last executing test programs: 10.04835052s ago: executing program 1 (id=2): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x4a, &(0x7f00000007c0), 0x4) 10.039287511s ago: executing program 1 (id=6): syz_mount_image$ext4(&(0x7f0000000880)='ext4\x00', &(0x7f00000008c0)='./bus\x00', 0x8, &(0x7f0000000900)={[{@noauto_da_alloc}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x91}}]}, 0x21, 0x4f3, &(0x7f0000000940)="$eJzs3c9vVEUcAPDvbru0lEJBOahRQUTRELY/gIZwES4aQ0iMxJMHqO3SNN1lm26JtHIoR+8kknjSP8GbBxNOHrx505sXPJigEg018bDmvV3apb+1P9Z2P5/k9b2ZWfY702Vm9g3sTgAt62hEzEbEnoi4FhE99fxM/YgLtSN53ONHt4fnHt0ezkS1euW3TFqe5EXDn0nsqz9nZ0S8/07ER5mlcSvTM+NDxWJhsp7unSpN9FamZ06NZes5A4P9g33nTp8d2LS2Hil99fDtsUsffPP1Sw++n33zk6Ra3Z/uT8sa27GZak3PRXdDXntEXNqKYE3SXv/7w86T9LZnIuJY2v97oi19NQGA3axa7YlqT2MaANjtkvv/7shk8/W1gO7IZvP52hre4ejKFsuVqZM95Zs3RiJdwzoYuez1sWKhr75WeDBymSTdn14vpAeeSt8tnI6IQxFxt2NvWp4fLhdHmvnGBwBa2L5F8/+fHbX5HwDY5TqbXQEAYNuZ/wGg9Zj/AaD1/Iv536cDAWCXcP8PAK3H/A8ArWfN+f/O9tQDANgW712+nBzVudr3Xz/5pu5TI4XKeL50czg/XJ6cyI+Wy6PFQn64Wl3r+Yrl8kT/mflkZXrmaql888bU1bHS0GjhaiG3lY0BANbl0JH7PyaT/uz5vekRDXs5mKthd8s2uwJA07Q1uwJA0/g8D7SuddzjWwaAXW6ZLXqfsuJ/Ebpn81fYqU48b/0fWtVG1v+tHcDO9t/W/9/a9HoA288cDq2rWs3Y8x8AWow1fmBD//4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALao7PTLZfLoX+GzyM5vPR+yPiIORy1wfKxb6IuJARPzQketI0v3NrjQAsEHZXzL1/b9O9BzvXly6J/NXR3qOiI8/v/LZraGpqcn+JP/3+fype/X8gT3NaAAA0OjC0qzaPF0/N9zIP350e/jJsZ1VfHixtrloEneuftRK2qM9PXdGLiK6/sjU0zXJ+5W2TYg/eycinlto/62GCN3pGkht59PF8ZPY+7cg/sLvf3H87FPxs2lZcs6lv4tnN6Eu0GruX6yNk/W+l3Sxev/LxtH0vHz/70xHqI1Lxr9kLJlbMv5l58e/tiXxM2mfPzqfXr0mD898++6SzGpPrexOxAvty8XPzMfPLD/+5o6vs40/vfjysZXKql9EnFi2/U92pC6lw2zvVGmitzI9c2qsNDRaGC3cGBgY7B/sO3f67EBvukZd+/ndcjF+PX/ywErxk/Z3rRC/c/X2x2vrbP+Xf1/78JVV4r/x6vKv/+FV4idz4uvrjD/UdWHF7buT+CMrtH+N1z9OrjP+g59nRtb5UABgG1SmZ8aHisXC5BoXyXvNtR7jYmdexGzEZj1huigREf+HdrnYyEWzRyZgqy10+mbXBAAAAAAAAAAAAAAAWEllema8Y4s/rdXsNgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALB7/RMAAP//TwTJNg==") syz_mount_image$fuse(0x0, &(0x7f0000000e40)='./bus\x00', 0x283016, 0x0, 0x11, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x20, 0x3, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) r1 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000007c0)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x353a, 0x1}}, 0x20) r2 = dup(r1) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000800)=@generic={0x0, r2}, 0x18) r3 = syz_open_dev$loop(&(0x7f0000000f40), 0x0, 0x0) ioctl$LOOP_SET_STATUS(r3, 0x4c02, &(0x7f0000000f80)={0x0, {}, 0x0, {}, 0x80a91f, 0x4, 0x13, 0x0, "22536a030000000000000043a52dbc3a9ae8b04fcca15748328cb3e74dc69e69fc1383375e1d61471a2d2dfe00000000000500000000000400", "0010000031ef6cf472daf732de7b040000000000000000e9ffffffffffff90e4", [0x5, 0x802]}) mount$overlay(0x0, &(0x7f0000001040)='./file0\x00', &(0x7f0000001080), 0x2004008, &(0x7f00000010c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 9.934635452s ago: executing program 1 (id=7): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) utime(0x0, 0x0) 9.46021474s ago: executing program 1 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000007c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000580)={0x1, 0x0, [{0x7, 0x1, 0x1, 0xffffffff, 0x8, 0x8, 0xfffffffc}]}) 9.45991692s ago: executing program 32 (id=17): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000007c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000580)={0x1, 0x0, [{0x7, 0x1, 0x1, 0xffffffff, 0x8, 0x8, 0xfffffffc}]}) 5.381939914s ago: executing program 5 (id=82): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2000c16, &(0x7f0000000280)={[{@usrquota}, {@nodelalloc}]}, 0xff, 0x25e, &(0x7f0000000e80)="$eJzs3U1IHGcYB/BnZndr1aXY9lIo/YBSSiuIvRV6sZcWhCJSSqEtWErppUULVulNe8olh+QYkuApFwm5xeQYvEguCYGcTOLBXAKJ5BDJIQnZsDsr+JVo3HUnZH4/WOfDd97nHWb+74g4GEBh9UXEUESUIqI/IioRkWxu8HH26WtuznUvjUXUaj/cTxrtsu3MxnG9ETEbEV9FxGKaxF/liOmFX1YfLn/32dGpyqdnFn7u7uhJNq2trny/fnrkyPnhL6evXr87ksRQVLecV/slu+wrJxHvHEaxV0RSznsE7Mfof+du1HP/bkR80sh/JdLILt6xyTcWK/HFqecde/zetfc7OVag/Wq1Sv0ZOFsDCieNiGok6UBEZOtpOjCQ/Qx/s9ST/j0x+W//nxNT43/kPVMB7VKNWPn2YteF3m35v1PK8g+8prJfSq38ODp/q76yXsp7QEBHfJAt6s///t9mPg/5h8KRfygu+Yfikn8oLvmH4pJ/KC75h4J42vxjv0275B+KS/6huA6c/xNPDm9QQEdszj8AUCy1rgO9Ndzel5CBXOQ9/wAAAAAAAAAAAAAAAAAAADvNdS+NbXza02N5zxaXT0asfZM13Vm/1Ph/xBFvNr72PEi29Jjsq8KL/fpRix206GzOb1+/dTvf+lc+zLf+zHjE7P8RMVgu77z/kub9d3Bv7/H9yu8tFnhJybbtr3/qbP3tHs/nW394OeJSff4Z3G3+SeO9xnL3+adav34t1v/nUYsdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0DHPAgAA///B2nXP") r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x101042, 0x65) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file1\x00', 0x2141, 0x59) openat(0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x42, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x800) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, r2, &(0x7f00000002c0)) ioctl$EXT4_IOC_MIGRATE(r1, 0x6609) 5.301016322s ago: executing program 5 (id=85): sched_setattr(0x0, 0x0, 0x0) userfaultfd(0x801) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$FUSE(r0, &(0x7f0000000340)={0x2020}, 0xfffffec1) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) 4.367540527s ago: executing program 5 (id=97): r0 = creat(&(0x7f0000000000)='./file0\x00', 0x6b) close(r0) close(0xffffffffffffffff) execve(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) chown(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) 4.307674843s ago: executing program 5 (id=100): prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x5) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000002c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000300)=""/102392, 0x18ff8) r4 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x40) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000019580)={0x2, 0x1f90, @loopback}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) setrlimit(0x9, &(0x7f0000000100)={0x8606, 0xffff}) io_setup(0x6573, &(0x7f0000000140)) openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x67) 3.991418305s ago: executing program 0 (id=104): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000000280)='./file0\x00', 0x104) r1 = open$dir(&(0x7f00000002c0)='./file0\x00', 0xc402, 0x80) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x2, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], 0x0, 0x1, 0x0, 0x0, 0x100, 0x74, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000}, 0x94) write$P9_RVERSION(r0, 0x0, 0x13) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)=[0x0], &(0x7f0000000540)=[0x2], 0x0, 0x1, 0x1}}, 0x40) 3.807662754s ago: executing program 2 (id=108): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000bde5a44070275290f515010203010902120001000000000904"], 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000200)={0x34, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_ADD(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1ab8ff00", @ANYRES16, @ANYBLOB="010028bd7000ffdbdf250100000008000200020000000800010001000000"], 0x24}, 0x1, 0x0, 0x0, 0xc800}, 0x20020000) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000100), r3) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x24, r4, 0x125, 0x0, 0x0, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x24}}, 0x0) 3.384285846s ago: executing program 0 (id=109): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f00000000c0)={0x0, 0x11}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.056361329s ago: executing program 5 (id=115): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x10000, &(0x7f0000001080)) r0 = getpgrp(0x0) r1 = gettid() rt_tgsigqueueinfo(r0, r1, 0x1f, &(0x7f0000000e80)={0x21, 0x5, 0x10004}) 2.732542152s ago: executing program 5 (id=117): r0 = syz_usb_connect$midi(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000108c0d020140000102030109021200010160"], 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$uac3(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$uac2(r0, &(0x7f0000000040)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003040000000003"]}, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_emit_ethernet(0x11, 0x0, 0x0) 1.388198979s ago: executing program 4 (id=125): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x16}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xb4}}, 0x0) 1.387893009s ago: executing program 4 (id=126): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f00000003c0)=0x1, 0x4) 1.382491289s ago: executing program 4 (id=127): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc, 0x2000002, 0x40010, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000140)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0xfe) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x4c881, &(0x7f0000000280)={0xa, 0x4e24, 0x10, @mcast2}, 0x1c) sendmmsg$inet6(r2, &(0x7f00000002c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000000) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000001540)=ANY=[@ANYBLOB="4c060000", @ANYRES16, @ANYBLOB], 0x64c}, 0x1, 0x0, 0x0, 0xc004}, 0x40001) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/profiling', 0x149a82, 0x0) bind$netlink(r3, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r4 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0x0, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x33}, 0x0, @in=@empty, 0x0, 0x0, 0x2, 0x7}}, 0xe8) sendmsg$key(r0, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="020100000a0000000600000000000000030006000000000002000000ffffffff0000000000000000030005000000000002000000ac1e000100000000000000000200"], 0x50}}, 0x0) 1.37527636s ago: executing program 4 (id=128): socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2, 0xffffffffffffffff}, &(0x7f0000000780), &(0x7f00000007c0)=r1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r3}, &(0x7f0000000900), &(0x7f0000000940)=r0}, 0x20) 1.320330016s ago: executing program 4 (id=129): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000300)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) write(r1, &(0x7f0000000340)="b9ba", 0x2) 1.320150216s ago: executing program 4 (id=130): syz_usb_connect(0x0, 0x371, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000057ec0020c215dcff30bd0102030109025f03019b000000090400000b403b4e000905"], 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 1.312114077s ago: executing program 2 (id=131): prctl$PR_SET_SECCOMP(0x3a, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./proc\x00', 0x1ff) r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000080)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r0, &(0x7f00000000c0)={0x18, 0x2, {0x0, @multicast1}}, 0x1e) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000340)=0xe) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0xc1101, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f00000003c0)=0x1) ioctl$PPPIOCGFLAGS1(r1, 0x8004745a, &(0x7f0000000400)) 1.237085624s ago: executing program 2 (id=134): mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) msync(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2) 1.236631834s ago: executing program 2 (id=135): socket$inet_udp(0x2, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x80000028b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) sendmmsg$unix(r2, &(0x7f00000001c0), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) prctl$PR_SET_THP_DISABLE(0x29, 0x1) fsopen(&(0x7f0000000280)='ramfs\x00', 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) timer_create(0x1, 0x0, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000002940)={0xa, 0xe22}, 0x1c) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000002980)={0x0, {{0xa, 0x0, 0x8, @mcast1}}, {{0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x3}, 0x2}}}, 0x108) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002ac0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000002b40)="e0b9547e841fd74eabc89b6f5b32", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x2, 0x4, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x34768}]}, &(0x7f00000006c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x39, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.222986876s ago: executing program 3 (id=137): syz_mount_image$erofs(&(0x7f0000000000), &(0x7f0000000040)='./file4\x00', 0x8, &(0x7f0000000080)=ANY=[@ANYRES64=0x0], 0x1, 0x1f1, &(0x7f00000000c0)="$eJzslb2L1EAYxp+ZxMxGRHsbCw88C3NJVsVGWBsbLQQ/DgvBxcsdpzkPzxR6ImJrY29n4Z9gKZytf4TsCoIg2oj1yHwkmZVEdsMuW/j+4GaeyXy878x7PAuCIP5bvox/j3yrj2AFwupvHlAOuLP+c+/n849XL6+/vvPukxhF4eRpYub4PnwcXPJQ2LGUUrrzK7a/AV7pm+A4bfU6GCKr74LjltUZGG5bfd/Ru2p9FG1u51l0bzffUCJWTaKaVDX9yfyAHy8ZNpz8mDP/+On+g2GeZ3sLFM0vd/C9yq8HXHTyc+sVwWQbO++XgCOxug+G61ZfgCjfxjxJff8rx/36fO+f9w/QdpNHR4Eprv0VQP1lc5EvG6hQnbYDbP61F5MheuaJ6y/jV1K2bQ/RJahndpUVnd91Asy3XqLjdvhGyGMNawRmOVAKtxaLFira1Is/DEz9qlRfmPFsQQctU0Gnf63aP+VbhlOOPxkreaN/LNaKHdXvn9neGW5lW9nDNO2fj8/G8bl0TRuRaZstUJ8fan8+XJ8ftq0NWIAnw6LYS0xbjVPTNjku1/7HsXoSh9RYuWnw17m/AJRBmf3juldq1WtNniAIYomcANOerH25FAPjX++foZxLry07UYIgCIIgCIIgCIIgOvMnAAD//xvFUk4=") creat(&(0x7f0000000300)='./file0\x00', 0x16) 953.298933ms ago: executing program 3 (id=138): syz_mount_image$vfat(&(0x7f00000001c0), &(0x7f0000000200)='./dev\x00', 0x844, &(0x7f0000000400)={[{@iocharset={'iocharset', 0x3d, 'macgaelic'}}, {@utf8no}, {@utf8no}, {@fat=@flush}, {@utf8}, {@fat=@showexec}, {@rodir}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'iso8859-4'}}, {@fat=@codepage={'codepage', 0x3d, '855'}}, {@uni_xlate}, {@utf8}, {@utf8no}, {@numtail}, {@utf8no}, {@iocharset={'iocharset', 0x3d, 'cp737'}}]}, 0x1, 0x292, &(0x7f00000005c0)="$eJzs3c9qM1UUAPAz+dMkn4tk4UoEB3Th6uOrT9AiFcSCoGShLrTYFKQJhRYCVTHtyifwCXweN+IL+ACKO7sQR6Yz+SeT0GraFP39Nrmce0/uuXdu29Xcfvbq6PT47OLk+uufo91OorYXe3GTRC9qMXUVlX76tToOADxxN1kWv2WFVhG6XB7RXJHZqD14cQDAg1j8+7/tWgCAx/HhRx+/t394ePBBmrYjRt+O+0kUn0X//kl8EcMYxIvoxh8R2UzRfufdw4NopLlevDGajPt55ujTH8rv3/8l4jZ/N7rRq87fTQsL+ZNxvxnPyvn3hjF4//voxsvV+W/N89tR5kd/J958faH+59GNHz+PsxjGcVnbNP+b3TR9O/vu968+yaN5fjIZ91uzceXoeudRnwwAAAAAAAAAAAAAAAAAAAAAAP9lz9OZ3vL9O9OL/9f0r7kfaLJwP8+LNE2zpBg/z2/EK41obHPtAAAAAAAAAAAAAAAAAAAA8FRcXH55ejQcDs432pi+1l/RFX8uR1oRcZdvblV0lbNc3amwop6o55+tiGEScb91NfO0WJMV7aKeQf2eO9aJiOHgPGnE5h5BMot0Frtei2KuPNIpGguRfz17O24b09N1epTEoLZ2n9tVh2QDjazi+NVXZu38PdIpV1AxuLNm9p2X/lHNWXdFVxIRzdlmLo+5/SF7Nj+Qzc3u4WP89gEAAAAAAAAAAAAAAAAAABbNX/qt6LzeQkEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsAXz//9/j8akTF41JqvnjUaUkS0vEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgP+BvwIAAP//wAFaIA==") mount(0x0, &(0x7f0000000080)='./dev\x00', 0x0, 0x0, 0x0) 861.745362ms ago: executing program 3 (id=139): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) sendto$inet(r0, &(0x7f0000000200), 0xffffffffffffff94, 0x0, 0x0, 0x0) 402.204319ms ago: executing program 2 (id=140): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000280)={0x79, 0x0, 0xc}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000300)={0x1, 0x0, [{0x4b564d06, 0x0, 0x4}]}) 395.455729ms ago: executing program 0 (id=141): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0xc, 0x0, 0x7ffc0002}]}) tgkill(0x0, 0x0, 0x28) 328.364356ms ago: executing program 0 (id=142): r0 = socket$inet(0x2, 0xa, 0x7) getsockopt$sock_buf(r0, 0x1, 0x1a, 0x0, &(0x7f0000002cc0)) 328.189786ms ago: executing program 0 (id=143): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f00000007c0)='./file1\x00', 0x400, &(0x7f0000000800), 0x80, 0x790, &(0x7f0000000840)="$eJzs3c1rHOUfAPDvbPPSX9qfjSBoPQUEDZRuTI2tgoeKBxEsFPRsGzbbULPJhuymNCGgRQQvgooHQS89W603r75c9Q/w7kFaqqbFiAeJzL6k22Y33aTZbMt+PjDJ88zM5jvfeWbmebIz7AbQs0bSH5mIwxHxURJxqDY/iYj+Sqkv4mR1vbXVlVw6JbG+/sYfSWWdW6sruWh4TepArfJERPzwfsSRzOa4paXlmclCIb9Qq4+VZ+fHSkvLR8/PTk7np/Nzx8cnJo6deP7E8d3L9a+flw9e//jVZ74++c97j1/98MckTsbB2rLGPHbLSIzU9kl/ugvv8Eq8s9vhuirp9gawI+mpua96lsfhJC33dXuTAIAOS0eh6wBAj0n0/wDQY+rvA9xaXcnVp+6+I7G3brwcEfur+dfvb1aX9NXu2e2v3AcdupXccWckiYjhXYg/EhFffPvWlXSKDt2HBGjm3UsRcXZ4ZPP1P9n0zMJ2PdvGOiN31Tfi/9J/n9GBe/kuHf+80Gz8l9kY/0ST8c9gk3N3J1qe/xsy13YhTEvp+O+lhmfb1hryrxneV6v9vzLm60/OnS/k02vbIxExGv2DaX18ixijN/+92WpZ4/jvz0/e/jKNn/6+vUbmWt/gna+ZmixP3k/OjW5ciniyr57/pYYlyUb7Jy3Gv6fbjPHaix983mpZmn+ab33anH9nrV+OeLpp+99+oi3Z8vnEscrhMFY/KJr45tfPhlrFb2z/dFpbXVlPIq7sfqbNpe0/tHX+w0nj85ql7cf46fKh71sta5J/rv6/UFXz438gebNSHqjNuzhZLi+MRwwkr2+ef+z2a+v1+vpp/qNPNT//tzr+09HJ2Tbz77v++1c7z7+z0vynttX+2y9cXZvZ1yp+e+0/USmN1uZsff2rXrfb3cD73X8AAAAAAAAAAAAAAAAAAAAAAAAA0I5MRByMJJPdKGcy2Wz1O7wfi6FMoVgqHzlXXJybisp3ZQ9Hf6b+UZeHGj4Pdbz2efj1+rG76s9FxKMR8eng/yr1bK5YmOp28gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQc6DF9/+nfhvs9tYBAB2zv9sbAADsOf0/APQe/T8A9B79PwD0Hv0/APQe/T8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAddvrUqXRa/3t1JZfWpy4sLc4ULxydypdmsrOLuWyuuDCfnS4Wpwv5bK44e6+/VygW5ydibvHiWDlfKo+VlpbPzBYX58pnzs9OTufP5Pv3JCsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2J7S0vLMZKGQX1B4CAp9tVZ7ULZnR4VMPYm9CjrQxjrr8zdPbTuLB2Bndq7QxYsSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEPkvwAAAP//vI8fOA==") lgetxattr(&(0x7f0000002840)='./file0\x00', &(0x7f0000002880)=@known='system.posix_acl_default\x00', 0x0, 0x0) 327.808816ms ago: executing program 2 (id=144): sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="100029bd7000ffdb"], 0x48}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0x8, 0x2, 0x8, 0x9b99}, 0x25, [0x9, 0x7, 0x2, 0x6, 0x8, 0x155f, 0x10000006, 0x6, 0x2dcd, 0x1, 0xb4, 0x8, 0xa2b9, 0x6, 0x7, 0xe1, 0x6, 0xfc000004, 0x403, 0xbbf, 0x3, 0xfffffffd, 0xfffffff7, 0xd, 0x0, 0x0, 0x6, 0x4, 0x100002, 0xc3, 0x5d6, 0x8002, 0x8a, 0x79, 0x2, 0x10080, 0x3c, 0x91, 0x129, 0x4, 0x16, 0x5, 0x5, 0x401, 0x1, 0x405, 0xa7, 0x81, 0x709, 0xf9a2, 0xa9, 0xff, 0xffffffff, 0x2, 0x2, 0x2, 0x7, 0x5, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x8, 0x4], [0x401, 0x3, 0x6, 0x9, 0x4, 0x8000c66, 0xa8a9, 0x2000006f, 0x8e, 0xd50, 0x7, 0xad, 0x2, 0x809, 0x40, 0xa7, 0x1000, 0x0, 0x200b398, 0x8001, 0xfffffffe, 0x4, 0x1c, 0x0, 0x1, 0xfffffffe, 0x9, 0x8, 0xffffff7f, 0x6, 0x6, 0x9, 0x40000004, 0x0, 0xfffbfff8, 0x4, 0x46, 0xf1, 0x7, 0xeb00060, 0x2, 0x9, 0xffffffff, 0x5, 0x3fe, 0x1ff, 0x1, 0x7fff, 0x67b2, 0x1cc, 0x9, 0x80000004, 0x6, 0x438, 0x2, 0x9, 0x2, 0x7fffffff, 0x4, 0xfffffff9, 0x18e, 0x1000, 0x2, 0x5], [0x2, 0xfffffffe, 0x9, 0x10, 0x2, 0x2e6bf783, 0x80000001, 0x5, 0x5, 0x491, 0x9, 0x200026, 0x7f, 0x400, 0x102, 0x1, 0x41, 0x6, 0xee4b, 0x2000004, 0x1, 0xc, 0x5, 0x9, 0x5, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x10000a, 0x2, 0x400, 0x8, 0x5, 0xd3, 0x8, 0x97f7, 0x3, 0x200000d, 0x3, 0x10010, 0x7, 0xdd81, 0x4, 0x7f, 0x9d27, 0x9, 0x1, 0x100, 0x2, 0x2, 0x7ffe, 0x28, 0x5, 0xd500, 0x1, 0x77, 0x5, 0x6, 0x10000, 0x8, 0x5, 0xfffffffe], [0xa772, 0x6, 0x5, 0x8, 0xbfc, 0x9, 0x5, 0x7f, 0x55, 0x7ff, 0xff, 0x1005, 0x10000001, 0x4, 0x21, 0x9, 0x81, 0x7, 0x9d87, 0x8, 0x8, 0x4, 0x140f1, 0x5396, 0x3, 0x4, 0x80008001, 0xbbd6, 0x1, 0x2, 0x100, 0x200d8ce, 0x7fffffff, 0x100009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0xffffffff, 0x10000, 0x0, 0x8004, 0x7fff, 0x3, 0x6, 0xf, 0xe, 0x8, 0x274, 0x6, 0xfffffff9, 0x7, 0x9, 0x9, 0x4, 0x463f, 0xf, 0xdab, 0x5, 0x8, 0x13fff, 0x8, 0xab6b]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r2, 0x4020aed2, &(0x7f00000001c0)={0x60000, 0x18000, 0x9fef19c9430e26b8}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0xfffffffffffffffe, 0x40000000000180, 0x2, 0x7, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0xb, 0x7, 0xfffffffffffffff8, 0x9, 0x8], 0x25000, 0x304}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x44, 0x2, 0x6, 0xa03, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x2002c0c4}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000012000100"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000408001d00ff03"], 0x28}, 0x1, 0x0, 0x0, 0x2000}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x50, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 298.326659ms ago: executing program 0 (id=145): r0 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key$fscrypt_v1(0x0, 0x0, 0x0, 0x0, r0) prlimit64(0x0, 0xe, &(0x7f0000000400)={0x8, 0x9}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000440)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000480)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f00000004c0)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000500), 0x0, 0x0) read$msr(r4, &(0x7f0000000fc0)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x47, &(0x7f0000019fc0)=0x7) socket$pptp(0x18, 0x1, 0x2) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') read$FUSE(r5, &(0x7f000001a000)={0x2020}, 0x2020) 66.550413ms ago: executing program 3 (id=146): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_CPUID2(r2, 0xc008ae91, 0x0) 249.95µs ago: executing program 3 (id=147): bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000640)={0x1, 0x0}, 0x8) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000800)=r0, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000980)=@bpf_lsm={0x1d, 0x3, &(0x7f0000000a40)=ANY=[], &(0x7f0000000a80)='syzkaller\x00', 0x7, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, r1, 0x8, 0x0, 0x6400, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000240)=[{0x5, 0x2, 0xc, 0xb}, {0x2, 0x1, 0xc, 0x8}], 0x20, 0x3}, 0x94) 0s ago: executing program 3 (id=148): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0xfff3}, {}, {0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x8ba4, 0xffffffffffffffff, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.209' (ED25519) to the list of known hosts. [ 18.833446][ T24] audit: type=1400 audit(1792949449.750:64): avc: denied { mounton } for pid=271 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 18.834602][ T271] cgroup: Unknown subsys name 'net' [ 18.856119][ T24] audit: type=1400 audit(1792949449.750:65): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.883377][ T24] audit: type=1400 audit(1792949449.780:66): avc: denied { unmount } for pid=271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 18.883540][ T271] cgroup: Unknown subsys name 'devices' [ 18.995936][ T271] cgroup: Unknown subsys name 'hugetlb' [ 19.001547][ T271] cgroup: Unknown subsys name 'rlimit' [ 19.108566][ T24] audit: type=1400 audit(1792949450.030:67): avc: denied { setattr } for pid=271 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=253 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.131792][ T24] audit: type=1400 audit(1792949450.030:68): avc: denied { mounton } for pid=271 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 19.131797][ T273] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.165109][ T24] audit: type=1400 audit(1792949450.030:69): avc: denied { mount } for pid=271 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.188262][ T24] audit: type=1400 audit(1792949450.050:70): avc: denied { relabelto } for pid=273 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.188442][ T271] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.213761][ T24] audit: type=1400 audit(1792949450.050:71): avc: denied { write } for pid=273 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.247922][ T24] audit: type=1400 audit(1792949450.090:72): avc: denied { read } for pid=271 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.273460][ T24] audit: type=1400 audit(1792949450.090:73): avc: denied { open } for pid=271 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.154306][ T282] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.161361][ T282] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.168885][ T282] device bridge_slave_0 entered promiscuous mode [ 20.176722][ T282] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.183745][ T282] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.191142][ T282] device bridge_slave_1 entered promiscuous mode [ 20.241230][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.248376][ T280] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.255943][ T280] device bridge_slave_0 entered promiscuous mode [ 20.262507][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.269727][ T279] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.277057][ T279] device bridge_slave_0 entered promiscuous mode [ 20.284079][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.291111][ T279] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.298520][ T279] device bridge_slave_1 entered promiscuous mode [ 20.316262][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.323314][ T280] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.330795][ T280] device bridge_slave_1 entered promiscuous mode [ 20.373338][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.380528][ T281] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.388048][ T281] device bridge_slave_0 entered promiscuous mode [ 20.397082][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.404175][ T281] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.411583][ T281] device bridge_slave_1 entered promiscuous mode [ 20.501073][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.508214][ T283] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.515646][ T283] device bridge_slave_0 entered promiscuous mode [ 20.522567][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.529714][ T283] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.537027][ T283] device bridge_slave_1 entered promiscuous mode [ 20.600294][ T281] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.607375][ T281] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.614701][ T281] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.621712][ T281] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.630134][ T279] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.637209][ T279] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.644476][ T279] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.651485][ T279] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.665627][ T280] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.672683][ T280] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.679948][ T280] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.686975][ T280] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.702211][ T283] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.709286][ T283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.716573][ T283] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.723581][ T283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.757109][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.764392][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.771913][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.779799][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.788031][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.796546][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.804314][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.811457][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.818998][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.826150][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.857500][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.865788][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.872982][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.880491][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.889139][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.896186][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.903508][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.911526][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 20.919469][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.939514][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.947448][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 20.955124][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 20.963204][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 20.971731][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.978824][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.986680][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 20.994881][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.001988][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.018513][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.027206][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 21.034902][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 21.042277][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.051068][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.058164][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.065642][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 21.073764][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.080820][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.098139][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 21.106169][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.114583][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.122496][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.130407][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.138105][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.146251][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.154375][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.162471][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.169541][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.177317][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 21.185482][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.192505][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.202764][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.211087][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.223249][ T281] device veth0_vlan entered promiscuous mode [ 21.233749][ T280] device veth0_vlan entered promiscuous mode [ 21.240560][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.249305][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.257822][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.265966][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.273811][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.281935][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.289984][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.297386][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.308646][ T279] device veth0_vlan entered promiscuous mode [ 21.319029][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.327105][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.335291][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.343348][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.351794][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.360001][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.374287][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 21.382495][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 21.390608][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 21.398966][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 21.408406][ T281] device veth1_macvtap entered promiscuous mode [ 21.419015][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.427033][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.435500][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.446713][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.455061][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.469516][ T283] device veth0_vlan entered promiscuous mode [ 21.484784][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 21.493131][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 21.501512][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.509911][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.518166][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.526097][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.534088][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.542242][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.550584][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.558749][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.567233][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.574844][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.582773][ T280] device veth1_macvtap entered promiscuous mode [ 21.590654][ T279] device veth1_macvtap entered promiscuous mode [ 21.601910][ T282] device veth0_vlan entered promiscuous mode [ 21.610230][ T281] request_module fs-gadgetfs succeeded, but still no fs? [ 21.611075][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.625378][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.633002][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 21.641356][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 21.649547][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.657875][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.666053][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 21.673474][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 21.683552][ T283] device veth1_macvtap entered promiscuous mode [ 21.692320][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.700090][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.708418][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.717471][ T281] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation [ 21.738825][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.747679][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.756496][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.765288][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.773588][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.782033][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.790832][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.797690][ T304] EXT4-fs (loop1): mounted filesystem without journal. Opts: noauto_da_alloc,max_dir_size_kb=0x0000000000000091,,errors=continue [ 21.799276][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.813246][ T304] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 21.821082][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 21.839200][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 21.854354][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.871668][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 21.879881][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.883264][ T49] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 21.895134][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.910898][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.924252][ T282] device veth1_macvtap entered promiscuous mode [ 21.931777][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.947437][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.952008][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 21.973244][ T318] syz.2.8 uses obsolete (PF_INET,SOCK_PACKET) [ 21.973409][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 21.980876][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 21.998824][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 21.999137][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 22.020184][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 22.028494][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 22.033729][ T300] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 22.039268][ T281] EXT4-fs error (device loop1): ext4_empty_dir:3074: inode #12: comm syz-executor: invalid size [ 22.227408][ T329] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 22.240764][ T329] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 22.252883][ T329] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.10: inode #88: comm syz.2.10: iget: illegal inode # [ 22.280459][ T329] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.10: error while reading EA inode 88 err=-117 [ 22.295389][ T329] EXT4-fs (loop2): 1 orphan inode deleted [ 22.301152][ T329] EXT4-fs (loop2): mounted filesystem without journal. Opts: barrier=0x00000000000003ff,noinit_itable,debug_want_extra_isize=0x000000000000002a,jqfmt=vfsold,nodelalloc,bsdgroups,,errors=continue [ 22.375630][ T355] netlink: 'syz.0.23': attribute type 30 has an invalid length. [ 22.394170][ T358] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 22.665862][ T367] kvm: pic: non byte write [ 22.700033][ T357] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.707239][ T357] bridge0: port 1(bridge_slave_0) entered disabled state [ 22.752502][ T357] device bridge_slave_0 entered promiscuous mode [ 22.769481][ T357] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.776786][ T357] bridge0: port 2(bridge_slave_1) entered disabled state [ 22.785265][ T357] device bridge_slave_1 entered promiscuous mode [ 22.914122][ T357] bridge0: port 2(bridge_slave_1) entered blocking state [ 22.921298][ T357] bridge0: port 2(bridge_slave_1) entered forwarding state [ 22.928596][ T357] bridge0: port 1(bridge_slave_0) entered blocking state [ 22.935653][ T357] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.226124][ T300] device bridge_slave_1 left promiscuous mode [ 23.256919][ T300] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.265977][ T300] device bridge_slave_0 left promiscuous mode [ 23.272148][ T300] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.281037][ T300] device veth1_macvtap left promiscuous mode [ 23.288396][ T300] device veth0_vlan left promiscuous mode [ 23.337544][ T7] bridge0: port 1(bridge_slave_0) entered disabled state [ 23.345402][ T7] bridge0: port 2(bridge_slave_1) entered disabled state [ 23.356214][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 23.363691][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 23.376258][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 23.384677][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 23.392890][ T7] bridge0: port 1(bridge_slave_0) entered blocking state [ 23.399958][ T7] bridge0: port 1(bridge_slave_0) entered forwarding state [ 23.424679][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 23.433289][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 23.442658][ T7] bridge0: port 2(bridge_slave_1) entered blocking state [ 23.449996][ T7] bridge0: port 2(bridge_slave_1) entered forwarding state [ 23.459948][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 23.468313][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 23.476864][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 23.486533][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 23.495672][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 23.504410][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 23.528146][ T357] device veth0_vlan entered promiscuous mode [ 23.536123][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 23.544564][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 23.553845][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 23.561795][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 23.579324][ T357] device veth1_macvtap entered promiscuous mode [ 23.588143][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 23.596677][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 23.605155][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 23.622318][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 23.630752][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 23.642165][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 23.650615][ T7] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 23.683168][ T424] ====================================================== [ 23.683168][ T424] WARNING: the mand mount option is being deprecated and [ 23.683168][ T424] will be removed in v5.15! [ 23.683168][ T424] ====================================================== [ 23.783851][ T432] EXT4-fs warning (device sda1): verify_group_input:147: Cannot add at group 5 (only 8 groups) [ 23.869329][ T24] kauditd_printk_skb: 95 callbacks suppressed [ 23.869338][ T24] audit: type=1400 audit(1792949454.790:169): avc: denied { unmount } for pid=279 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 23.961939][ T24] audit: type=1400 audit(1792949454.840:170): avc: denied { mount } for pid=437 comm="syz.4.49" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 23.989312][ T24] audit: type=1400 audit(1792949454.860:171): avc: denied { unmount } for pid=283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 24.009830][ T24] audit: type=1400 audit(1792949454.870:172): avc: denied { read } for pid=444 comm="syz.4.53" name="ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 24.032618][ T24] audit: type=1400 audit(1792949454.870:173): avc: denied { open } for pid=444 comm="syz.4.53" path="/dev/ppp" dev="devtmpfs" ino=153 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 24.056310][ T24] audit: type=1400 audit(1792949454.880:174): avc: denied { ioctl } for pid=444 comm="syz.4.53" path="/dev/ppp" dev="devtmpfs" ino=153 ioctlcmd=0x743e scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 24.080696][ T24] audit: type=1400 audit(1792949454.910:175): avc: denied { create } for pid=444 comm="syz.4.53" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 24.101970][ T24] audit: type=1400 audit(1792949455.020:176): avc: denied { wake_alarm } for pid=419 comm="syz.2.44" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 24.126008][ T24] audit: type=1400 audit(1792949455.050:177): avc: denied { create } for pid=419 comm="syz.2.44" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 24.183502][ T446] EXT4-fs (loop5): mounted filesystem without journal. Opts: dioread_lock,noquota,errors=remount-ro,grpquota, [ 24.193048][ T445] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue [ 24.197040][ T24] audit: type=1400 audit(1792949455.120:178): avc: denied { read } for pid=443 comm="syz.5.54" name="file1" dev="loop5" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=lnk_file permissive=1 [ 24.205021][ T445] ext4 filesystem being mounted at /8/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 24.811428][ T481] FAULT_INJECTION: forcing a failure. [ 24.811428][ T481] name failslab, interval 1, probability 0, space 0, times 1 [ 24.824542][ T481] CPU: 1 PID: 481 Comm: syz.0.66 Not tainted syzkaller #0 [ 24.831646][ T481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 24.841725][ T481] Call Trace: [ 24.845025][ T481] __dump_stack+0x21/0x24 [ 24.849354][ T481] dump_stack_lvl+0x1a7/0x208 [ 24.854027][ T481] ? show_regs_print_info+0x18/0x18 [ 24.859223][ T481] dump_stack+0x15/0x1c [ 24.863370][ T481] should_fail+0x3ab/0x500 [ 24.867783][ T481] ? __d_alloc+0x2d/0x690 [ 24.872108][ T481] __should_failslab+0xa4/0xe0 [ 24.876868][ T481] should_failslab+0x9/0x20 [ 24.881370][ T481] kmem_cache_alloc+0x3d/0x2d0 [ 24.886129][ T481] __d_alloc+0x2d/0x690 [ 24.890276][ T481] ? __ns_get_path+0x23b/0x470 [ 24.895035][ T481] d_alloc_anon+0x17/0x20 [ 24.899360][ T481] __ns_get_path+0x2f5/0x470 [ 24.903944][ T481] ns_get_path+0x54/0x90 [ 24.908181][ T481] proc_ns_get_link+0x15e/0x280 [ 24.913024][ T481] ? proc_ns_instantiate+0xf0/0xf0 [ 24.918130][ T481] ? security_inode_follow_link+0xc4/0x110 [ 24.924385][ T481] ? proc_ns_instantiate+0xf0/0xf0 [ 24.929795][ T481] pick_link+0x5b2/0xcc0 [ 24.934041][ T481] step_into+0xaa6/0xcd0 [ 24.938280][ T481] ? _raw_spin_unlock+0x4d/0x70 [ 24.943125][ T481] ? set_root+0x3f0/0x3f0 [ 24.947454][ T481] ? preempt_count_add+0x90/0x1b0 [ 24.952476][ T481] path_openat+0xec4/0x3040 [ 24.956980][ T481] ? do_filp_open+0x400/0x400 [ 24.961656][ T481] do_filp_open+0x1df/0x400 [ 24.966156][ T481] ? vfs_tmpfile+0x2c0/0x2c0 [ 24.970746][ T481] ? get_unused_fd_flags+0x92/0xa0 [ 24.975862][ T481] do_sys_openat2+0x19f/0x750 [ 24.980535][ T481] ? do_sys_open+0xe0/0xe0 [ 24.984984][ T481] ? __kasan_check_write+0x14/0x20 [ 24.990103][ T481] ? switch_fpu_return+0x19c/0x330 [ 24.995213][ T481] ? fpu__clear_all+0x20/0x20 [ 24.999895][ T481] __x64_sys_openat+0x136/0x160 [ 25.004742][ T481] do_syscall_64+0x31/0x40 [ 25.009156][ T481] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.015039][ T481] RIP: 0033:0x7f428dec3d8e [ 25.019449][ T481] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 25.039058][ T481] RSP: 002b:00007f428c95aec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 25.047470][ T481] RAX: ffffffffffffffda RBX: 00007f428c95b6c0 RCX: 00007f428dec3d8e [ 25.055437][ T481] RDX: 0000000000000002 RSI: 00007f428c95af90 RDI: ffffffffffffff9c [ 25.063424][ T481] RBP: 00007f428df9ab20 R08: 0000000000000000 R09: 0000000000000000 [ 25.071394][ T481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.079363][ T481] R13: 00007f428e18a038 R14: 00007f428e189fa0 R15: 00007ffe37f9e088 [ 25.089533][ T454] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 25.243220][ T488] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 25.250884][ T488] SELinux: (dev overlay, type overlay) has no security xattr handler [ 25.334178][ T454] usb 3-1: Using ep0 maxpacket: 8 [ 25.335935][ T496] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001e4a3, chksum : 0xe65d9f0a, utbl_chksum : 0x7319d30d) [ 25.354058][ T499] FAULT_INJECTION: forcing a failure. [ 25.354058][ T499] name failslab, interval 1, probability 0, space 0, times 0 [ 25.366961][ T499] CPU: 0 PID: 499 Comm: syz.4.74 Not tainted syzkaller #0 [ 25.374069][ T499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.384126][ T499] Call Trace: [ 25.387441][ T499] __dump_stack+0x21/0x24 [ 25.391757][ T499] dump_stack_lvl+0x1a7/0x208 [ 25.396416][ T499] ? thaw_kernel_threads+0x220/0x220 [ 25.401680][ T499] ? show_regs_print_info+0x18/0x18 [ 25.406871][ T499] ? skb_put+0x10a/0x1f0 [ 25.411100][ T499] dump_stack+0x15/0x1c [ 25.415252][ T499] should_fail+0x3ab/0x500 [ 25.419685][ T499] ? sidtab_sid2str_get+0x137/0x2c0 [ 25.424885][ T499] __should_failslab+0xa4/0xe0 [ 25.429669][ T499] should_failslab+0x9/0x20 [ 25.434185][ T499] __kmalloc_track_caller+0x5f/0x310 [ 25.439453][ T499] ? sidtab_sid2str_put+0x2d4/0x690 [ 25.444636][ T499] kmemdup+0x26/0x60 [ 25.448515][ T499] sidtab_sid2str_get+0x137/0x2c0 [ 25.453533][ T499] security_sid_to_context_core+0x2ac/0x480 [ 25.459417][ T499] security_sid_to_context+0x33/0x40 [ 25.464684][ T499] avc_audit_post_callback+0x1db/0x830 [ 25.470135][ T499] ? skb_put+0x10a/0x1f0 [ 25.474367][ T499] ? avc_audit_pre_callback+0x290/0x290 [ 25.479894][ T499] ? audit_log_n_string+0x217/0x5a0 [ 25.485096][ T499] ? audit_log_untrustedstring+0xe6/0x100 [ 25.490814][ T499] ? avc_audit_pre_callback+0x290/0x290 [ 25.496355][ T499] common_lsm_audit+0x14a4/0x1850 [ 25.501365][ T499] ? avc_alloc_node+0x83/0x340 [ 25.506114][ T499] ? avc_audit_pre_callback+0x290/0x290 [ 25.511660][ T499] ? ipv6_skb_to_auditdata+0xcd0/0xcd0 [ 25.517103][ T499] ? __kasan_check_write+0x14/0x20 [ 25.522220][ T499] ? __kasan_check_write+0x14/0x20 [ 25.527318][ T499] ? _raw_spin_lock_irqsave+0xc2/0x130 [ 25.532791][ T499] ? _raw_spin_lock+0xf0/0xf0 [ 25.537454][ T499] slow_avc_audit+0x1c4/0x240 [ 25.542121][ T499] ? avc_get_hash_stats+0x180/0x180 [ 25.547303][ T499] ? avc_denied+0x133/0x1b0 [ 25.551785][ T499] avc_has_perm+0x215/0x3d0 [ 25.556286][ T499] ? avc_has_perm_noaudit+0x3b0/0x3b0 [ 25.561639][ T499] ? do_futex+0x1270/0x1270 [ 25.566127][ T499] selinux_socket_connect_helper+0x27d/0x8f0 [ 25.572091][ T499] ? socket_type_to_security_class+0x340/0x340 [ 25.578230][ T499] ? do_futex+0xfe9/0x1270 [ 25.582658][ T499] ? security_file_alloc+0x33/0x120 [ 25.587862][ T499] ? security_file_alloc+0x33/0x120 [ 25.593039][ T499] ? __fget_files+0x2e1/0x340 [ 25.597694][ T499] selinux_socket_connect+0x23/0x30 [ 25.602872][ T499] security_socket_connect+0x72/0xa0 [ 25.608136][ T499] __sys_connect+0x30f/0x450 [ 25.612712][ T499] ? __sys_connect_file+0x170/0x170 [ 25.617896][ T499] ? __kasan_check_read+0x11/0x20 [ 25.622898][ T499] __x64_sys_connect+0x7a/0x90 [ 25.627640][ T499] do_syscall_64+0x31/0x40 [ 25.632046][ T499] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 25.637924][ T499] RIP: 0033:0x7f4cab26b559 [ 25.642347][ T499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 25.661938][ T499] RSP: 002b:00007f4ca9cc3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 25.670338][ T499] RAX: ffffffffffffffda RBX: 00007f4cab4f1fa0 RCX: 00007f4cab26b559 [ 25.678314][ T499] RDX: 0000000000000010 RSI: 0000200000000740 RDI: 0000000000000004 [ 25.684145][ T454] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 25.686272][ T499] RBP: 00007f4cab302b20 R08: 0000000000000000 R09: 0000000000000000 [ 25.686278][ T499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 25.686293][ T499] R13: 00007f4cab4f2038 R14: 00007f4cab4f1fa0 R15: 00007ffc3d6de388 [ 25.696537][ T454] usb 3-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 25.730084][ T454] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 25.740937][ T454] usb 3-1: config 0 descriptor?? [ 25.876616][ T512] FAULT_INJECTION: forcing a failure. [ 25.876616][ T512] name fail_futex, interval 1, probability 0, space 0, times 1 [ 25.889607][ T512] CPU: 1 PID: 512 Comm: syz.4.79 Not tainted syzkaller #0 [ 25.896734][ T512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 25.906793][ T512] Call Trace: [ 25.910070][ T512] __dump_stack+0x21/0x24 [ 25.914383][ T512] dump_stack_lvl+0x1a7/0x208 [ 25.919059][ T512] ? thaw_kernel_threads+0x220/0x220 [ 25.924352][ T512] ? show_regs_print_info+0x18/0x18 [ 25.929546][ T512] ? stack_trace_save+0xa6/0xf0 [ 25.934390][ T512] ? stack_trace_snprint+0xe0/0xe0 [ 25.939488][ T512] dump_stack+0x15/0x1c [ 25.943725][ T512] should_fail+0x3ab/0x500 [ 25.948128][ T512] get_futex_key+0x13f/0xc30 [ 25.952707][ T512] ? exit_to_user_mode_prepare+0x76/0xa0 [ 25.958374][ T512] ? futex_wait_restart+0x240/0x240 [ 25.963560][ T512] futex_wake+0x11c/0x570 [ 25.967879][ T512] ? futex_wait+0x6f0/0x6f0 [ 25.972515][ T512] do_futex+0xfad/0x1270 [ 25.976770][ T512] ? __kasan_check_read+0x11/0x20 [ 25.981802][ T512] ? ____kasan_slab_free+0x130/0x160 [ 25.987092][ T512] ? __kasan_slab_free+0x11/0x20 [ 25.992039][ T512] ? rcu_gp_kthread_wake+0x90/0x90 [ 25.997142][ T512] ? futex_exit_release+0x1e0/0x1e0 [ 26.002347][ T512] ? security_file_free+0xc7/0xe0 [ 26.007476][ T512] __se_sys_futex+0x2ba/0x370 [ 26.012157][ T512] ? __x64_sys_futex+0x100/0x100 [ 26.017087][ T512] ? ____fput+0x15/0x20 [ 26.021246][ T512] __x64_sys_futex+0xe5/0x100 [ 26.025910][ T512] do_syscall_64+0x31/0x40 [ 26.030326][ T512] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.036296][ T512] RIP: 0033:0x7f4cab26b559 [ 26.040712][ T512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.060301][ T512] RSP: 002b:00007f4ca9cc30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 26.068700][ T512] RAX: ffffffffffffffda RBX: 00007f4cab4f1fa8 RCX: 00007f4cab26b559 [ 26.076659][ T512] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4cab4f1fac [ 26.084616][ T512] RBP: 00007f4cab4f1fa0 R08: 0032590beb6a8e1c R09: 0000000000000000 [ 26.092598][ T512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.100608][ T512] R13: 00007f4cab4f2038 R14: 00007ffc3d6de2a0 R15: 00007ffc3d6de388 [ 26.128448][ T517] FAULT_INJECTION: forcing a failure. [ 26.128448][ T517] name failslab, interval 1, probability 0, space 0, times 0 [ 26.141259][ T517] CPU: 0 PID: 517 Comm: syz.0.81 Not tainted syzkaller #0 [ 26.148379][ T517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 26.158445][ T517] Call Trace: [ 26.161748][ T517] __dump_stack+0x21/0x24 [ 26.166091][ T517] dump_stack_lvl+0x1a7/0x208 [ 26.170784][ T517] ? thaw_kernel_threads+0x220/0x220 [ 26.176081][ T517] ? show_regs_print_info+0x18/0x18 [ 26.181287][ T517] dump_stack+0x15/0x1c [ 26.185460][ T517] should_fail+0x3ab/0x500 [ 26.189892][ T517] ? call_usermodehelper_setup+0x71/0x1d0 [ 26.195627][ T517] __should_failslab+0xa4/0xe0 [ 26.200409][ T517] should_failslab+0x9/0x20 [ 26.204929][ T517] kmem_cache_alloc_trace+0x3a/0x2e0 [ 26.210228][ T517] call_usermodehelper_setup+0x71/0x1d0 [ 26.215785][ T517] ? __request_module+0x910/0x910 [ 26.220822][ T517] __request_module+0x391/0x910 [ 26.225684][ T517] ? copy_regset_to_user+0x200/0x200 [ 26.230982][ T517] ? security_capable+0x87/0xb0 [ 26.235842][ T517] dev_load+0x5b/0xb0 [ 26.239840][ T517] ? wext_ioctl_dispatch+0x3d0/0x3d0 [ 26.245135][ T517] wext_ioctl_dispatch+0xa4/0x3d0 [ 26.250173][ T517] ? iw_handler_get_private+0x1f0/0x1f0 [ 26.255735][ T517] ? __kasan_check_write+0x14/0x20 [ 26.260856][ T517] ? _copy_from_user+0x95/0xd0 [ 26.265633][ T517] wext_handle_ioctl+0x114/0x1d0 [ 26.270591][ T517] ? call_commit_handler+0x100/0x100 [ 26.275889][ T517] ? selinux_file_ioctl+0x3ad/0x4c0 [ 26.281099][ T517] ? security_bpf+0x82/0xa0 [ 26.285620][ T517] sock_ioctl+0x13e/0x740 [ 26.289957][ T517] ? sock_poll+0x350/0x350 [ 26.294380][ T517] ? __fget_files+0x2e1/0x340 [ 26.299071][ T517] ? security_file_ioctl+0x84/0xa0 [ 26.304193][ T517] ? sock_poll+0x350/0x350 [ 26.308615][ T517] __se_sys_ioctl+0x121/0x1a0 [ 26.313296][ T517] __x64_sys_ioctl+0x7b/0x90 [ 26.317888][ T517] do_syscall_64+0x31/0x40 [ 26.322315][ T517] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 26.328206][ T517] RIP: 0033:0x7f428df03559 [ 26.332618][ T517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 26.352221][ T517] RSP: 002b:00007f428c95b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 26.360635][ T517] RAX: ffffffffffffffda RBX: 00007f428e189fa0 RCX: 00007f428df03559 [ 26.368610][ T517] RDX: 0000200000000040 RSI: 0000000000008b1a RDI: 0000000000000003 [ 26.376586][ T517] RBP: 00007f428df9ab20 R08: 0000000000000000 R09: 0000000000000000 [ 26.384557][ T517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 26.392531][ T517] R13: 00007f428e18a038 R14: 00007f428e189fa0 R15: 00007ffe37f9e088 [ 26.451084][ T520] EXT4-fs (loop5): mounted filesystem without journal. Opts: usrquota,nodelalloc,,errors=continue [ 26.462420][ T520] ext4 filesystem being mounted at /14/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 26.490560][ T526] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3589920902 (7179841804 ns) > initial count (617750926 ns). Using initial count to start timer. [ 26.554096][ T531] netlink: 'syz.0.86': attribute type 11 has an invalid length. [ 26.853626][ T546] overlayfs: overlapping lowerdir path [ 27.056449][ T554] tipc: Started in network mode [ 27.075149][ T554] tipc: Own node identity 1216a30f73b9, cluster identity 4711 [ 27.101749][ T554] tipc: Enabled bearer , priority 0 [ 27.123129][ T555] device syzkaller0 entered promiscuous mode [ 27.149791][ T554] tipc: Resetting bearer [ 27.178224][ T553] tipc: Resetting bearer [ 27.198254][ T553] tipc: Disabling bearer [ 27.427471][ T566] process 'syz.5.97' launched './file0' with NULL argv: empty string added [ 27.654589][ T311] usb 3-1: USB disconnect, device number 2 [ 28.244020][ T311] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 28.436192][ T602] capability: warning: `syz.3.112' uses 32-bit capabilities (legacy support in use) [ 28.913957][ T454] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 29.020532][ T24] kauditd_printk_skb: 47 callbacks suppressed [ 29.020543][ T24] audit: type=1400 audit(1792949459.940:226): avc: denied { read } for pid=611 comm="syz.4.116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 29.046076][ T311] usb 3-1: New USB device found, idVendor=2770, idProduct=9052, bcdDevice=15.f5 [ 29.055656][ T311] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.063763][ T311] usb 3-1: Product: syz [ 29.068107][ T311] usb 3-1: Manufacturer: syz [ 29.072727][ T311] usb 3-1: SerialNumber: syz [ 29.080508][ T311] usb 3-1: config 0 descriptor?? [ 29.168531][ T24] audit: type=1326 audit(1792949460.090:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=618 comm="syz.4.118" exe="/root/ci2-android-5-10/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f4cab26b559 code=0x0 [ 29.255428][ T621] EXT4-fs (loop4): Test dummy encryption mode enabled [ 29.263347][ T621] ------------[ cut here ]------------ [ 29.269097][ T621] EA inode 11 i_nlink=0 [ 29.269203][ T621] WARNING: CPU: 0 PID: 621 at fs/ext4/xattr.c:1002 ext4_xattr_inode_update_ref+0x4ea/0x540 [ 29.283377][ T621] Modules linked in: [ 29.287314][ T621] CPU: 0 PID: 621 Comm: syz.4.118 Not tainted syzkaller #0 [ 29.294534][ T621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 29.304726][ T621] RIP: 0010:ext4_xattr_inode_update_ref+0x4ea/0x540 [ 29.311347][ T621] Code: 40 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 e7 e8 79 0e be ff 49 8b 34 24 48 c7 c7 60 ea 2c 85 44 89 fa e8 06 04 99 02 <0f> 0b 4c 8b 74 24 08 4c 8b 64 24 10 e9 a5 fe ff ff e8 d0 a0 9c 02 [ 29.311355][ T621] RSP: 0018:ffffc90007a272c0 EFLAGS: 00010246 [ 29.311374][ T621] RAX: 18f933a14d536200 RBX: ffff88811caa55a8 RCX: 0000000000080000 [ 29.345376][ T621] RDX: ffffc90003914000 RSI: 00000000000067f2 RDI: 00000000000067f3 [ 29.353350][ T621] RBP: ffffc90007a273b0 R08: ffffc90007a26c47 R09: fffff52000f44dbc [ 29.361346][ T621] R10: dffffc0000000000 R11: fffff52000f44d89 R12: ffff88811caa5488 [ 29.364451][ T454] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.369342][ T621] R13: dffffc0000000000 R14: ffff88811caa5448 R15: 0000000000000000 [ 29.383356][ T454] usb 1-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 29.387377][ T621] FS: 00007f4ca9ca26c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 29.387384][ T621] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 29.387391][ T621] CR2: 00007f4ca18c1000 CR3: 0000000114cee000 CR4: 00000000003506b0 [ 29.387406][ T621] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 29.400529][ T454] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.405594][ T621] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 29.416706][ T454] usb 1-1: config 0 descriptor?? [ 29.420301][ T621] Call Trace: [ 29.452323][ T621] ? ext4_xattr_block_csum+0x560/0x560 [ 29.457975][ T621] ? __ext4_journal_ensure_credits+0x30/0x470 [ 29.464302][ T621] ? ext4_xattr_inode_dec_ref_all+0x394/0xf20 [ 29.470396][ T621] ext4_xattr_inode_dec_ref_all+0x91a/0xf20 [ 29.476311][ T621] ? ext4_xattr_delete_inode+0xc00/0xc00 [ 29.482062][ T621] ? __ext4_journal_ensure_credits+0x470/0x470 [ 29.488465][ T621] ? ext4_get_inode_loc+0x100/0x130 [ 29.493661][ T621] ext4_xattr_delete_inode+0xa42/0xc00 [ 29.499143][ T621] ? ext4_expand_extra_isize_ea+0x19d0/0x19d0 [ 29.505253][ T621] ? __ext4_mark_inode_dirty+0x489/0x660 [ 29.787432][ T621] ext4_evict_inode+0x10e2/0x1780 [ 29.792510][ T621] ? _raw_spin_unlock+0x4d/0x70 [ 29.797398][ T621] ? ext4_inode_is_fast_symlink+0x370/0x370 [ 29.803322][ T621] ? ext4_inode_is_fast_symlink+0x370/0x370 [ 29.809237][ T621] evict+0x4a9/0x940 [ 29.813288][ T621] ? mode_strip_sgid+0x150/0x150 [ 29.818348][ T621] ? _raw_spin_lock+0x94/0xf0 [ 29.823027][ T621] ? _raw_spin_trylock_bh+0x150/0x150 [ 29.828436][ T621] ? ext4_get_projid+0x140/0x140 [ 29.833375][ T621] ? __kasan_check_write+0x14/0x20 [ 29.838515][ T621] iput+0x654/0x7e0 [ 29.842325][ T621] ext4_orphan_cleanup+0x989/0xd40 [ 29.847459][ T621] ext4_fill_super+0x867e/0x8d90 [ 29.852400][ T621] ? ext4_mount+0x40/0x40 [ 29.856765][ T621] ? vscnprintf+0x80/0x80 [ 29.861097][ T621] ? set_blocksize+0x1eb/0x3a0 [ 29.865906][ T621] ? sb_set_blocksize+0xaa/0xf0 [ 29.870760][ T621] mount_bdev+0x26a/0x380 [ 29.875104][ T621] ? ext4_mount+0x40/0x40 [ 29.879483][ T621] ext4_mount+0x34/0x40 [ 29.883617][ T621] legacy_get_tree+0xed/0x190 [ 29.888339][ T621] ? ext4_chksum+0x180/0x180 [ 29.892926][ T621] vfs_get_tree+0x89/0x260 [ 29.897371][ T621] do_new_mount+0x25a/0xa30 [ 29.901889][ T621] path_mount+0x581/0xca0 [ 29.906239][ T621] __se_sys_mount+0x320/0x390 [ 29.910938][ T621] ? __x64_sys_mount+0xd0/0xd0 [ 29.915840][ T621] __x64_sys_mount+0xbf/0xd0 [ 29.920462][ T621] do_syscall_64+0x31/0x40 [ 29.924891][ T621] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 29.930781][ T621] RIP: 0033:0x7f4cab26c7ca [ 29.935200][ T621] Code: 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 29.954833][ T621] RSP: 002b:00007f4ca9ca1e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 29.963229][ T621] RAX: ffffffffffffffda RBX: 00007f4ca9ca1ee0 RCX: 00007f4cab26c7ca [ 29.971275][ T621] RDX: 00002000000000c0 RSI: 0000200000000340 RDI: 00007f4ca9ca1ea0 [ 29.979416][ T621] RBP: 00002000000000c0 R08: 00007f4ca9ca1ee0 R09: 0000000000000008 [ 29.987440][ T621] R10: 0000000000000008 R11: 0000000000000246 R12: 0000200000000340 [ 29.995427][ T621] R13: 00007f4ca9ca1ea0 R14: 000000000000048d R15: 000000000000002c [ 30.003388][ T621] ---[ end trace fc65eaf0009cd92d ]--- [ 30.008982][ T621] EXT4-fs (loop4): 1 orphan inode deleted [ 30.014751][ T621] EXT4-fs (loop4): mounted filesystem without journal. Opts: data_err=ignore,errors=remount-ro,debug_want_extra_isize=0x000000000000005a,noquota,test_dummy_encryption,debug_want_extra_isize=0x000000000000003a,grpquota,inlinecrypt,nodelalloc, [ 30.113968][ T15] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 30.200849][ T24] audit: type=1400 audit(1792949461.120:228): avc: denied { map_read map_write } for pid=632 comm="syz.4.120" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 30.352255][ T24] audit: type=1400 audit(1792949461.270:229): avc: denied { relabelfrom } for pid=641 comm="syz.3.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 30.371949][ T15] usb 6-1: Using ep0 maxpacket: 16 [ 30.372216][ T24] audit: type=1400 audit(1792949461.280:230): avc: denied { relabelto } for pid=641 comm="syz.3.124" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 30.418340][ T24] audit: type=1400 audit(1792949461.340:231): avc: denied { create } for pid=652 comm="syz.4.129" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 30.438357][ T24] audit: type=1400 audit(1792949461.350:232): avc: denied { write } for pid=652 comm="syz.4.129" path="socket:[16986]" dev="sockfs" ino=16986 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 30.457981][ T609] usb 3-1: USB disconnect, device number 3 [ 30.476649][ T24] audit: type=1400 audit(1792949461.400:233): avc: denied { create } for pid=657 comm="syz.2.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.496646][ T24] audit: type=1400 audit(1792949461.400:234): avc: denied { bind } for pid=657 comm="syz.2.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.516253][ T24] audit: type=1400 audit(1792949461.400:235): avc: denied { connect } for pid=657 comm="syz.2.131" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 30.524077][ T15] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 30.547994][ T15] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 30.570377][ T670] erofs: (device loop3): mounted with root inode @ nid 36. [ 30.577715][ T670] SELinux: (dev loop3, type erofs) getxattr errno 117 [ 30.714176][ T311] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 30.904091][ T15] usb 6-1: New USB device found, idVendor=0d8c, idProduct=0102, bcdDevice= 0.40 [ 30.913292][ T15] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 30.921557][ T15] usb 6-1: Product: syz [ 30.925959][ T15] usb 6-1: Manufacturer: syz [ 30.930579][ T15] usb 6-1: SerialNumber: syz [ 30.973971][ T311] usb 5-1: Using ep0 maxpacket: 32 [ 31.094043][ T311] usb 5-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 31.104422][ T311] usb 5-1: config 155 interface 0 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 31.115060][ T311] usb 5-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 31.284040][ T311] usb 5-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 31.293152][ T311] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 31.301186][ T311] usb 5-1: Product: syz [ 31.305393][ T311] usb 5-1: Manufacturer: syz [ 31.310016][ T311] usb 5-1: SerialNumber: syz [ 31.381529][ T311] usb 1-1: USB disconnect, device number 2 [ 31.467939][ T689] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue [ 31.568606][ T25] usb 5-1: USB disconnect, device number 2 [ 31.592898][ T609] usb 6-1: USB disconnect, device number 2 [ 31.759016][ T706] ================================================================== [ 31.767146][ T706] BUG: KASAN: slab-out-of-bounds in tc_setup_flow_action+0x88e/0x3160 [ 31.775309][ T706] Read of size 8 at addr ffff888110ba44d8 by task syz.3.148/706 [ 31.782932][ T706] [ 31.785273][ T706] CPU: 1 PID: 706 Comm: syz.3.148 Tainted: G W syzkaller #0 [ 31.793875][ T706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 31.803928][ T706] Call Trace: [ 31.807228][ T706] __dump_stack+0x21/0x24 [ 31.811560][ T706] dump_stack_lvl+0x1a7/0x208 [ 31.816234][ T706] ? show_regs_print_info+0x18/0x18 [ 31.821440][ T706] ? thaw_kernel_threads+0x220/0x220 [ 31.826721][ T706] print_address_description+0x7f/0x2c0 [ 31.832266][ T706] ? tc_setup_flow_action+0x88e/0x3160 [ 31.837726][ T706] kasan_report+0x100/0x140 [ 31.842214][ T706] ? flow_action_cookie_create+0x28/0x90 [ 31.847837][ T706] ? tc_setup_flow_action+0x88e/0x3160 [ 31.853275][ T706] __asan_report_load8_noabort+0x14/0x20 [ 31.858886][ T706] tc_setup_flow_action+0x88e/0x3160 [ 31.864152][ T706] mall_replace_hw_filter+0x2db/0x8c0 [ 31.869503][ T706] ? pcpu_block_update_hint_alloc+0x8b7/0xc50 [ 31.875550][ T706] ? mall_set_parms+0x450/0x450 [ 31.880379][ T706] ? tcf_exts_destroy+0xb0/0xb0 [ 31.885212][ T706] ? pcpu_alloc+0xf8d/0x16c0 [ 31.889787][ T706] ? mall_set_parms+0x1a0/0x450 [ 31.894626][ T706] mall_change+0x546/0x770 [ 31.899035][ T706] ? __kasan_check_write+0x14/0x20 [ 31.904126][ T706] ? mall_get+0xa0/0xa0 [ 31.908262][ T706] ? tcf_chain_tp_insert_unique+0x946/0xa70 [ 31.914130][ T706] tc_new_tfilter+0x1487/0x1ab0 [ 31.918961][ T706] ? mall_get+0xa0/0xa0 [ 31.923104][ T706] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.928726][ T706] ? security_capable+0x87/0xb0 [ 31.933567][ T706] ? ns_capable+0x8c/0xf0 [ 31.937873][ T706] ? netlink_net_capable+0x125/0x160 [ 31.943160][ T706] ? tcf_gate_entry_destructor+0x20/0x20 [ 31.948772][ T706] rtnetlink_rcv_msg+0x811/0xca0 [ 31.953693][ T706] ? unwind_get_return_address+0x4d/0x90 [ 31.959306][ T706] ? rtnetlink_bind+0x80/0x80 [ 31.964008][ T706] ? stack_trace_save+0xa6/0xf0 [ 31.968846][ T706] ? stack_trace_snprint+0xe0/0xe0 [ 31.973939][ T706] ? avc_has_perm+0x168/0x3d0 [ 31.978595][ T706] ? memcpy+0x56/0x70 [ 31.982557][ T706] ? avc_has_perm+0x27f/0x3d0 [ 31.987214][ T706] ? __kasan_slab_alloc+0xc9/0xe0 [ 31.992222][ T706] ? avc_has_perm_noaudit+0x3b0/0x3b0 [ 31.997580][ T706] ? entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.003632][ T706] ? selinux_nlmsg_lookup+0x398/0x430 [ 32.008988][ T706] netlink_rcv_skb+0x1e9/0x430 [ 32.013734][ T706] ? rtnetlink_bind+0x80/0x80 [ 32.018396][ T706] ? netlink_ack+0xb30/0xb30 [ 32.022969][ T706] ? __netlink_lookup+0x387/0x3b0 [ 32.027976][ T706] rtnetlink_rcv+0x1c/0x20 [ 32.032373][ T706] netlink_unicast+0x86c/0xa30 [ 32.037131][ T706] netlink_sendmsg+0x949/0xb70 [ 32.041898][ T706] ? schedule_preempt_disabled+0x20/0x20 [ 32.047519][ T706] ? netlink_getsockopt+0x530/0x530 [ 32.052841][ T706] ? security_socket_sendmsg+0x82/0xa0 [ 32.058295][ T706] ? netlink_getsockopt+0x530/0x530 [ 32.063478][ T706] ____sys_sendmsg+0x5be/0x8f0 [ 32.068224][ T706] ? __sys_sendmsg_sock+0x40/0x40 [ 32.073230][ T706] ? import_iovec+0x7c/0xb0 [ 32.077851][ T706] ___sys_sendmsg+0x236/0x2e0 [ 32.082519][ T706] ? __sys_sendmsg+0x280/0x280 [ 32.087393][ T706] ? alloc_file+0x82/0x580 [ 32.091819][ T706] ? __fdget+0x1a1/0x230 [ 32.096055][ T706] __x64_sys_sendmsg+0x201/0x2d0 [ 32.100973][ T706] ? __kasan_check_write+0x14/0x20 [ 32.106061][ T706] ? ___sys_sendmsg+0x2e0/0x2e0 [ 32.110887][ T706] ? __kasan_check_read+0x11/0x20 [ 32.115886][ T706] ? exit_to_user_mode_prepare+0x9a/0xa0 [ 32.121499][ T706] do_syscall_64+0x31/0x40 [ 32.125910][ T706] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.131793][ T706] RIP: 0033:0x7fa791951559 [ 32.136192][ T706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 32.155786][ T706] RSP: 002b:00007fa7903a9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 32.164240][ T706] RAX: ffffffffffffffda RBX: 00007fa791bd7fa0 RCX: 00007fa791951559 [ 32.172198][ T706] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 32.180152][ T706] RBP: 00007fa7919e8b20 R08: 0000000000000000 R09: 0000000000000000 [ 32.188139][ T706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 32.196092][ T706] R13: 00007fa791bd8038 R14: 00007fa791bd7fa0 R15: 00007ffd47429d78 [ 32.204058][ T706] [ 32.206397][ T706] Allocated by task 706: [ 32.210623][ T706] __kasan_kmalloc+0xd4/0x100 [ 32.215292][ T706] __kmalloc+0x19f/0x330 [ 32.219516][ T706] tcf_idr_create+0x5f/0x790 [ 32.224085][ T706] tcf_idr_create_from_flags+0x61/0x70 [ 32.229521][ T706] tcf_gact_init+0x2e6/0x560 [ 32.234090][ T706] tcf_action_init_1+0x443/0x6d0 [ 32.239019][ T706] tcf_action_init+0x227/0x780 [ 32.243756][ T706] tcf_exts_validate+0x23c/0x540 [ 32.248673][ T706] mall_set_parms+0x4a/0x450 [ 32.253244][ T706] mall_change+0x47a/0x770 [ 32.257638][ T706] tc_new_tfilter+0x1487/0x1ab0 [ 32.262466][ T706] rtnetlink_rcv_msg+0x811/0xca0 [ 32.267384][ T706] netlink_rcv_skb+0x1e9/0x430 [ 32.272124][ T706] rtnetlink_rcv+0x1c/0x20 [ 32.276519][ T706] netlink_unicast+0x86c/0xa30 [ 32.281301][ T706] netlink_sendmsg+0x949/0xb70 [ 32.286075][ T706] ____sys_sendmsg+0x5be/0x8f0 [ 32.290817][ T706] ___sys_sendmsg+0x236/0x2e0 [ 32.295474][ T706] __x64_sys_sendmsg+0x201/0x2d0 [ 32.300391][ T706] do_syscall_64+0x31/0x40 [ 32.304790][ T706] entry_SYSCALL_64_after_hwframe+0x61/0xcb [ 32.310654][ T706] [ 32.312969][ T706] The buggy address belongs to the object at ffff888110ba4400 [ 32.312969][ T706] which belongs to the cache kmalloc-256 of size 256 [ 32.327087][ T706] The buggy address is located 216 bytes inside of [ 32.327087][ T706] 256-byte region [ffff888110ba4400, ffff888110ba4500) [ 32.340334][ T706] The buggy address belongs to the page: [ 32.346005][ T706] page:ffffea000442e900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110ba4 [ 32.356217][ T706] head:ffffea000442e900 order:1 compound_mapcount:0 [ 32.362782][ T706] flags: 0x4000000000010200(slab|head) [ 32.368219][ T706] raw: 4000000000010200 dead000000000100 dead000000000122 ffff888100043200 [ 32.376816][ T706] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 32.385394][ T706] page dumped because: kasan: bad access detected [ 32.391801][ T706] page_owner tracks the page as allocated [ 32.397519][ T706] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 106, ts 4061455684, free_ts 0 [ 32.414775][ T706] prep_new_page+0x176/0x190 [ 32.419346][ T706] get_page_from_freelist+0x225f/0x23f0 [ 32.424872][ T706] __alloc_pages_nodemask+0x29a/0x640 [ 32.430225][ T706] new_slab+0x84/0x3f0 [ 32.434279][ T706] ___slab_alloc+0x2f8/0x4c0 [ 32.438849][ T706] __slab_alloc+0x63/0xa0 [ 32.443161][ T706] kmem_cache_alloc_trace+0x1a8/0x2e0 [ 32.448512][ T706] inode_doinit_use_xattr+0x5d/0x400 [ 32.453778][ T706] inode_doinit_with_dentry+0x93a/0xd70 [ 32.459303][ T706] selinux_d_instantiate+0x27/0x40 [ 32.464394][ T706] security_d_instantiate+0x9e/0xf0 [ 32.469576][ T706] d_splice_alias+0x6d/0x390 [ 32.474147][ T706] kernfs_iop_lookup+0x2c5/0x310 [ 32.479061][ T706] __lookup_slow+0x2b8/0x410 [ 32.483630][ T706] lookup_slow+0x57/0x70 [ 32.487849][ T706] walk_component+0x326/0x460 [ 32.492498][ T706] page_owner free stack trace missing [ 32.497876][ T706] [ 32.500207][ T706] Memory state around the buggy address: [ 32.505816][ T706] ffff888110ba4380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.513865][ T706] ffff888110ba4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 32.521908][ T706] >ffff888110ba4480: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc [ 32.529948][ T706] ^ [ 32.536861][ T706] ffff888110ba4500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.544899][ T706] ffff888110ba4580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 32.553279][ T706] ================================================================== [ 32.561323][ T706] Disabling lock debugging due to kernel taint