slave_0 left promiscuous mode [ 28.851520][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.859292][ T306] device bridge_slave_1 left promiscuous mode [ 28.865474][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.872903][ T306] device bridge_slave_0 left promiscuous mode [ 28.878995][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.886880][ T306] device bridge_slave_1 left promiscuous mode [ 28.893057][ T306] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.900605][ T306] device bridge_slave_0 left promiscuous mode [ 28.906788][ T306] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.914978][ T306] device veth1_macvtap left promiscuous mode [ 28.921031][ T306] device veth0_vlan left promiscuous mode [ 28.927828][ T306] device veth1_macvtap left promiscuous mode [ 28.933849][ T306] device veth0_vlan left promiscuous mode [ 28.939789][ T306] device veth1_macvtap left promiscuous mode [ 28.945819][ T306] device veth0_vlan left promiscuous mode