last executing test programs: 47.467875564s ago: executing program 1 (id=206): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000c80)=ANY=[@ANYBLOB="0600000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000003180)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) close(r2) 47.413830387s ago: executing program 1 (id=207): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x4, 0xc8}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB], 0x50) syz_init_net_socket$nfc_raw(0x27, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0x18, 0x0, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r2}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000001500)={0x7ac, r5, 0x301, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x44}}}}, [@NL80211_ATTR_TID_CONFIG={0x15c, 0x11d, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd7}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x74}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xfffffffffffffffe}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x83}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}]}, {0xd4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xf2}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x3}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x8c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xc5f1, 0x200, 0x3, 0x5, 0x3, 0x2, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7ff, 0x9, 0x800, 0x2c51, 0x8, 0x7f, 0x5800, 0x401]}}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x1, 0xc, 0x6c, 0x6, 0x5, 0x78, 0x6, 0xb, 0xb, 0x9, 0x4, 0x3, 0x2, 0x9, 0x5, 0x6c, 0x36, 0xb, 0x8]}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xfff8, 0x1, 0x1, 0x9, 0x3ff, 0xcd, 0x6]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x1, 0x2, 0x6, 0x6c, 0x3, 0x24, 0x24, 0x16, 0x12, 0x2, 0x1b, 0x30, 0x16, 0x60, 0xb, 0x1b, 0x0]}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x3ff}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x8, 0x11d, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_TID_CONFIG={0x4}, @NL80211_ATTR_TID_CONFIG={0x198, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x91}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x72}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xcf}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x38}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x80, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x3}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9527}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x200000000}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x34, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0xaca, 0x7, 0xff7, 0x67f2, 0x7, 0x9, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}]}, {0xa0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x94, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x78, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x3, 0x8}, {0x0, 0x5}, {0x4, 0x6}, {0x5, 0xa}, {0x5}, {0x3, 0x8}, {0x2, 0x6}, {0x5, 0x2}, {0x0, 0x1}, {0x4, 0x6}, {0x7, 0x1}, {0x5, 0x2}, {0x5, 0x3}, {0x5, 0x4}, {0x6, 0x9}, {0x5, 0x1}, {0x7, 0xa}, {0x6, 0x3}, {0x3, 0x5}, {0x4, 0x4}, {0x1, 0x2}, {0x1, 0x2}, {0x1, 0x1}, {0x1}, {0x6, 0x6}, {}, {0x6, 0x4}, {0x2, 0x1}, {0x5, 0x5}, {0x7, 0xa}, {0x7, 0x6}, {0x0, 0x2}, {0x3, 0x4}, {0x5, 0x3}, {0x7, 0x1}, {0x5, 0x7}, {0x0, 0x4}, {0x2, 0x8}, {0x1, 0x1}, {0x2, 0x5}, {0x5, 0x5}, {0x7, 0x4}, {0x1, 0x9}, {0x2, 0x3}]}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x6c, 0x60, 0x48, 0x60, 0x16, 0x36, 0xc, 0x12, 0x1, 0x18, 0x9, 0x1b, 0x60, 0x48, 0x60, 0x1b, 0x2, 0x6c, 0x24, 0x5, 0x12, 0x6, 0xc, 0x36, 0x16, 0x1]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x101, 0x3, 0xe96, 0xfffe, 0x2, 0x8, 0x8, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x9, 0x0, 0x236d, 0x1, 0x5, 0x0, 0x8]}}]}]}]}]}, @NL80211_ATTR_TID_CONFIG={0x1d4, 0x11d, 0x0, 0x1, [{0x124, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x104, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x7c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0xd7ca, 0x7fff, 0xfffa, 0x0, 0x0, 0x8, 0x4]}}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x5166964301436659, 0x60, 0x16, 0x48, 0x16]}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x0, 0xb, 0x6c, 0x6, 0x9, 0x24, 0x3, 0x1, 0x1b, 0x60, 0x18, 0x6c, 0x586880f13f40918b, 0x60]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x1, 0x800, 0xc000, 0x4, 0x80, 0x6, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3ff, 0x4, 0x2, 0x7fff, 0x7, 0xa, 0x3, 0x1000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xf0, 0x9c9e, 0x90, 0x4, 0xa, 0xb, 0x7ff]}}]}, @NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x36, 0x6, 0x1b, 0x16, 0x18, 0x16, 0x60, 0x5, 0x1, 0x12, 0x9, 0x30, 0xb, 0x16, 0x12, 0x48, 0x16, 0x1b, 0x24, 0x10, 0x3, 0x5, 0x1b, 0x48, 0x6, 0x3, 0x4, 0x9]}, @NL80211_TXRATE_LEGACY={0x16, 0x1, [0xc, 0x18, 0xc, 0x1, 0xc, 0x24, 0x6, 0x48, 0x16, 0x48, 0x48, 0xb, 0x30, 0x18, 0x1, 0x12, 0x1, 0x18]}]}, @NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x16]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x4, 0x6, 0x36, 0x12, 0x6c, 0x36, 0x0, 0xc, 0x2, 0xc, 0x74, 0xb, 0x24, 0x3, 0x9, 0x4, 0x58, 0x6c, 0x2, 0x18, 0x6475aabf69df7630, 0xc, 0x6, 0x2, 0xd, 0x48, 0x5, 0x3, 0x6]}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe9}]}, {0x4}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xb7}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x3e}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x7}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x4c}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xb2}]}, {0x6c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x38, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x34, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x2, 0x24, 0x70, 0x18, 0x0, 0x0, 0x6]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x424, 0xe, 0x2, 0x568, 0x1ff, 0x7ff, 0x144f]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xfffffffffffffffe}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x2b8, 0x11d, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xe4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x7}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xed}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x254, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x248, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x16, 0x12, 0x4, 0x48, 0x9, 0x36, 0xc, 0x1b, 0x4, 0x6, 0x16, 0x4, 0x1, 0x3, 0x24, 0x41, 0x6c, 0x16, 0x4, 0x30, 0x1, 0x2, 0x4, 0xc, 0x1b]}]}, @NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x1, 0x0, 0x64e5, 0x6, 0x2, 0x85, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x3c, 0x2, [{0x1, 0x4}, {0x4, 0x3}, {0x6, 0x5}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x9}, {0x4, 0x3}, {0x0, 0x7}, {0x1, 0x8}, {0x7, 0xa}, {0x6, 0x4}, {0x1}, {0x5}, {0x0, 0x8}, {}, {0x2, 0x3}, {0x1, 0x7}, {0x0, 0x6}, {0x6, 0x1}, {0x2, 0x2}, {0x5, 0x7}, {0x4, 0xa}, {0x2, 0x9}, {0x6, 0x9}, {0x7, 0x5}, {0x0, 0x1}, {0x0, 0x2}, {0x0, 0x6}, {0x3, 0x4}, {0x0, 0xa}, {0x7, 0x7}, {0x5, 0x3}, {0x0, 0x7}, {0x4, 0x2}, {0x5, 0x4}, {0x5, 0x3}, {0x1, 0x2}, {0x5, 0x3}, {0x3, 0x8}, {0x0, 0x1}, {0x2}, {0x1, 0x7}, {0x1, 0x5}, {0x2, 0x6}, {0x3, 0x6}, {0x6}, {0x4, 0x7}, {0x3, 0x6}, {0x7}, {0x3, 0x3}, {0x0, 0x7}, {0x7}, {0x7, 0x9}, {0x0, 0x8}, {0x7, 0x5}, {0x7, 0x3}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x9, 0x61f, 0x7ff, 0x1, 0x7, 0x2, 0x2]}}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x6, 0x7}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x46, 0x2, [{0x0, 0x8}, {0x2, 0x1}, {}, {0x2, 0x1}, {0x0, 0x8}, {0x3, 0x7}, {0x7, 0x8}, {0x0, 0x2}, {0x6, 0x9}, {0x5, 0xa}, {0x2, 0x3}, {0x6, 0x2}, {0x1}, {0x1, 0x8}, {0x0, 0x7}, {0x2, 0x4}, {0x0, 0x6}, {0x1, 0xa}, {0x1, 0x1}, {0x1, 0x8}, {0x0, 0x3}, {0x5, 0x2}, {0x0, 0x4}, {0x0, 0x2}, {0x7}, {0x0, 0x4}, {0x1, 0x9}, {0x1, 0x7}, {0x7}, {0x0, 0x8}, {0x6, 0x7}, {0x4, 0x1}, {0x0, 0x2}, {0x2, 0x5}, {0x5, 0x4}, {0x2, 0x8}, {0x3, 0x7}, {0x0, 0x7}, {0x3}, {0x0, 0x1}, {0x6, 0x5}, {0x6}, {0x5, 0xa}, {0x6, 0x4}, {0x4}, {0x0, 0x8}, {0x4, 0x9}, {0x0, 0x4}, {0x4, 0x9}, {0x1, 0x3}, {0x0, 0x9}, {0x2, 0x9}, {0x3, 0x1}, {0x3, 0x6}, {0x1}, {0x0, 0xa}, {0x4}, {0x1, 0x7}, {0x0, 0x1}, {0x0, 0x8}, {0x2, 0x7}, {0x2, 0x6}, {0x4, 0x1}, {0x4, 0x3}, {0x4, 0x8}, {0x1, 0x7}]}]}, @NL80211_BAND_2GHZ={0x74, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x0, 0x3, 0xd6c, 0x5, 0x81, 0x8, 0x5]}}, @NL80211_TXRATE_HT={0x27, 0x2, [{0x5, 0x4}, {0x4, 0x6}, {0x2, 0x6}, {0x1}, {0x2, 0x1}, {0x0, 0x9}, {0x3, 0x1}, {0x0, 0x9}, {0x4, 0x1}, {0x3, 0x9}, {0x0, 0x9}, {0x5, 0x9}, {0x6, 0x9}, {0x6}, {0x2, 0x3}, {0x0, 0x6}, {0x1, 0x4}, {0x0, 0x3}, {0x4, 0x3}, {0x2, 0x4}, {}, {0x0, 0x9}, {0x4, 0x8}, {0x3, 0x3}, {0x0, 0x6}, {0x6, 0x3}, {0x0, 0x5}, {0x6, 0x3}, {0x4, 0x9}, {0x5, 0x9}, {0x6, 0x7}, {0x7, 0x3}, {0x6, 0x4}, {0x1, 0x7}, {0x0, 0x1}]}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0xc, 0x3, 0x18, 0x2, 0x12, 0x2, 0x5, 0x9, 0x24, 0x18, 0x36, 0x16, 0x3, 0x5, 0x16, 0x1, 0x48]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0xf32, 0x4, 0x7, 0x1, 0x0, 0xa8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x16, 0x48, 0x12, 0x1, 0xc3356f6216629aef, 0x60, 0x60, 0x2, 0x60, 0x6c, 0xc, 0x17]}]}, @NL80211_BAND_60GHZ={0x9c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2b, 0x2, [{0x1, 0x5}, {0x2, 0x7}, {0x1, 0x8}, {0x5, 0x6}, {0x6, 0x6}, {0x0, 0x8}, {0x7, 0x2}, {0x2, 0x3}, {0x3, 0x1}, {0x0, 0x2}, {0x5, 0x9}, {0x3, 0x6}, {0x6, 0x1}, {0x0, 0x6}, {0x1, 0x7}, {0x6, 0xa}, {0x7, 0x9}, {0x3, 0x5}, {0x4, 0x6}, {0x0, 0x2}, {0x2, 0x5}, {0x2, 0xa}, {0x5, 0x9}, {0x4, 0x1}, {0x1, 0x6}, {0x4, 0x7}, {0x5, 0x1}, {0x7, 0xa}, {0x2, 0x8}, {0x7, 0x4}, {0x1, 0xa}, {0x6, 0x9}, {0x5, 0x1}, {0x6, 0x2}, {0x0, 0xa}, {0x0, 0x2}, {0x2, 0x4}, {0x7, 0x8}, {0x1, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xff, 0x9e4, 0x6, 0x9, 0x3ff, 0xfffa, 0x35e, 0x5]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0xfff, 0x2, 0x3, 0x8000, 0x0, 0x0, 0x1]}}, @NL80211_TXRATE_HT={0x3a, 0x2, [{0x6, 0x8}, {0x0, 0x9}, {0x1, 0x5}, {0x3}, {0x2, 0x1}, {0x1, 0x9}, {0x0, 0x2}, {0x7, 0x6}, {0x4, 0x6}, {0x1, 0x8}, {0x3, 0xa}, {0x0, 0x1}, {0x3, 0x4}, {0x4, 0xa}, {0x4}, {0x0, 0x8}, {0x7, 0x5}, {0x5, 0x2}, {0x2, 0x9}, {0x2, 0x3}, {0x0, 0x9}, {0x0, 0x4}, {0x0, 0x7}, {0x3, 0x5}, {0x4, 0x8}, {0x2, 0x7}, {0x4, 0x8}, {0x4, 0x6}, {0x1, 0xa}, {0x0, 0x3}, {0x3, 0x7}, {0x0, 0x6}, {0x0, 0x1}, {0x6, 0x7}, {0x0, 0x2}, {0x7, 0x4}, {0x3}, {0x0, 0x8}, {0x1, 0x4}, {0x4, 0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x7, 0x6}, {0x7, 0x4}, {0x7, 0x9}, {0x1, 0x7}, {0x5, 0x9}, {0x0, 0x5}, {0x1, 0x8}, {0x1}, {0x1, 0x1}, {0x4, 0x3}, {0x1, 0xa}]}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x7, 0x1, [0x6, 0x6c, 0x18]}]}]}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}]}]}, 0x7ac}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000280)={r4, 0x7, 0x104, 0x7ff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) sigaltstack(0x0, &(0x7f0000000640)={&(0x7f0000000480)=""/202, 0x0, 0xca}) r6 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) r7 = syz_io_uring_setup(0x2085, &(0x7f0000000380)={0x0, 0x86f7, 0x10000, 0x3, 0x188}, &(0x7f0000002000)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r8, r9, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x22}) io_uring_enter(r7, 0x48e9, 0xf2bb, 0x2, 0x0, 0x0) ioctl$EVIOCGABS20(r6, 0x40044591, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, 0x0, 0x880) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') 47.198960056s ago: executing program 1 (id=211): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000003000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000140)=0xff, r2, 0x0, 0x3, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xfffffffb, @private2, 0xffff}, {0xa, 0x4e21, 0x8, @private0, 0x5}, r2, 0x10}}, 0x48) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000001c0)={@local, 0x0}, &(0x7f0000000200)=0x14) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb01001800000000000000180018000000060000000000000001000001000000000400f9ffffffffffffff0000006100305f00"], &(0x7f0000000f40)=""/4079, 0x36, 0xfef, 0x8}, 0x28) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000180), r6, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000300)={0x4, 0x8, 0xfa00, {r6, 0x6}}, 0x10) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r7, 0x0) inotify_init1(0x0) unshare(0x8000400) pselect6(0x40, &(0x7f0000000240)={0x2, 0x0, 0x7, 0x3, 0x3, 0x0, 0x100, 0x5}, &(0x7f00000000c0)={0x1d, 0xfffffffffffffffe, 0x40, 0x7eff, 0x0, 0x1, 0x0, 0x8}, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0xb) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_udp_SIOCINQ(r9, 0x541b, &(0x7f0000000280)) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000039000900000000000000000001000000040000000c0001800600000005470000080002"], 0x38}}, 0x0) 47.171736068s ago: executing program 1 (id=213): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x4, 0xc8}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB], 0x50) syz_init_net_socket$nfc_raw(0x27, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0x18, 0x0, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r2}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000001500)={0x7ac, r5, 0x301, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x44}}}}, [@NL80211_ATTR_TID_CONFIG={0x15c, 0x11d, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd7}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x74}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xfffffffffffffffe}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x83}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}]}, {0xd4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xf2}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x3}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x8c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xc5f1, 0x200, 0x3, 0x5, 0x3, 0x2, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7ff, 0x9, 0x800, 0x2c51, 0x8, 0x7f, 0x5800, 0x401]}}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x1, 0xc, 0x6c, 0x6, 0x5, 0x78, 0x6, 0xb, 0xb, 0x9, 0x4, 0x3, 0x2, 0x9, 0x5, 0x6c, 0x36, 0xb, 0x8]}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xfff8, 0x1, 0x1, 0x9, 0x3ff, 0xcd, 0x6]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x1, 0x2, 0x6, 0x6c, 0x3, 0x24, 0x24, 0x16, 0x12, 0x2, 0x1b, 0x30, 0x16, 0x60, 0xb, 0x1b, 0x0]}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x3ff}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x8, 0x11d, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_TID_CONFIG={0x4}, @NL80211_ATTR_TID_CONFIG={0x198, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x91}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x72}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xcf}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x38}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x80, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x3}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9527}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x200000000}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x34, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0xaca, 0x7, 0xff7, 0x67f2, 0x7, 0x9, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}]}, {0xa0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x94, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x78, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x3, 0x8}, {0x0, 0x5}, {0x4, 0x6}, {0x5, 0xa}, {0x5}, {0x3, 0x8}, {0x2, 0x6}, {0x5, 0x2}, {0x0, 0x1}, {0x4, 0x6}, {0x7, 0x1}, {0x5, 0x2}, {0x5, 0x3}, {0x5, 0x4}, {0x6, 0x9}, {0x5, 0x1}, {0x7, 0xa}, {0x6, 0x3}, {0x3, 0x5}, {0x4, 0x4}, {0x1, 0x2}, {0x1, 0x2}, {0x1, 0x1}, {0x1}, {0x6, 0x6}, {}, {0x6, 0x4}, {0x2, 0x1}, {0x5, 0x5}, {0x7, 0xa}, {0x7, 0x6}, {0x0, 0x2}, {0x3, 0x4}, {0x5, 0x3}, {0x7, 0x1}, {0x5, 0x7}, {0x0, 0x4}, {0x2, 0x8}, {0x1, 0x1}, {0x2, 0x5}, {0x5, 0x5}, {0x7, 0x4}, {0x1, 0x9}, {0x2, 0x3}]}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x6c, 0x60, 0x48, 0x60, 0x16, 0x36, 0xc, 0x12, 0x1, 0x18, 0x9, 0x1b, 0x60, 0x48, 0x60, 0x1b, 0x2, 0x6c, 0x24, 0x5, 0x12, 0x6, 0xc, 0x36, 0x16, 0x1]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x101, 0x3, 0xe96, 0xfffe, 0x2, 0x8, 0x8, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x9, 0x0, 0x236d, 0x1, 0x5, 0x0, 0x8]}}]}]}]}]}, @NL80211_ATTR_TID_CONFIG={0x1d4, 0x11d, 0x0, 0x1, [{0x124, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x104, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x7c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0xd7ca, 0x7fff, 0xfffa, 0x0, 0x0, 0x8, 0x4]}}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x5166964301436659, 0x60, 0x16, 0x48, 0x16]}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x0, 0xb, 0x6c, 0x6, 0x9, 0x24, 0x3, 0x1, 0x1b, 0x60, 0x18, 0x6c, 0x586880f13f40918b, 0x60]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x1, 0x800, 0xc000, 0x4, 0x80, 0x6, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3ff, 0x4, 0x2, 0x7fff, 0x7, 0xa, 0x3, 0x1000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xf0, 0x9c9e, 0x90, 0x4, 0xa, 0xb, 0x7ff]}}]}, @NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x36, 0x6, 0x1b, 0x16, 0x18, 0x16, 0x60, 0x5, 0x1, 0x12, 0x9, 0x30, 0xb, 0x16, 0x12, 0x48, 0x16, 0x1b, 0x24, 0x10, 0x3, 0x5, 0x1b, 0x48, 0x6, 0x3, 0x4, 0x9]}, @NL80211_TXRATE_LEGACY={0x16, 0x1, [0xc, 0x18, 0xc, 0x1, 0xc, 0x24, 0x6, 0x48, 0x16, 0x48, 0x48, 0xb, 0x30, 0x18, 0x1, 0x12, 0x1, 0x18]}]}, @NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x16]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x4, 0x6, 0x36, 0x12, 0x6c, 0x36, 0x0, 0xc, 0x2, 0xc, 0x74, 0xb, 0x24, 0x3, 0x9, 0x4, 0x58, 0x6c, 0x2, 0x18, 0x6475aabf69df7630, 0xc, 0x6, 0x2, 0xd, 0x48, 0x5, 0x3, 0x6]}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe9}]}, {0x4}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xb7}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x3e}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x7}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x4c}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xb2}]}, {0x6c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x38, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x34, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x2, 0x24, 0x70, 0x18, 0x0, 0x0, 0x6]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x424, 0xe, 0x2, 0x568, 0x1ff, 0x7ff, 0x144f]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xfffffffffffffffe}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x2b8, 0x11d, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xe4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x7}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xed}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x254, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x248, 0xd, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x2c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x16, 0x12, 0x4, 0x48, 0x9, 0x36, 0xc, 0x1b, 0x4, 0x6, 0x16, 0x4, 0x1, 0x3, 0x24, 0x41, 0x6c, 0x16, 0x4, 0x30, 0x1, 0x2, 0x4, 0xc, 0x1b]}]}, @NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x1, 0x0, 0x64e5, 0x6, 0x2, 0x85, 0x8]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x3c, 0x2, [{0x1, 0x4}, {0x4, 0x3}, {0x6, 0x5}, {0x7, 0x5}, {0x1, 0x4}, {0x7, 0x9}, {0x4, 0x3}, {0x0, 0x7}, {0x1, 0x8}, {0x7, 0xa}, {0x6, 0x4}, {0x1}, {0x5}, {0x0, 0x8}, {}, {0x2, 0x3}, {0x1, 0x7}, {0x0, 0x6}, {0x6, 0x1}, {0x2, 0x2}, {0x5, 0x7}, {0x4, 0xa}, {0x2, 0x9}, {0x6, 0x9}, {0x7, 0x5}, {0x0, 0x1}, {0x0, 0x2}, {0x0, 0x6}, {0x3, 0x4}, {0x0, 0xa}, {0x7, 0x7}, {0x5, 0x3}, {0x0, 0x7}, {0x4, 0x2}, {0x5, 0x4}, {0x5, 0x3}, {0x1, 0x2}, {0x5, 0x3}, {0x3, 0x8}, {0x0, 0x1}, {0x2}, {0x1, 0x7}, {0x1, 0x5}, {0x2, 0x6}, {0x3, 0x6}, {0x6}, {0x4, 0x7}, {0x3, 0x6}, {0x7}, {0x3, 0x3}, {0x0, 0x7}, {0x7}, {0x7, 0x9}, {0x0, 0x8}, {0x7, 0x5}, {0x7, 0x3}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x9, 0x61f, 0x7ff, 0x1, 0x7, 0x2, 0x2]}}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x5, 0x2, [{0x6, 0x7}]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x46, 0x2, [{0x0, 0x8}, {0x2, 0x1}, {}, {0x2, 0x1}, {0x0, 0x8}, {0x3, 0x7}, {0x7, 0x8}, {0x0, 0x2}, {0x6, 0x9}, {0x5, 0xa}, {0x2, 0x3}, {0x6, 0x2}, {0x1}, {0x1, 0x8}, {0x0, 0x7}, {0x2, 0x4}, {0x0, 0x6}, {0x1, 0xa}, {0x1, 0x1}, {0x1, 0x8}, {0x0, 0x3}, {0x5, 0x2}, {0x0, 0x4}, {0x0, 0x2}, {0x7}, {0x0, 0x4}, {0x1, 0x9}, {0x1, 0x7}, {0x7}, {0x0, 0x8}, {0x6, 0x7}, {0x4, 0x1}, {0x0, 0x2}, {0x2, 0x5}, {0x5, 0x4}, {0x2, 0x8}, {0x3, 0x7}, {0x0, 0x7}, {0x3}, {0x0, 0x1}, {0x6, 0x5}, {0x6}, {0x5, 0xa}, {0x6, 0x4}, {0x4}, {0x0, 0x8}, {0x4, 0x9}, {0x0, 0x4}, {0x4, 0x9}, {0x1, 0x3}, {0x0, 0x9}, {0x2, 0x9}, {0x3, 0x1}, {0x3, 0x6}, {0x1}, {0x0, 0xa}, {0x4}, {0x3, 0x2}, {0x0, 0x1}, {0x0, 0x8}, {0x2, 0x7}, {0x2, 0x6}, {0x4, 0x1}, {0x4, 0x3}, {0x4, 0x8}, {0x1, 0x7}]}]}, @NL80211_BAND_2GHZ={0x74, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x0, 0x3, 0xd6c, 0x5, 0x81, 0x8, 0x5]}}, @NL80211_TXRATE_HT={0x27, 0x2, [{0x5, 0x4}, {0x4, 0x6}, {0x2, 0x6}, {0x1}, {0x2, 0x1}, {0x0, 0x9}, {0x3, 0x1}, {0x0, 0x9}, {0x4, 0x1}, {0x3, 0x9}, {0x0, 0x9}, {0x5, 0x9}, {0x6, 0x9}, {0x6}, {0x2, 0x3}, {0x0, 0x6}, {0x1, 0x4}, {0x0, 0x3}, {0x4, 0x3}, {0x2, 0x4}, {}, {0x0, 0x9}, {0x4, 0x8}, {0x3, 0x3}, {0x0, 0x6}, {0x6, 0x3}, {0x0, 0x5}, {0x6, 0x3}, {0x4, 0x9}, {0x5, 0x9}, {0x6, 0x7}, {0x7, 0x3}, {0x6, 0x4}, {0x1, 0x7}, {0x0, 0x1}]}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0xc, 0x3, 0x18, 0x2, 0x12, 0x2, 0x5, 0x9, 0x24, 0x18, 0x36, 0x16, 0x3, 0x5, 0x16, 0x1, 0x48]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0xf32, 0x4, 0x7, 0x1, 0x0, 0xa8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x10, 0x1, [0x16, 0x48, 0x12, 0x1, 0xc3356f6216629aef, 0x60, 0x60, 0x2, 0x60, 0x6c, 0xc, 0x17]}]}, @NL80211_BAND_60GHZ={0x9c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2b, 0x2, [{0x1, 0x5}, {0x2, 0x7}, {0x1, 0x8}, {0x5, 0x6}, {0x6, 0x6}, {0x0, 0x8}, {0x7, 0x2}, {0x2, 0x3}, {0x3, 0x1}, {0x0, 0x2}, {0x5, 0x9}, {0x3, 0x6}, {0x6, 0x1}, {0x0, 0x6}, {0x1, 0x7}, {0x6, 0xa}, {0x7, 0x9}, {0x3, 0x5}, {0x4, 0x6}, {0x0, 0x2}, {0x2, 0x5}, {0x2, 0xa}, {0x5, 0x9}, {0x4, 0x1}, {0x1, 0x6}, {0x4, 0x7}, {0x5, 0x1}, {0x7, 0xa}, {0x2, 0x8}, {0x7, 0x4}, {0x1, 0xa}, {0x6, 0x9}, {0x5, 0x1}, {0x6, 0x2}, {0x0, 0xa}, {0x0, 0x2}, {0x2, 0x4}, {0x7, 0x8}, {0x1, 0x4}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xff, 0x9e4, 0x6, 0x9, 0x3ff, 0xfffa, 0x35e, 0x5]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0xfff, 0x2, 0x3, 0x8000, 0x0, 0x0, 0x1]}}, @NL80211_TXRATE_HT={0x3a, 0x2, [{0x6, 0x8}, {0x0, 0x9}, {0x1, 0x5}, {0x3}, {0x2, 0x1}, {0x1, 0x9}, {0x0, 0x2}, {0x7, 0x6}, {0x4, 0x6}, {0x1, 0x8}, {0x3, 0xa}, {0x0, 0x1}, {0x3, 0x4}, {0x4, 0xa}, {0x4}, {0x0, 0x8}, {0x7, 0x5}, {0x5, 0x2}, {0x2, 0x9}, {0x2, 0x3}, {0x0, 0x9}, {0x0, 0x4}, {0x0, 0x7}, {0x3, 0x5}, {0x4, 0x8}, {0x2, 0x7}, {0x4, 0x8}, {0x4, 0x6}, {0x1, 0xa}, {0x0, 0x3}, {0x3, 0x7}, {0x0, 0x6}, {0x0, 0x1}, {0x6, 0x7}, {0x0, 0x2}, {0x7, 0x4}, {0x3}, {0x0, 0x8}, {0x1, 0x4}, {0x4, 0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x7, 0x6}, {0x7, 0x4}, {0x7, 0x9}, {0x1, 0x7}, {0x5, 0x9}, {0x0, 0x5}, {0x1, 0x8}, {0x1}, {0x1, 0x1}, {0x4, 0x3}, {0x1, 0xa}]}]}, @NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x7, 0x1, [0x6, 0x6c, 0x18]}]}]}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}]}]}, 0x7ac}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000280)={r4, 0x7, 0x104, 0x7ff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) sigaltstack(0x0, &(0x7f0000000640)={&(0x7f0000000480)=""/202, 0x0, 0xca}) r6 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) r7 = syz_io_uring_setup(0x2085, &(0x7f0000000380)={0x0, 0x86f7, 0x10000, 0x3, 0x188}, &(0x7f0000002000)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r8, r9, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x22}) io_uring_enter(r7, 0x48e9, 0xf2bb, 0x2, 0x0, 0x0) ioctl$EVIOCGABS20(r6, 0x40044591, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, 0x0, 0x880) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') 47.065494142s ago: executing program 1 (id=216): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xfffffffc, 0xb, 0x0, 0xfffffffc, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000000f060104000009050001000700000090a49b5a725affe7b306000b0004000000"], 0x24}, 0x1, 0x0, 0x0, 0x20040800}, 0x40080) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0x0, 0xffffffffffffffff, 0x0, 0x31, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x140070, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x5, 0x9, 0x1}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x2, 0x3, 0x3}, 0x14}}, 0x20040000) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0a000000080000000100000040"], 0x48) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000240)={r7, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) fcntl$getflags(r3, 0x3) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, 0xffffffffffffffff, 0x0) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) r8 = syz_open_pts(r0, 0x0) r9 = syz_io_uring_setup(0x14dd, &(0x7f0000000300)={0x0, 0x5121, 0x0, 0x3, 0x258}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r10, r11, &(0x7f0000000080)=@IORING_OP_SYMLINKAT={0x26, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r9, 0x47ba, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCSTI(r8, 0x5412, &(0x7f00000000c0)=0x7) 46.17544893s ago: executing program 1 (id=229): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='kfree\x00', r0}, 0x18) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[@mss, @sack_perm, @window={0x3, 0x7, 0xfffd}, @sack_perm, @window={0x3, 0x3, 0x401}, @window, @window={0x3, 0x108, 0x400}, @mss={0x2, 0x3}, @sack_perm, @mss, @window={0x3, 0x4, 0x7f}, @timestamp, @timestamp], 0xd) r2 = syz_clone(0x2b02000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000003000010850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000a80)='kfree\x00', r4, 0x0, 0x3}, 0x18) ptrace$pokeuser(0x6, r2, 0x388, 0x2590f58a) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xb, &(0x7f0000001140)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000010a850000000400000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r8, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20040018}, 0x0) sendmsg$inet(r8, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0x1}], 0x1}, 0x880) recvmsg(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000b80)=""/214, 0xd6}, {&(0x7f00000011c0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/95, 0x5f}, {&(0x7f0000000500)=""/29, 0x1d}, {&(0x7f00000007c0)=""/83, 0x53}, {&(0x7f0000000600)=""/36, 0x24}, {&(0x7f00000006c0)=""/87, 0x57}], 0x7}, 0x40000041) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r5}, 0x18) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) fsopen(&(0x7f0000000140)='romfs\x00', 0x1) remap_file_pages(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0xffffffff998abe5f, 0x20000) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r10 = memfd_secret(0x80000) ioctl$sock_kcm_SIOCKCMATTACH(r10, 0x89e0, &(0x7f0000000280)={r9, r0}) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000004c0)=ANY=[@ANYRES32], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000003c0)='kfree\x00', r11}, 0x10) 42.059006879s ago: executing program 3 (id=300): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r0}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000c00)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x2, 0x5, 0x59, @loopback, @loopback, 0x700, 0xb6, 0x1, 0x9}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00', 0x0}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000280)={@remote, r3}, 0x14) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r3, {0xfff1, 0x10}, {0x8, 0x4}, {0x6, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x8804) getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000380)={@private0}, &(0x7f0000000480)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000880)}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl2\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x2f, 0x9, 0xa2, 0x5e6, 0x10, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x7800, 0x2, 0x3}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000006c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl0\x00', 0x0, 0x29, 0x4, 0x50, 0x3, 0x10, @local, @empty, 0x7, 0x7800, 0xffff8001, 0x800}}) r4 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f00000005c0)={@empty, @remote, @remote, 0x6, 0x2, 0x0, 0x0, 0xb7, 0x2000213, r5}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000840)={'syztnl0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x29, 0x8, 0x2, 0x0, 0x20, @mcast2, @empty, 0x8000, 0x10, 0xe, 0x1}}) sendmsg$ETHTOOL_MSG_WOL_GET(0xffffffffffffffff, 0x0, 0x20000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{}, &(0x7f0000000040), 0x0}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r8, @ANYBLOB="05002abd7000fddbdf25010000008c0008803000008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b08000300070000005800008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3000098028000080060001000a000000140002000000000000000000000000000000000105000300000000000400008008000100", @ANYRES32=r9, @ANYBLOB="ec4e08a9ec26b25e254670402fc2233c17789b870c0549465af9419dd39731793a5f7e61fe0b8ee5054314076eac1707367d0ca64becdbbcbcdc2c1b825e09971277d6858ef0f384c84804fe0a0f3fb497d7fce6d69982a8f751400e05f085012118088970ee5a256cf29e263baa3e2fe8f7106c10920a1008404d5e09f908e914b84b822a4f"], 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x181) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r10, &(0x7f0000000100)={0xa, 0x4e22, 0x5ccc6e74, @ipv4={'\x00', '\xff\xff', @loopback}, 0xffff2d76}, 0x1c) listen(r10, 0x3) mount$9p_tcp(&(0x7f0000000100), &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e22']) close_range(r10, r10, 0x0) 41.10830885s ago: executing program 3 (id=313): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r0}, 0x10) r1 = add_key$keyring(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='ceph\x00', 0x0, &(0x7f0000000080)="010000000037a788a11d1f000000000000006923c63a4541062101b60a2156566de77062086575a59ea9cb", 0x2b, r1) 41.002793424s ago: executing program 3 (id=315): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x124a, 0x80, 0x0, 0x52}, 0x0, 0x0) socket(0x1e, 0x4, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r1 = io_uring_setup(0x4fee, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x800, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xd}, {0xe, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r1, 0x2219, 0x7721, 0x16, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000065681bf7e0790f0000631735f076f1000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r3}, 0x10) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002005817d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b0", 0x3a}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) pipe(&(0x7f0000000d00)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x4, '\x00', 0x0, 0x0, 0x0, 0x1}, 0x50) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x0, &(0x7f0000000040)}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) r8 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r7, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r8, &(0x7f0000000500)=[{{&(0x7f0000000080)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='p'], 0x70}}], 0x1, 0x2000c044) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r11], 0x20}}, 0x0) write$binfmt_misc(r6, &(0x7f0000000240), 0xfffffecc) splice(r5, 0x0, r7, 0x0, 0x714f, 0x0) 40.172268961s ago: executing program 3 (id=322): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xe, 0x101301) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f0000000b80), 0x0, 0x4008014, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000ff0f000007"], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='kfree\x00', r4, 0x0, 0xf}, 0x18) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f00, 0x0, 0x4, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x4, 0x2f, 0x0, @empty, @multicast1}}}}) r5 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000002c0)=0xc) syz_pidfd_open(r6, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f00000017c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546000677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5467a932b77674e802a0d42bc6099ad238af770b5ed8925161729298700000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809b5b9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed3957f813567f7a95435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac559eaf39027ceb379a902d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff7a1ef3282830689da6b53b263339863297771429d120000003341bf4abacac94500fca0493cf29b33dcc9ffffffffffffffd39f6ce0c6ff01589646efd1cf870cd7bb2366fdf870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1293b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd000c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301fb997316dbf17866fb84d4173731efe895ff2e1c55ef08235a0126e01254c44060926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a861887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc74aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7ad333545794f37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea139376f24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff070000001e48418046c216c1f895778cb25122a2a998de0842a486721737390cbf3a74cb2003016f1514216bdf57d2a40dddb51ab63e96ec84ac3571f02f647b3385b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba2f58ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df986741517abf11389b751f4e109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288d139bd3da230ed05a8fe64680b0a3f9f2dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b9100000000a55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c776f4b4ce07e1c6fa66fcfc7a228805f76785efc0ceb1c8e5729c66418d169fc03aa18854693ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7e478950aa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab848753203b458b97ec1afb079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7db3c4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b70ebc660309e1e245b0fdf9743af932cd6db49a47613808bad959719c0000000000378ac2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6ca0400966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e3030108000000000000c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bffef97dcecc467ace456597685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5000000000006065d6735eb7a00e127c0000000000000000000000bfb0bba79344643b1d8daa9f38e4b62c1e2af68c6f5054b078acd74b4a9c944e4505da485a3a4154387a0a88370d9ed9467b09c5888a06431df3f68abf0b366c4d5f8bea7b29c257ed756dff7a21c6b661cbdd43de65afd7f661d5c84f915c90e3d6ea012b68b787eb01d8320000000000000060176dacba0ec503a37fae6b472ec369c79ee6a420c0fd8d8d82fe136d5af6c30bfeb0a7275babfdb96a127aa9386e0671c6454245a18c1c8c49552cff5d27b547cdc34c0858c77a47a9ff86ee9fbd9ceda428716a4218821176d8067997527230fa67d26950d3e4f2750fa7c872874ad3a2d11f9f6eb08e6d7b6fa257b04d8ce36360f524e3dfd2211641f3d2637d86b80681eca50ce0eecafdd22d41fa515c15591e70ded4b70efac3cb42fb352d82e8f7573e8ed8248da356fa91a252976d3a4d8c1843a8d5bb7f5f1028453a0562a3ea93117076dd4940b7df50d78289fe66197525f6095f8662d232970bef61b03fa83027963a1a2e07cfee30c0d0b4c5877f93b3637ca21eab5afcf5d4638dfe8f9202aaad51c979049dd76d65368cbd4187d9f74257c7c4a23ac4a34eec5aa17e78c5167216f5e72138d20f8325dd5f8f96c32189c904eaef580987f1ce601a7cdc35461db9981ac42f9e24b0699bbe4e3d986e38952b0b7938eefd9e7a292bbb66367ad77045fdc18855c81c031dedd185c723238373fc698d676791d04f1ff5f0825a6619e844882f31ed190233d58ecee949e310bf2b1a51b8a33ae65a06d2b6ad386bf8dc49dd328bcd75d1843a13d68560175a18af7efc3c0f20e32f84f6aaaf000000000000000000000013a6c66bce74a8fb9092023df695da2714a7933d699d42de2bc4a85e0a0e22228290a7a7553ab93a16e42553ed86869a02df2f47d4088fac1772d3cd955c81cbf91c2ca7942942f61723b558079b82547844f92df2499c4b2c2ef2539e5daa8d8727baaa6b5755e6f83bbfca000000000000000000000509619f5f0cbc72eebc653946d3552236f0dfe485cfa71bd69f4ded6e131128c3875b785875addfcbd5931c12adbef75535e694f3a19f28f9f99fa32e8ff66e7b1ff674434fb63ba0e28aadccf77d387525c98e81476058c958eaccfa7d251d0671222dc9d06485f7f690d3d4227bd21bd7ff8338617705b7faec47c86789a488b43d0fedf1b0ee05d65c677ced1e8214b2f6cb74d73886eb"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff7e}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, 0x0) sendmsg$nl_route(r5, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3800000013000500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000100000000"], 0x38}}, 0x48000) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) r8 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) listen(r5, 0xa) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f00000005c0)={0xffffffffffffffff, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) 40.095390664s ago: executing program 3 (id=325): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xfffffffc, 0xb, 0x0, 0xfffffffc, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) socket$tipc(0x1e, 0x5, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000000f060104000009050001000700000090a49b5a725affe7b306000b0004000000"], 0x24}, 0x1, 0x0, 0x0, 0x20040800}, 0x40080) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0x0, 0xffffffffffffffff, 0x0, 0x31, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) 40.042683626s ago: executing program 3 (id=326): io_setup(0x30, &(0x7f0000000600)=0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101402) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000)="0136a531", 0x4}]) 36.546651767s ago: executing program 32 (id=362): r0 = socket(0x10, 0x803, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020700000000000002030207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000100850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r1}, 0x18) memfd_create(0x0, 0x1) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540006001400b59500000000000000000a000000", @ANYRES32=r0, @ANYBLOB="140001"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) 35.078380601s ago: executing program 4 (id=368): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0000444e0b4fb5f732979e3346f5", @ANYRES64], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f6000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000f00)='kfree\x00', r1, 0x0, 0x34}, 0x18) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000020500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000002b0900020073797a310000000008000a40ffff"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300540e7ff10000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x40008d1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff2}, {0xffff, 0xffff}, {0x5, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) socket$netlink(0x10, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) r4 = syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x818010, &(0x7f0000000300)={[{@minixdf}, {@grpjquota}]}, 0x3, 0x738, &(0x7f0000000780)="$eJzs3V9rW2UYAPDnnDambtVWUPEPyMSh4li61snYlduV3gwHA2+30malNl1qk8wl7GK78lZEURBBv4P3itd+AL+Cgn9GvZhXkZN/29qki1vbQPP7wUne55wTnvddxvtA30PeAMbWsewljXgxIi4mETOd80lE5FqtyYhz7fu27txcyo4kms1LfyWte7I47vtM5mhE3IqIFyLi51zEiXRn3kq9sbZYKhU3O/FcdX1jrlJvnFxdX1wprhSvnT19euH0mXfOnt27sb71wYfPF7qdnP/thyTOxXQnvH8ce6mdLpf9Ez7gvf1INkLJqDvAI5mMiInO+3MxExOtFgBwmDXzEU0AYMwk6j8AjJnu3wG6a3v7tQ42yB/nI2KqX/7JzprZVGsd8shW8sDKRBIRswfZUQ6lW7cj4srssZ3//5Ida7b/16m96CD76qds/jnXb/5Je/NP9Jl/prrPTjymwfPfvfwTA+a/i0PmeP/lWnlg/tsRLyWTffInvfzJgPxXhsz/493lfwdda34f8fr2+jMRDzxRkOz6fMjc1dVS8VT7tX+OY7WbH+02/iN961/SeoZlt/FvDDn+6c9f/eXWLvnffG337z+J+PN8Z42+K6uJnw2Z/9Pcu18OupblX+6O/9vj9115+Pf/3ZD5z7zycWPIWwEAAAAAAAAAAAAAAAAAAAAAAAAAAOBQSCNiOpK00GunaaHQ3sP72TiSlsqV6omr5dq15WjtlT0bubT7U8sz7TjJ4vnO7/F344VWe6sXvx0Rz0TEF/knW3FhqVxaHvXgAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDj6Lb9///Jt/f/BwAOualRdwAAOHDqPwCMH/UfAMaP+g8A40f9B4Dxo/4DwPh5hPqf349+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA2Ll64kB3NrTs3l7J4+Xq9tla+fnK5WFkrrNeWCkvlzY3CSrm8UioWlsrr2z+fbItL5fLGwkLUbsxVi5XqXKXeuLxerl2rXl5dX1wpXi7mDmxkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADC86daRpIWISFvtNC0UIp6KiNnIJVdXS8VTEfF0RPyaz+WzeH7UnQYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAPVapN9YWS6XipoaGhkavMeqZCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7evU2/R90TAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABil9PckIrLjjZnj09uvPpHczbfeI+KTby59dWOxWt2cz87/3Ttf/bpzfmEU/QcAHqZbp7t1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD6qdQba4ulUnGzUk8i4m6zrX2md+nxGqMeIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAe+e/AAAA//829Mx2") bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000ed07449e000000000000000098010000", @ANYRES32=r2, @ANYRES16=r4], &(0x7f0000000580)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x7f}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = fsopen(&(0x7f0000000040)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x89) fchdir(r7) openat$dir(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000f40)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000e9e8cb9a1bc7f8159f08bb54fb20a3f03fc541a8f0e7d69650c57bd9be1d9301c5147d2277bb4821a26fefd8db5faf4c565a06df5cafaa5692ab3f541a609f522cfa775b8b8b8a52896dceafcadea13137c0b3363a68cc1772c11d4da695d68993e8f97de42bd784cf3c432d1295435a7deac75dc0b7e9eae1a2eb9ae752542d681e100af822516feca8c2304a15bb26ad6ae6639606a628602185a496be78cdacf7a867c3f9ea67c5aabf9ae1a6e395cf003d41fb5a9f9fccdc00ad52a825d62e7031f3d8fc481459072d", @ANYRES32, @ANYRESHEX=0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r7, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32], 0x0}, 0x90) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r8}, 0x10) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) r10 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r10, 0xc0a85320, &(0x7f00000005c0)={{0x80}, 'port0\x00', 0x22, 0x11cfa, 0x0, 0x8000008, 0x3, 0x4, 0x10000001, 0x0, 0x3}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r10, 0x40505330, &(0x7f00000003c0)={0x800100, 0x0, 0x97e, 0x0, 0x0, 0x4000003}) close_range(r9, 0xffffffffffffffff, 0x0) 34.86456691s ago: executing program 4 (id=369): sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x800) socket$nl_route(0x10, 0x3, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000002040)=ANY=[@ANYBLOB="1e0000000000000005000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0, 0x8, 0x0, 0x0, 0x0, 0x51, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0xce) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000005c0)='sched_switch\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000025c0)=[{0x0}], 0x1) memfd_create(&(0x7f0000000600)='syzkaller\x00', 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f0000000080)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000640)={0x6, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x14, 0x4, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x2c, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) 34.789683244s ago: executing program 4 (id=370): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000340)={0x0, 0x0, 0x0, &(0x7f00000003c0)="a4090000009236902edd6dfc023a26f1f578245d2904c7647719bc762aa2b3938564bde0bdc8ae7dc9f60ead90764187e02d7fbf8f07b4a2351d2d9f5138a25561bfe650c53b234933726bbaf6741ef2be855ddb19ddb890263a6b665d6a8a219f8b753d4e7ee423fb1cb941057fdb3f10d60bff2377014636e7eb0475e8cc76e0", 0x1, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xd, &(0x7f0000000240)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x2}, 0x18) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000001e80)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0xd, &(0x7f0000000a00)=ANY=[@ANYRESOCT=r3, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000021007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000005fc545000085000000010000009561aba59f6eaf76ab45f9e935e0f8bfbe5db241f1a5d56d3ba85c91475d141de58587872ea8e6209b8aec238acc91a3a3b42c46594126583c706dfad5a27d55ff947dcda34c9634073edd10c5226cba6afeeb15c34c7b371a20aed24a12d0a1658f5ab8d3e3f91e1d6cd660cff09de71f15eec9290f1e58dc566fa412e7ba14f6"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r5 = socket$kcm(0x10, 0x2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040008000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) pipe(&(0x7f00000000c0)) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x800000, &(0x7f00000002c0)={[{@noauto_da_alloc}, {@jqfmt_vfsold}, {@noquota}, {@norecovery}, {}]}, 0x1, 0x4be, &(0x7f0000000540)="$eJzs3ctrW1caAPBPUvyMZ/KYYUgyMAlkIPMglh8MsWdmM6uZWQSGCXTTQuraiutatowlp7EJ1Gl3WXRRWlooXXRZ6D/QbppVQ6F03e5LFiWlTV1oCwUVXUmO/JArGjsC398PbnTuOTf6zrH4jq+OrnUDSK1ztX8yEUMR8UlEHKvvbj3gXP1h48HN6dqWiWr1yleZ5LjafvPQ5v87GhHrEdEfEf//d8QzmZ1xy6tr81PFYmG5sZ+vLCzly6trF+cWpmYLs4XF0YlLk5MTI+Njk/s21tsvP3f78vv/7X33u5fu333lww9q3RpqtLWOYz/Vh94TJ1rqjkTEPw8iWBfkGuMZ6HZH+EVqr99vIuJ8kv/HIpe8mkAaVKvV6o/VvnbN61Xg0Mom58CZ7HBE1MvZ7PBw/Rz+tzGYLZbKlb9eK60sztTPlY9HT/baXLEw0nivcDx6MrX90aT8cH9s2/54RHIO/GpuINkfni4VZx7vVAdsc3Rb/n+bq+c/kBLe8kN6yX9IL/kP6SX/Ib3kP6SX/If0kv+QXvIf0kv+Q3rJf0gv+Q+p9L/Ll2tbtfn37zPXV1fmS9cvzhTK88MLK9PD06XlGJ4t9b3X2fMVS6Wl0b/Fyo18pVCu5Mura1cXSiuLlatzC1OzvVHoOeDxAJ07cfbOZ5mIWP/7QLLV9Dba5CocbtUX6t8BAKRPrtsTENA1lv4gvbzHB3b5it4t+ts1LD1S1J8LCxygbLc7AHTNhdM+/4O0sv4P6WX9H9Jr6zm+swFIo+6s/wPdZP0f0muo5f4/mZb7f/2q5d5dIxHx64j4NNfT17zXF3AYZL/INHL/wrE/Dm1v7c18nywK9EbE829eef3GVKWyPFqr/3qzvvJGvb63G90HOpbk71jj0S9yAEi1jQc3p5vbZuXxg4/75b/qFyHsjH+ksTbZn3xGObiR2XKtQmafrl1YvxURp3aLn2nc77z+ycfgRm5H/JONx0z9KZL+Hknum/4o8e+902n80y3x/9AS/8wj/1QgHe7U5p+R3fI/m+R0bObf1vlnaJ+uj24//2U3579cm/nvbIcxnn3rxXtt49+KOLNr/Ga8/iTW9vi1vl3oMP79p574Xbu26tv159ktflOtlK8sLOXLq2sX5xamZguzhcXRiUuTkxMj42OT+WSNOt9cqd7pH6c+vrvX+AfbxN9r/LW6P3c4/h9+/9GT5/aI/6fzu7/+J/eIPxARf+kw/jdjnz/drq0Wf6bN+LPb47cs8NXqxjuMX37tP30dHgoAPAbl1bX5qWKxsKygoKCwWej2zAQctIdJ3+2eAAAAAAAAAAAAAJ16HJcTd3uMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACHwU8BAAD//zAx0oQ=") mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1021000, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) fdatasync(r7) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r6, &(0x7f00000000c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) fcntl$setpipe(r8, 0x407, 0x0) vmsplice(r8, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x1, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000200)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020d00bf050005001201", 0x2e}], 0x1}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r4, 0x0, 0xfffffffffffffffc}, 0x18) 33.844462554s ago: executing program 4 (id=373): r0 = syz_open_dev$usbfs(&(0x7f0000000240), 0xe, 0x101301) ioctl$USBDEVFS_IOCTL(r0, 0xc0105512, &(0x7f0000000200)) 33.72535893s ago: executing program 4 (id=375): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xfffffffc, 0xb, 0x0, 0xfffffffc, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000000f060104000009050001000700000090a49b5a725affe7b306000b0004000000"], 0x24}, 0x1, 0x0, 0x0, 0x20040800}, 0x40080) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0x0, 0xffffffffffffffff, 0x0, 0x31, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x140070, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x5, 0x9, 0x1}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x2, 0x3, 0x3}, 0x14}}, 0x20040000) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0a000000080000000100000040"], 0x48) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000240)={r7, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) fcntl$getflags(r3, 0x3) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, 0xffffffffffffffff, 0x0) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) syz_open_pts(r0, 0x0) r8 = syz_io_uring_setup(0x14dd, &(0x7f0000000300)={0x0, 0x5121, 0x0, 0x3, 0x258}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000080)=@IORING_OP_SYMLINKAT={0x26, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r8, 0x47ba, 0x0, 0x0, 0x0, 0x0) 32.803548639s ago: executing program 4 (id=379): ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2080}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xd4, r1, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x68, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xf800}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_virt_wifi\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_batadv\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x20, 0x800, 0x3, 0x400, 0xc00, 0x1, 0x5, '\x00', 0x0, r0, 0x1, 0x4}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x98, r4, 0x204, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x80, 0x23}}}}, [@NL80211_ATTR_CSA_IES={0x10, 0xb9, 0x0, 0x1, [@NL80211_ATTR_CSA_C_OFF_PRESP={0xc, 0xbb, [0x5, 0x7, 0x5, 0x6]}]}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x67}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16c1}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x86}]}, 0x98}, 0x1, 0x0, 0x0, 0x80c4}, 0x40) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), r0) sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x78, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x28, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffd}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xae}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3b94}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) sendmsg$IPVS_CMD_FLUSH(r0, 0xffffffffffffffff, 0x20040080) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x10, 0x1405, 0x1, 0x70bd28, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20004041}, 0x41000) pipe2$9p(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000740)={0x0, 0x3, 0x8a, 0x5788}) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000780), 0x20000) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r8, 0x40045402, &(0x7f00000007c0)) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000800)={0x0, r2, 0xf, 0x8, 0x1, 0x8}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000900)=0x0) r10 = perf_event_open(&(0x7f0000000880)={0x0, 0x80, 0xff, 0x2, 0x5, 0x4, 0x0, 0x6, 0x32040, 0x2, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfffffffc, 0x2, @perf_bp={&(0x7f0000000840), 0x2}, 0x104280, 0x3, 0x348, 0x3, 0x0, 0x4, 0xf, 0x0, 0x5, 0x0, 0xb}, r9, 0x5, 0xffffffffffffffff, 0xa) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000980)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(r7, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x28, r4, 0x300, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x21, 0x4c}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x60044) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r3, &(0x7f0000000a80)={0x50000010}) sync_file_range(r8, 0x6, 0xbbd, 0x4) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x10, 0x3fb, 0x20, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44080}, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c00)={0x8c, r1, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x3a, 0x21}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r12 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000d40)={0x0, @in6={{0xa, 0x4e20, 0x57, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xffffffff}}, 0x7fff, 0x9}, &(0x7f0000000e00)=0x90) setsockopt$inet_sctp_SCTP_MAXSEG(r12, 0x84, 0xd, &(0x7f0000000e40)=@assoc_id=r13, 0x4) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000e80)={0x0}, &(0x7f0000000ec0)=0xc) r15 = getpgrp(r9) tgkill(r14, r15, 0xb) 32.676394675s ago: executing program 5 (id=381): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8921, &(0x7f0000001f40)='lo:\x96o8\x14d\xa1\xe3\xd7\\b}\x1f\xa1Y\xad4\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\xf5\a\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xbaUn\x04\'5\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\x06\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\r\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc5\xdcZ\xb9\xd7Z\x88\x9b\xdff[\x90\xfa\x9a{b\xf4Dq') bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', 0xffffffffffffffff, 0x0, 0xffffffffffffffff}, 0x18) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x158, 0x11, 0x148, 0x0, 0x0, 0x230, 0x2a8, 0x2a8, 0x230, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x110, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x40, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x4, 0x18}}}, @common=@unspec=@limit={{0x48}, {0x5, 0x5, 0x4, 0x3, 0x9, 0x3, 0xfffffffffffffff8}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @multicast1, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x12, 0x9, 0x5, 0x1, 'netbios-ns\x00', 'syz0\x00', {0x4a7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) 32.57298734s ago: executing program 5 (id=383): bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x0, 0x0, &(0x7f0000000580)='GPL\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000001200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a30000000000800410073697700140033006c6f"], 0xffaf}, 0x1, 0x0, 0x0, 0x854}, 0x804) r1 = socket$can_bcm(0x1d, 0x2, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000001000000b703000000000080850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000240)='ext4_get_implied_cluster_alloc_exit\x00', r2}, 0x18) pipe2(&(0x7f0000000c40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) vmsplice(r4, 0x0, 0x0, 0xa) connect$can_bcm(r3, &(0x7f0000000140), 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYRES8=r1], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000980)=ANY=[@ANYBLOB="18000000000000000000000000000074d89ffe30b956a03db0ffbc1ad5fda6f384caf2ba2cbc944f9170e5c8b29d08e808bddf2fc68aa8792f888715e7e93430460b858caebbe60636a7a003441dec12954df906eaa6afd6f77b14f4cbbbb86c8ebe3293ed9a067e56a9c1921e22906209c405dc063ee53b4d0c22951e0d91ae6a51d33e3c56cdea9e7685e59a7c2f153da9ca6846d8d59af60c169e9fef7a4863a316f2793491ce9f612953e7b4579f483d04e38ffc15d2088fe62f05d98f6a38bf2e4a97f30c675de50d9170d0", @ANYBLOB="c60a9b822d1fccc877ec3affd829704726410a2c2927261339c870bd8286b83b23088f39ff49d53792b69f1d4939f73ee323d550adf9c0a731f7920da09fafe452ecd77f803bb4f00f444b9d699ae5a4511a63df8fd988d7b1996f479f95a56409e39d58852d392f7ec88689e82c08cd6a8b05c1611970c5ad6128dedb2b4e0e1be75f975c7874acfdb610a96a76e256ffa66965a95645c2ac37c10c", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0xd, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r6 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg$unix(r7, 0x0, 0x0, 0x211) recvmmsg(r7, &(0x7f00000000c0), 0x0, 0x2, 0x0) r8 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r6, &(0x7f0000000200)={0xe0000003}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) socket$unix(0x1, 0x1, 0x0) listxattr(&(0x7f00000001c0)='./file0\x00', &(0x7f0000002380)=""/4090, 0xffa) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r9, 0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, &(0x7f0000000800)=[{&(0x7f0000001880)}, {0x0}, {&(0x7f0000000680)="b0002c67e2bd45c03817be3720e7974e4401b44d5f4750c3d88bc27332cbef82a01e31b28af47652441ac22f51fa15cc591a5051495cbd7368f64dcdec47e28d9cb19266d31654c9b7e791c385ccb881f6aeabc9117b5a260c", 0x59}, {&(0x7f0000000780)}], 0x4) socket$nl_route(0x10, 0x3, 0x0) 32.468191894s ago: executing program 5 (id=384): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa1", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$inet(0x2, 0x5, 0x0) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000080)="441f0801000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) 32.360980589s ago: executing program 5 (id=386): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000027"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) recvmmsg(0xffffffffffffffff, &(0x7f0000005400)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=""/4084, 0xff4}}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000005100)=[{0x0}, {&(0x7f0000004f40)=""/101, 0x65}]}}], 0x3, 0x0, 0x0) r0 = socket(0x1e, 0x4, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0xfffffffc}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0700000004000000080000000c0f000036080100", @ANYRES32, @ANYBLOB="0100000000000000000000000000000100000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24, @ANYRES32, @ANYBLOB], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000030000850000001b000000b70000000000000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x18) syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x10840, &(0x7f00000001c0)=ANY=[@ANYBLOB='iocharset=utf8,shortname=winnt,shortname=win95\x00\x00ni_xlate=0,showexec,shortname=winnt,shortname=win95,nonumtairodir,nonumtail=0,shortname=mixed,nfs=nostale_ro,utf8=0,\x00'], 0x1, 0x26f, &(0x7f00000005c0)="$eJzs3cFqU1kYB/AvbTpJC0OyGCgzDMwdZjOr0HaYfcrQgWECM8yQha4sNkVpaqGFgi7a7orvoK+gS7eCC3HrC4ggVXBjXXUhROJtapImsdWmEf39Nv045/x7zsm93EsXPbn04+rK0trG8v7+XuTzmciWoxwHmSjGWIxHaicAgC/JQaMRrxqpUa8FADgf3v8A8PUZ9P7P7By1/Xv+KwMAhuWT/v4fG8qSAIAh+//Cxb/nK5WF/5IkH7G6u1ndrKY/0/755bga9ajFTBTiTUTjSFr/+VdlYSZpel6M/Or2WJrf3qyOd+ZnoxDF3vnZJBXVZq6Vn4ipw/yTqajFXBTiu975uZ75b+LXX9rmL0UhHl+OtajHUjSzaT4XEVuzSfLHP5WufO7dOAAAAAAAAAAAAAAAAAAAAAAAGIZScqTYef5Nen5PqdSvP823nw80Oeh8oMZ21/k62fghO9q9AwAAAAAAAAAAAAAAAAAAwOdi4/qNlcV6vbY+qLj26M6DvVwa+ODgwUXmcN6OrlZj39TuwN88ebJddBXf/vzsVq+uXORO+/l8XDHR3HFbS3I45f2fhjjpWRUP9658/9vG9O/9xkS2veXmsYvb50bKDusDf1mI6Dsm331Dnqq42yrKr4+Nad1KtfXJUV+46dvlxXtbT1+cNDXgodEYP+vHEAAAAAAAAAAAAAAAAAAA0PH/7aNeCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACMzvvv/z9tkYuOlnzfwTuj3iMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALwNAAD//w39kbE=") r4 = openat(0xffffffffffffff9c, 0x0, 0x183341, 0x0) ioctl$FS_IOC_RESVSP(r4, 0x40305828, 0x0) syz_genetlink_get_family_id$nl80211(0x0, r0) sendmsg$NL80211_CMD_SET_NOACK_MAP(r0, 0x0, 0x20008041) openat$cgroup_ro(r4, 0x0, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) rt_sigprocmask(0x0, 0x0, 0x0, 0x0) r6 = gettid() r7 = gettid() tkill(r6, 0x12) tkill(r6, 0x2d) tkill(r7, 0x14) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r5, 0x10e, 0xc, 0x0, 0x0) sendmsg$netlink(r5, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc, 0x1000, 0x2, 0x4}, 0x10) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x9200000000000000) r8 = dup3(r1, r0, 0x0) recvmmsg(r8, &(0x7f00000016c0)=[{{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f0000000040)=""/8, 0x8}, {&(0x7f0000000340)=""/149, 0x95}, {&(0x7f0000001940)=""/162, 0xa2}, {&(0x7f0000001580)=""/85, 0x55}, {&(0x7f00000014c0)=""/119, 0x71}, {&(0x7f0000001700)=""/180, 0xb4}, {&(0x7f00000017c0)=""/242, 0xf2}], 0x7, 0x0, 0xfffffffffffffee8}, 0xffffffff}], 0x1, 0x40000100, 0x0) 31.527061945s ago: executing program 5 (id=389): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000000)={0xfffffffc, 0xb, 0x0, 0xfffffffc, 0x7f, "db8f2d2b3b7596160c6981acf8805944823a7f"}) r1 = socket$tipc(0x1e, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_GET_BYINDEX(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="240000000f060104000009050001000700000090a49b5a725affe7b306000b0004000000"], 0x24}, 0x1, 0x0, 0x0, 0x20040800}, 0x40080) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0x0, 0xffffffffffffffff, 0x0, 0x31, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x140070, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x5, 0x9, 0x1}, 0x50) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, 0x2, 0x3, 0x3}, 0x14}}, 0x20040000) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000440)=@framed, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0a000000080000000100000040"], 0x48) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000240)={r7, 0x0, 0x0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000004c0)={r3, &(0x7f0000000340), &(0x7f00000005c0)=""/155}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) fcntl$getflags(r3, 0x3) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, 0xffffffffffffffff, 0x0) write$binfmt_aout(r0, &(0x7f0000000300)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) syz_open_pts(r0, 0x0) r8 = syz_io_uring_setup(0x14dd, &(0x7f0000000300)={0x0, 0x5121, 0x0, 0x3, 0x258}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000080)=@IORING_OP_SYMLINKAT={0x26, 0x4, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r8, 0x47ba, 0x0, 0x0, 0x0, 0x0) 30.926258421s ago: executing program 33 (id=229): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18060000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000400)='kfree\x00', r0}, 0x18) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f00000002c0)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[@mss, @sack_perm, @window={0x3, 0x7, 0xfffd}, @sack_perm, @window={0x3, 0x3, 0x401}, @window, @window={0x3, 0x108, 0x400}, @mss={0x2, 0x3}, @sack_perm, @mss, @window={0x3, 0x4, 0x7f}, @timestamp, @timestamp], 0xd) r2 = syz_clone(0x2b02000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000003000010850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000a80)='kfree\x00', r4, 0x0, 0x3}, 0x18) ptrace$pokeuser(0x6, r2, 0x388, 0x2590f58a) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xb, &(0x7f0000001140)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000010a850000000400000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r6}, 0x10) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r8, &(0x7f0000000e40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20040018}, 0x0) sendmsg$inet(r8, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0x1}], 0x1}, 0x880) recvmsg(r7, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000b80)=""/214, 0xd6}, {&(0x7f00000011c0)=""/4096, 0x1000}, {&(0x7f0000000580)=""/95, 0x5f}, {&(0x7f0000000500)=""/29, 0x1d}, {&(0x7f00000007c0)=""/83, 0x53}, {&(0x7f0000000600)=""/36, 0x24}, {&(0x7f00000006c0)=""/87, 0x57}], 0x7}, 0x40000041) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f0000000300)='kfree\x00', r5}, 0x18) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) fsopen(&(0x7f0000000140)='romfs\x00', 0x1) remap_file_pages(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0xffffffff998abe5f, 0x20000) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r10 = memfd_secret(0x80000) ioctl$sock_kcm_SIOCKCMATTACH(r10, 0x89e0, &(0x7f0000000280)={r9, r0}) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000004c0)=ANY=[@ANYRES32], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000003c0)='kfree\x00', r11}, 0x10) 30.614772594s ago: executing program 5 (id=391): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x61, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000240)='rxrpc_recvmsg\x00', r0, 0x0, 0x1}, 0x18) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x100) getpid() sched_setaffinity(0x0, 0x0, 0x0) syz_emit_ethernet(0x6e, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, r2, &(0x7f0000000340)={0xdd1, 0x9, 0x6, 0x5, 0x3, 0x8, 0x10, 0x5, 0x7c3}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 25.39478097s ago: executing program 6 (id=405): getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, &(0x7f00000006c0)) sendmsg$TIPC_NL_LINK_RESET_STATS(0xffffffffffffffff, 0x0, 0x80) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8400, 0x100) setsockopt$inet6_int(r1, 0x29, 0x1, &(0x7f0000000600)=0x5, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x5fef, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000020000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000340)='kfree\x00', r2, 0x0, 0x80000}, 0x18) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000500)={0x1c, r3, 0x10ada85e65c25359, 0xfffffffc, 0x25dfdbfd, {{0x6b}, {@val={0x8}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8441}, 0x4000000) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x2, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000680)={'pim6reg1\x00', 0x0}) bpf$TOKEN_CREATE(0x24, &(0x7f0000000800)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000b8ffffffb702000004000000b7030000000000de850000000400000095"], &(0x7f00000007c0)='syzkaller\x00', 0xfffffffd, 0x0, 0x0, 0x0, 0x2, '\x00', r5, @fallback=0x33, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffa}, 0x94) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f00000001c0)={'filter\x00', 0x5, 0x4, 0x3f0, 0x220, 0x0, 0x220, 0x220, 0x308, 0x308, 0x4, 0x0, {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @private, @empty}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @local, @private}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) 25.224233288s ago: executing program 6 (id=407): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000080000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = socket$inet(0x2, 0x5, 0x0) setsockopt$inet_opts(r2, 0x0, 0x4, &(0x7f0000000080)="441f0801000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) 25.110876683s ago: executing program 6 (id=408): symlinkat(&(0x7f0000001040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0xffffffffffffff9c, &(0x7f0000000640)='./file0\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x35, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[], &(0x7f0000000840)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x5, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_setup(0x30, &(0x7f0000000600)=0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101402) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000)="0136a531", 0x4}]) 25.045334625s ago: executing program 6 (id=409): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1b, 0x2000000000000016, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x18000, &(0x7f0000000000), 0x1, 0x632, &(0x7f0000001280)="$eJzs3c9rHNcdAPDvzEqyZauVXUqpTUsFPdhQvJZcU7c92e6hPhhqqA8h5GBhSY7w+geWDLZjsAw5JJBACLmG4Ev+gZBr0DXkFgKJbzkHnBCc5JAEb5jZWWuz2rU3kla78Xw+MDNvfmjf++7s2/dmZkcTQGlNZaM0Yl9EnEsiJlvWTURj5VSx3cOvb5/PhiTq9f9/lURSLGtu/6iY7s5GSeNvPj4Z8bvK+nyXbt66OFurN9yJOLx86erhpZu3Di1emr0wf2H+8syRfx49Nv2vmQ+3Js7dxfTU6f/96fWXX/zHwie1Q0kcj7OjL81FWxxbZarx7kYWYuvykYg4liU6vC+wnSrF53E0Iv4Qk1HJ5xomY/G1gRYO6Kt6pdE+1cfqQOkk0UwMuCDANmv2A5rH9v04Dh5mD05k4xsd4h8pjt535sdGux4mLUdG2dKIPVuQ/0pE/Hh7/9vZEF3OQ4xsQT5d878bEX/stP+TPP49eaRZ/GmkLX+XpaeLcxtZ+f6ziTIkLenePn93NpHbz/2S+Fv3Qxb/8WKaLT/Z5fWfdopnqm2+bPUPgMFYPVE05FlHJNbav6xn2Oz/RHv/p/5+fm2ove3aiO7tX7oFr/50ef9vpFP732zvd+ZteNrWD0ti5dsznV9ytH3B56+eerNb/lMt/b9syPJv9gV7sOmu4YO7Efvb4n8lf+uTx/s/6dD/zfp753rM47+ffnmq27pNxr9p9XsRBzoe/6z1SrNU2/XJJJrXJ4/OHF5YrM1PN8Yd8/jgoxfe7Zb/oOPP9v+uLvE/af9ny672mMd7Z+5daqR2rFs38dT40y/GkrN5aiwfr1WvseR0sUljcmN2efnakSeXpblNPp1pxH/wr53rf5f484OP8eZXZg+uPnfxYbd1m9z/j+o9bthNFv/cBvf/Gz3m8d3z1//cbd36+NfOSYxvNCgAAAAAAAAoqTS/Bpuk1cfpNK0WF95+H7vS2pWl5b8tXLl+eS7iYP57yNG0eaV7sjGfZPMzxe9hm/NH2ub/HhF7I+Ktyng+Xz1/pTY36OABAAAAAAAAAAAAAAAAAABgSOwu7v9/VDwP7JtKmlargy4VsG36+YA5YLip/1Beef3fnuetAUNG+w/l1bH++1KAUlDVobzUfygv9R/KS/2H8lL/oby61/91a+72uywAAAAAwJbZ+5fV+yMRsfLv8XzIjBXrRgdaMqDf1HEor8qgCwAMzOML/G7/h9Lpqf//ffHPAftfHGAAkpb0SjORdw7qT678q0nfywYAAAAAAAAAAAAANBzYt3o/cf8/lJLb/qC8Nnb/f2XjfwoMjU7/+t/jQKAcHONDyfVwEmBntxXu/wcAAAAAAAAAAACAbTORD0laLX4GPBFpWq1G/CYi9sRosrBYm5+OiN9GxGeV0R3Z/MygCw0AAAAAAAAAAAAAAAAAAADPmKWbty7O1mrz11oTP6xb8mwnmk88HZbytCYi6XsWabQtGY+IYYi9P4mRliVJxEq257filZPNf35iGN6fIjHgLyYAAAAAAAAAAAAAAAAAACihlnuPO9v/zjaXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC239rz//uXGHSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCv008BAAD//xS+O5U=") fsetxattr$security_capability(r0, &(0x7f0000000100), &(0x7f0000000140)=@v2={0x2000000, [{0x8, 0xd20}, {0xfffffff8, 0x1}]}, 0x14, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) cachestat(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x3, 0xc3bb) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff47}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00'}, 0x10) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0xe, 0x0) iopl(0x3) 24.982117308s ago: executing program 34 (id=326): io_setup(0x30, &(0x7f0000000600)=0x0) r1 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000002740), 0x101402) io_submit(r0, 0x1, &(0x7f0000000180)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000)="0136a531", 0x4}]) 24.326203587s ago: executing program 6 (id=415): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="1804000000000000000000000000000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xc94284a3061bb7fe, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r0, 0x0, 0xffffffffffffffff}, 0x18) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x158, 0x11, 0x148, 0x0, 0x0, 0x230, 0x2a8, 0x2a8, 0x230, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x110, 0x158, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x40, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x4, 0x18}}}, @common=@unspec=@limit={{0x48}, {0x5, 0x5, 0x4, 0x3, 0x9, 0x3, 0xfffffffffffffff8}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @multicast1, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x12, 0x9, 0x5, 0x1, 'netbios-ns\x00', 'syz0\x00', {0x4a7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) 23.382795407s ago: executing program 6 (id=420): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="07000000040000008000000004"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f00000000c0)='.\x00', 0xa4000061) read(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x0, 0x11, 0x148, 0x340, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fdb30dcb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x548) semctl$SETALL(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)=[0x3, 0x3bd1, 0x9, 0x1, 0xc2, 0x7, 0x7f]) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x10010, r0, 0xe8802000) r5 = socket$xdp(0x2c, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) bind$xdp(r5, &(0x7f0000000100)={0x2c, 0xe, r7, 0xfffffffe}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffc, '\x00', 0x0, 0x0}, 0x50) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000840000"], 0x0, 0xffffffff}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r12}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x10, 0xb, &(0x7f0000000f80)=ANY=[@ANYRES32, @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000e16ed6850000000c000000b70000000000000085100000020000018500000008000000950000000000000095000000000b5807c85cf3061241ccee2af47ca458e508f46b9bfff70c2237229859ea2f17b882de47bf74aad9ffbcc6f25210c3304fa7f2d2ce127339c757e61486dafefce46c700de56b17c4ee910ed64c1d8d6547f1c1f5574ad2b3987f57ffbaf7bff2ca4f46a1ee21b397ca121ea96cb5d0b46e22d5e8e0e15c0533aa1bc335d6ee0495acc42a00c5ce6aa8cb77d06b47c3975907d9544917093dc3a801a43c91ad552e19c1d66a41952e761a04ac068c327a323a593cd0ddc70f3436e3dbc20ef7ee18c421184e0bfe80a6d60edb8e5291a29f29b5fe5e7e6c8e8a338e4cb01c02ba9d1a2652"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0xa}, 0x94) syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./bus\x00', 0x4000, &(0x7f0000000500)=ANY=[@ANYRES32=r8, @ANYRES8=r11, @ANYRES32, @ANYRESHEX, @ANYRESDEC], 0x1, 0x2cb, &(0x7f0000000ac0)="$eJzs3c1qE1EUwPHTJjZpapssRFAQL7rRzVDjA2iQFsSAUpuiLoSpnWjImJSZUEkRm4249TmKS3eC+gLdiBv37ooguCkiXunMpJ2005CG5qP2/4MyJ3Puyb1tbsvJQKabD94+Lxddo2jWZDSpZFSkIVsime0oMBIcR714TMIacnXi17cL9x8+upPL52fmlJrNzV/PKqWmLn588fLdpc+1iYX3Ux8SspF5vPkz+31jbOPc5t/5ZyVXldzfulpTplqsVmvmom2ppZJbNpS6Z1uma6lSxbWclnzRri4v15VZWZpMLTuW6yqzUldlq65qVVVz6sp8apYqyjAMNZmSky3ewZjC+tycmfPCWERaR53EEBuPOuk4uUZ0srDehzUBAIAh077/93v9g/v//IJ/PEz/fzbU/6tKZP8vQv/fI42WR6H+P+x0HxeEnnOcnJkKfn9b0f8DAAAAAAAAAAAAAAAAAAAAAHAcbGmd1lqnt4/BKe9xQkSSIqKD/E5BJx8rx7ERfv116OvA1993Y0DLxRELfXAvKWK/WSmsFPyjn88VpSS2WDItafnj7YeAH8/ezs9MK09GPtlrQf3aSiEmiWZ9UyaqfiQu4j9Ba/0pSYXnz0pazkTPn1VR9WNy5XKo3pC0fHkiVbFlydvXu/Wvril1625+T/24Nw4AAAAAgP+BoXbse//u5b0BSdmf9+tD1we01mvtrg/seX8dl/NcSwQAAAAAoC/c+mrZtG3L6SJIiEh35SJdT9ou0FrkSJ+wqyAmg5z9oOCmiAzBMvoVJKW5x1Q35T/kUFtUdzAmLiID/7EcIhj0XyYAAAAAR82tr+7+g59OfX3do9UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAydXo/sOb4falmou3d/nbE+v4NAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEPkXwAAAP//AukZwg==") r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r13, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) sendmsg$nl_route(r14, 0x0, 0x0) 23.382372707s ago: executing program 35 (id=420): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="07000000040000008000000004"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r2}, 0x10) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f00000000c0)='.\x00', 0xa4000061) read(r3, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='.\x00', 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x8, 0x3, 0x4e8, 0x0, 0x11, 0x148, 0x340, 0x0, 0x450, 0x2a8, 0x2a8, 0x450, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xd0, 0x110, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}, {0x0, 0x0, 0x81}}]}, @common=@inet=@LOG={0x40, 'LOG\x00', 0x0, {0x4f, 0x7, "72f6daeff0a9c6294e211d2d88fe6dcff5d0e552201da3b7a1fdb30dcb59"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x548) semctl$SETALL(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000040)=[0x3, 0x3bd1, 0x9, 0x1, 0xc2, 0x7, 0x7f]) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x10010, r0, 0xe8802000) r5 = socket$xdp(0x2c, 0x3, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) bind$xdp(r5, &(0x7f0000000100)={0x2c, 0xe, r7, 0xfffffffe}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000001b000000b70000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffc, '\x00', 0x0, 0x0}, 0x50) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000000840000"], 0x0, 0xffffffff}, 0x94) r12 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000880)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r12}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x10, 0xb, &(0x7f0000000f80)=ANY=[@ANYRES32, @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000e16ed6850000000c000000b70000000000000085100000020000018500000008000000950000000000000095000000000b5807c85cf3061241ccee2af47ca458e508f46b9bfff70c2237229859ea2f17b882de47bf74aad9ffbcc6f25210c3304fa7f2d2ce127339c757e61486dafefce46c700de56b17c4ee910ed64c1d8d6547f1c1f5574ad2b3987f57ffbaf7bff2ca4f46a1ee21b397ca121ea96cb5d0b46e22d5e8e0e15c0533aa1bc335d6ee0495acc42a00c5ce6aa8cb77d06b47c3975907d9544917093dc3a801a43c91ad552e19c1d66a41952e761a04ac068c327a323a593cd0ddc70f3436e3dbc20ef7ee18c421184e0bfe80a6d60edb8e5291a29f29b5fe5e7e6c8e8a338e4cb01c02ba9d1a2652"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x41000, 0xa}, 0x94) syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./bus\x00', 0x4000, &(0x7f0000000500)=ANY=[@ANYRES32=r8, @ANYRES8=r11, @ANYRES32, @ANYRESHEX, @ANYRESDEC], 0x1, 0x2cb, &(0x7f0000000ac0)="$eJzs3c1qE1EUwPHTJjZpapssRFAQL7rRzVDjA2iQFsSAUpuiLoSpnWjImJSZUEkRm4249TmKS3eC+gLdiBv37ooguCkiXunMpJ2005CG5qP2/4MyJ3Puyb1tbsvJQKabD94+Lxddo2jWZDSpZFSkIVsime0oMBIcR714TMIacnXi17cL9x8+upPL52fmlJrNzV/PKqWmLn588fLdpc+1iYX3Ux8SspF5vPkz+31jbOPc5t/5ZyVXldzfulpTplqsVmvmom2ppZJbNpS6Z1uma6lSxbWclnzRri4v15VZWZpMLTuW6yqzUldlq65qVVVz6sp8apYqyjAMNZmSky3ewZjC+tycmfPCWERaR53EEBuPOuk4uUZ0srDehzUBAIAh077/93v9g/v//IJ/PEz/fzbU/6tKZP8vQv/fI42WR6H+P+x0HxeEnnOcnJkKfn9b0f8DAAAAAAAAAAAAAAAAAAAAAHAcbGmd1lqnt4/BKe9xQkSSIqKD/E5BJx8rx7ERfv116OvA1993Y0DLxRELfXAvKWK/WSmsFPyjn88VpSS2WDItafnj7YeAH8/ezs9MK09GPtlrQf3aSiEmiWZ9UyaqfiQu4j9Ba/0pSYXnz0pazkTPn1VR9WNy5XKo3pC0fHkiVbFlydvXu/Wvril1625+T/24Nw4AAAAAgP+BoXbse//u5b0BSdmf9+tD1we01mvtrg/seX8dl/NcSwQAAAAAoC/c+mrZtG3L6SJIiEh35SJdT9ou0FrkSJ+wqyAmg5z9oOCmiAzBMvoVJKW5x1Q35T/kUFtUdzAmLiID/7EcIhj0XyYAAAAAR82tr+7+g59OfX3do9UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHAydXo/sOb4falmou3d/nbE+v4NAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEPkXwAAAP//AukZwg==") r13 = socket$nl_route(0x10, 0x3, 0x0) r14 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r13, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) sendmsg$nl_route(r14, 0x0, 0x0) 17.762001641s ago: executing program 36 (id=379): ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DEST(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2080}, 0xc, &(0x7f00000001c0)={&(0x7f00000000c0)={0xd4, r1, 0x100, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x68, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xf800}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1\x00'}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth1_virt_wifi\x00'}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}]}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_batadv\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x4}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x2}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x80}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x20, 0x800, 0x3, 0x400, 0xc00, 0x1, 0x5, '\x00', 0x0, r0, 0x1, 0x4}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r3, &(0x7f0000000440)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x98, r4, 0x204, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x80, 0x23}}}}, [@NL80211_ATTR_CSA_IES={0x10, 0xb9, 0x0, 0x1, [@NL80211_ATTR_CSA_C_OFF_PRESP={0xc, 0xbb, [0x5, 0x7, 0x5, 0x6]}]}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x67}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x2}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0x2}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16c1}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x86}]}, 0x98}, 0x1, 0x0, 0x0, 0x80c4}, 0x40) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), r0) sendmsg$TIPC_NL_PUBL_GET(r0, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x78, r5, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x28, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffd}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xae}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_PUBL={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x1}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x3b94}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x80000001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_TYPE={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) sendmsg$IPVS_CMD_FLUSH(r0, 0xffffffffffffffff, 0x20040080) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x10, 0x1405, 0x1, 0x70bd28, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x20004041}, 0x41000) pipe2$9p(&(0x7f0000000700)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$FS_IOC_RESVSP(r6, 0x40305828, &(0x7f0000000740)={0x0, 0x3, 0x8a, 0x5788}) r8 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000780), 0x20000) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r8, 0x40045402, &(0x7f00000007c0)) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000800)={0x0, r2, 0xf, 0x8, 0x1, 0x8}) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000900)=0x0) r10 = perf_event_open(&(0x7f0000000880)={0x0, 0x80, 0xff, 0x2, 0x5, 0x4, 0x0, 0x6, 0x32040, 0x2, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0xfffffffc, 0x2, @perf_bp={&(0x7f0000000840), 0x2}, 0x104280, 0x3, 0x348, 0x3, 0x0, 0x4, 0xf, 0x0, 0x5, 0x0, 0xb}, r9, 0x5, 0xffffffffffffffff, 0xa) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000980)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_STOP_AP(r7, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x28, r4, 0x300, 0x70bd2b, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x21, 0x4c}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4}, 0x60044) epoll_ctl$EPOLL_CTL_ADD(r10, 0x1, r3, &(0x7f0000000a80)={0x50000010}) sync_file_range(r8, 0x6, 0xbbd, 0x4) sendmsg$AUDIT_GET_FEATURE(r0, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x10, 0x3fb, 0x20, 0x70bd26, 0x25dfdbfe, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x44080}, 0x0) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000d00)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c00)={0x8c, r1, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000000}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8000}, @IPVS_CMD_ATTR_SERVICE={0x30, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x3a, 0x21}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private0={0xfc, 0x0, '\x00', 0x1}}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x6}]}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r12 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000d40)={0x0, @in6={{0xa, 0x4e20, 0x57, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xffffffff}}, 0x7fff, 0x9}, &(0x7f0000000e00)=0x90) setsockopt$inet_sctp_SCTP_MAXSEG(r12, 0x84, 0xd, &(0x7f0000000e40)=@assoc_id=r13, 0x4) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000e80)={0x0}, &(0x7f0000000ec0)=0xc) r15 = getpgrp(r9) tgkill(r14, r15, 0xb) 15.310144877s ago: executing program 37 (id=391): socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8fe00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000001100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x61, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000240)='rxrpc_recvmsg\x00', r0, 0x0, 0x1}, 0x18) r1 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r1, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, 0x0, 0x0, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x100) getpid() sched_setaffinity(0x0, 0x0, 0x0) syz_emit_ethernet(0x6e, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_SETQUOTA(0xffffffff80000800, &(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, r2, &(0x7f0000000340)={0xdd1, 0x9, 0x6, 0x5, 0x3, 0x8, 0x10, 0x5, 0x7c3}) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 12.335310276s ago: executing program 0 (id=526): socket$kcm(0xf, 0x3, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1a3a700080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x8000}, 0x40) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1e000000000000000500000006"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='kfree\x00', r4}, 0x18) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000010007b0000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], &(0x7f0000000040)='GPL\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f0000000040)='kfree\x00', r5}, 0x18) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r6, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r9, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0xea, 0x0, 0x0, 0x1, 0x1009, 0x7f}, {0x12, 0x2, 0x0, 0x401, 0x8001}, 0x0, 0x5, 0x10000000}}, @TCA_TBF_BURST={0x8, 0x6, 0x8057}]}}]}, 0x60}}, 0x44080) recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) 11.451066574s ago: executing program 0 (id=542): syz_open_dev$usbfs(&(0x7f0000000240), 0xe, 0x101301) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r0, &(0x7f0000000b80), 0x0, 0x4008014, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000ff0f000007"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f0000001040)={'gre0\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f00, 0x0, 0x4, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x4, 0x2f, 0x0, @empty, @multicast1}}}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3800000013000500"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000100000000"], 0x38}}, 0x48000) r3 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000005c0)={r4, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000003b00000000000000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}}) 11.390894167s ago: executing program 0 (id=544): r0 = socket$l2tp(0x2, 0x2, 0x73) recvfrom$l2tp(r0, &(0x7f0000000740)=""/4096, 0x1000, 0x40000020, 0x0, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000700), 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x4058534c, &(0x7f00000000c0)={0x80, 0x0, {0x3, 0x2, 0x0, 0x2, 0xff}}) tkill(0x0, 0x7) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10) epoll_create1(0x0) 10.510577315s ago: executing program 0 (id=565): r0 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0xfffffdd6}], 0x1, 0x9c00, 0x0, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000400)=ANY=[@ANYRESHEX=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) openat$uhid(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xb, &(0x7f0000001f80)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002a20702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000083850000002d00000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000280)='kfree\x00', r3}, 0x18) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r5}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)={0x14, r2, 0x1, 0x2, 0x0, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x4008890}, 0x0) 9.881446622s ago: executing program 0 (id=576): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000001c0)=0x10) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000d40)=@filter={'filter\x00', 0x4, 0x4, 0x360, 0xffffffff, 0x0, 0xf0, 0x1c0, 0xfeffffff, 0xffffffff, 0x290, 0x290, 0x290, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xf0}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@private=0xa010101, 'vxcan1\x00'}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28}}, {{@ipv6={@private0, @loopback, [0xff, 0x0, 0xff000000], [0x0, 0xff, 0xff000000, 0xffffff00], 'team0\x00', 'batadv_slave_0\x00', {0xff}, {}, 0xff, 0xe7, 0x4, 0x44}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x9, 0x8, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c0) 9.730820079s ago: executing program 0 (id=578): r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/tcp\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f00000014c0)=""/223, 0xdf}], 0x1, 0x96, 0x0) write$tcp_mem(r0, &(0x7f0000000180)={0x1, 0x20, 0x3, 0x20, 0x28}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xb, &(0x7f0000000900)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xc, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000400)={0x14, 0x7a, 0x601, 0x70bd29, 0x0, "", [@nested={0x4, 0xcf}]}, 0x14}], 0x1}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00', r1, 0x0, 0x9}, 0x18) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000080000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000a3850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000001340)={&(0x7f0000000900)='kfree\x00', r3}, 0x18) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000001fc0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0xc2f00, 0x4d, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f0000000980)='mm_page_free\x00', r6}, 0x18) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0xc4000, 0x0) sendmsg$NL80211_CMD_DEAUTHENTICATE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x24, 0x0, 0xfc5, 0x0, 0x0, {{0x11}, {@val={0x8}, @void}}, [@NL80211_ATTR_IE={0x8, 0x2a, [@perr={0x84, 0xffffffffffffff21}]}]}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=@deltaction={0x54, 0x18, 0x1, 0x70bd2a, 0x25dfdc00, {0xa}, [@TCA_ACT_TAB={0x40, 0x1, [{0xc, 0xb, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x37}}, {0x10, 0x8, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) 2.439945674s ago: executing program 7 (id=666): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff00000000000000", @ANYRES32=0x1, @ANYBLOB="0000000000000003000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000002c0)={0xffffffffffffffff}, 0x13f, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r1, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000140)=0xff, r2, 0x0, 0x3, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xfffffffb, @private2, 0xffff}, {0xa, 0x4e21, 0x8, @private0, 0x5}, r2, 0x10}}, 0x48) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f00000001c0)={@local, 0x0}, &(0x7f0000000200)=0x14) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES16, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b7040000000000008500000057000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x200000c, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb01001800000000000000180018000000060000000000000001000001000000000400f9ffffffffffffff0000006100305f00"], &(0x7f0000000f40)=""/4079, 0x36, 0xfef, 0x8}, 0x28) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000380)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r5, &(0x7f0000000000)={0x13, 0x10, 0xfa00, {&(0x7f0000000180), r6, 0x1}}, 0x18) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r1, &(0x7f0000000300)={0x4, 0x8, 0xfa00, {r6, 0x6}}, 0x10) r7 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r7, 0x0) inotify_init1(0x0) unshare(0x8000400) pselect6(0x40, &(0x7f0000000240)={0x2, 0x0, 0x7, 0x3, 0x3, 0x0, 0x100, 0x5}, &(0x7f00000000c0)={0x1d, 0xfffffffffffffffe, 0x40, 0x7eff, 0x0, 0x1, 0x0, 0x8}, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r4}, 0xb) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet6_udp_SIOCINQ(r9, 0x541b, &(0x7f0000000280)) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000039000900000000000000000001000000040000000c0001800600000005470000080002"], 0x38}}, 0x0) 2.170236826s ago: executing program 7 (id=671): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0xb, 0x42718, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext={0xd07, 0x40}, 0x100b28, 0x6, 0x0, 0x1, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x44, 0x24, 0xd0f, 0x70bd2b, 0xfffffffc, {0x60, 0x0, 0x0, r3, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0xfffffffffffffe2d, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xfff, 0x40, 0x172}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x3000c81c) r4 = open(&(0x7f00009e1000)='./file0\x00', 0x8060, 0x0) fcntl$setlease(r4, 0x400, 0x0) open(&(0x7f0000000040)='./file0\x00', 0xc0200, 0x100) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x104) lsetxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180), &(0x7f0000006e00)=ANY=[], 0xe02, 0x1) 2.053517251s ago: executing program 7 (id=673): r0 = open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) pwritev2(r0, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0xfffffdd6}], 0x1, 0x9c00, 0x0, 0x3) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000400)=ANY=[@ANYRESHEX=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00'}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x7, &(0x7f0000000540)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000a80)='kfree\x00', r3}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)={0x14, 0x0, 0x1, 0x2, 0x0, {0x54}}, 0x14}, 0x1, 0x0, 0x0, 0x4008890}, 0x0) 1.839400481s ago: executing program 9 (id=679): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x14, 0x0, 0xfe, 0x0, 0x0, 0x2, 0x1c00}, [@RTA_DST={0x8, 0x1, {0x100}}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008001}, 0x4000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x8084) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000001000/0x4000)=nil) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) lsetxattr$security_selinux(&(0x7f0000000900)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000940), &(0x7f0000000980)='system_u:object_r:netutils_exec_t:s0\x00', 0xf, 0x0) 1.776161423s ago: executing program 9 (id=681): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000300)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1b, 0x2000000000000016, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x18000, &(0x7f0000000000), 0x1, 0x632, &(0x7f0000001280)="$eJzs3c9rHNcdAPDvzEqyZauVXUqpTUsFPdhQvJZcU7c92e6hPhhqqA8h5GBhSY7w+geWDLZjsAw5JJBACLmG4Ev+gZBr0DXkFgKJbzkHnBCc5JAEb5jZWWuz2rU3kla78Xw+MDNvfmjf++7s2/dmZkcTQGlNZaM0Yl9EnEsiJlvWTURj5VSx3cOvb5/PhiTq9f9/lURSLGtu/6iY7s5GSeNvPj4Z8bvK+nyXbt66OFurN9yJOLx86erhpZu3Di1emr0wf2H+8syRfx49Nv2vmQ+3Js7dxfTU6f/96fWXX/zHwie1Q0kcj7OjL81FWxxbZarx7kYWYuvykYg4liU6vC+wnSrF53E0Iv4Qk1HJ5xomY/G1gRYO6Kt6pdE+1cfqQOkk0UwMuCDANmv2A5rH9v04Dh5mD05k4xsd4h8pjt535sdGux4mLUdG2dKIPVuQ/0pE/Hh7/9vZEF3OQ4xsQT5d878bEX/stP+TPP49eaRZ/GmkLX+XpaeLcxtZ+f6ziTIkLenePn93NpHbz/2S+Fv3Qxb/8WKaLT/Z5fWfdopnqm2+bPUPgMFYPVE05FlHJNbav6xn2Oz/RHv/p/5+fm2ove3aiO7tX7oFr/50ef9vpFP732zvd+ZteNrWD0ti5dsznV9ytH3B56+eerNb/lMt/b9syPJv9gV7sOmu4YO7Efvb4n8lf+uTx/s/6dD/zfp753rM47+ffnmq27pNxr9p9XsRBzoe/6z1SrNU2/XJJJrXJ4/OHF5YrM1PN8Yd8/jgoxfe7Zb/oOPP9v+uLvE/af9ny672mMd7Z+5daqR2rFs38dT40y/GkrN5aiwfr1WvseR0sUljcmN2efnakSeXpblNPp1pxH/wr53rf5f484OP8eZXZg+uPnfxYbd1m9z/j+o9bthNFv/cBvf/Gz3m8d3z1//cbd36+NfOSYxvNCgAAAAAAAAoqTS/Bpuk1cfpNK0WF95+H7vS2pWl5b8tXLl+eS7iYP57yNG0eaV7sjGfZPMzxe9hm/NH2ub/HhF7I+Ktyng+Xz1/pTY36OABAAAAAAAAAAAAAAAAAABgSOwu7v9/VDwP7JtKmlargy4VsG36+YA5YLip/1Beef3fnuetAUNG+w/l1bH++1KAUlDVobzUfygv9R/KS/2H8lL/oby61/91a+72uywAAAAAwJbZ+5fV+yMRsfLv8XzIjBXrRgdaMqDf1HEor8qgCwAMzOML/G7/h9Lpqf//ffHPAftfHGAAkpb0SjORdw7qT678q0nfywYAAAAAAAAAAAAANBzYt3o/cf8/lJLb/qC8Nnb/f2XjfwoMjU7/+t/jQKAcHONDyfVwEmBntxXu/wcAAAAAAAAAAACAbTORD0laLX4GPBFpWq1G/CYi9sRosrBYm5+OiN9GxGeV0R3Z/MygCw0AAAAAAAAAAAAAAAAAAADPmKWbty7O1mrz11oTP6xb8mwnmk88HZbytCYi6XsWabQtGY+IYYi9P4mRliVJxEq257filZPNf35iGN6fIjHgLyYAAAAAAAAAAAAAAAAAACihlnuPO9v/zjaXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC239rz//uXGHSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCv008BAAD//xS+O5U=") fsetxattr$security_capability(r0, &(0x7f0000000100), &(0x7f0000000140)=@v2={0x2000000, [{0x8, 0xd20}, {0xfffffff8, 0x1}]}, 0x14, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) cachestat(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x3, 0xc3bb) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff47}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00'}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0xe, 0x0) iopl(0x3) 1.647663498s ago: executing program 7 (id=683): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd9b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB="01000000040200f2c8dc1b"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 1.483404546s ago: executing program 7 (id=685): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8000000}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0b00000007000000080000000800000005"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000100000000000000fe0018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000004c0)={r0, &(0x7f0000000400)="93265f96a398b14eeb0e4b72d997bfb1add2d32b944d6726368622b4fd60b28352e688e44a2f4766db2ccb5da453e4d690faafd5fcb6964b1dacdbf8e8cd45980171cf819db19ed077d8d2741f561608f86a17ca5e335437ca1fd670d6df74e86010c0eef18bda9d16b2e29f00e94c279ba6da7edfca4eea59ea7c4ccdadf9a153ade09c9af09f2f6e255891b4a79c0e34c68f211f2917", &(0x7f0000000540)=@buf="04e46db587a0842a85a3b30f499ccd752cd1d25472d7f2fe6a8615ad1205f60f4ee8213641955b22be209c07d3e3b43a4beab73dcaf15ff11d6664bda99b7405d5188762eb6522c0eb1e691846eafaae9fa9f7af9b725e37eed37bffb9308e8a6ee5df9c6c1d4f076efc5a3af2f01cc7728a3154ccb3f5f9a6839be665ca5591ef522039aab2c4baf0747e079e41", 0x4}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r0, &(0x7f0000000640)="3dc2a8b6d5973a622dc47d68b11c23393cc11357e9a20bb87a0d5f826557ae136f957cc58fe14b1f50ba323a4b9c4da2b6116e2f35a7ce63ad0ac0ad4fb1782ef4bc9e0c749247a35ff4a91af99645731f5d50b4293bd648de13cf6c831d3610f626e62ded3cc9a86ddabeeabca38156fb3dda57c779678b4777a5ced53ac8ac5edb00af0db2bcd78ba428135f216eca153a15db3d33352b02b0c456ec5931c4a3f09b4d8ca6889441771568791356b81152ff70e53cfe8e661fdcc519e1c953432d26056fa890e4a92a7807", &(0x7f0000000280)=@udp}, 0x20) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) semctl$IPC_INFO(0x0, 0x4, 0x3, &(0x7f0000001c00)=""/4096) r2 = syz_mount_image$ext4(&(0x7f00000000c0)='ext3\x00', &(0x7f0000000140)='./file0\x00', 0x0, &(0x7f0000000600)={[], [{@fowner_eq}]}, 0x2, 0x54c, &(0x7f0000000a00)="$eJzs3WFrJGcdAPD/TLK5vbvUbFXkLNgrXuWu6G0ujW2jSHuC6KuCWt+fIdkL4TbZI9nUSyia4gtfCiIq+AF8I/gBBOlHEKGg70VFEb3Tl9qR3Zm1SXb3NiSbznXz+8HcPs/MzvP/P0N2dnbmuZkAzq3nIuJ2RExFxAsRMVfMT4sp9vOp875HD99a6UxJZNkb/0giKeb12urUpyPicrFaNSK++bWIa2l/3O3dvXvLzWZjq6jPtzfuz2/v7t1c31hea6w1NhcXF15eemXppaVbWeFU/axFxKtf+ctPfviLr776m8995493/nbju518v/SJPO+IWDlVgCHytivdbdHT2UZbZxGsJJ3+VKbKzgIAgOPoHJp/NCI+3T3+n4up7tEcAAAAMEmy12bjP0lEBgAAAEysNCJmI0nrxViA2UjTej0fw/vxuJQ2W9vtz95t7WyudpZF1KKS3l1vNm4VY4VrUUk69YVijG2v/uKR+mJEPB0RP5672K3XV1rN1bJPfgAAAMA5cfnq4d///55Lu2UAAABgwtT6KtXScgEAAADORq3sBAAAAIAz5/c/AAAATLSvv/56Z8p6z/FefXN3517rzZurje179Y2dlfpKa+t+fa3VWuves29jVHvNVuv+52Nz58F8u7Hdnt/e3buz0drZbN9Z938KAAAAoCxPX33nD0lE7H/xYneK4j6Ao8yceWbAE+XPZScAjNNU2QkApZkuOwGgNJWR77CHgEmXjFjeP3gnP1cYvz2bfAAAgPG7/sn+6/+9a/ujzw0AH2bHGesDAEwWV/fg/KqcdATglXFnApTlI/nLhWHLh9684xjX//NzDFl2osQAAICxme1OSVovjtNnI03r9Yinuo8FqCR315uNW8Xvg9/PVS506gvdNZORY4YBAAAAAAAAAAAAAAAAAAAAAAAAgFyWJZEdVM2yWgYAAABMkoj0r0n3bv4R1+eenz18duDIU79+/sZPHyy321sLETPJP+c6s2Yiov2zYv6LmUcCAAAAwBMg/51evC6UnQ0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAk+bRw7dWetMHGffvX46IWsSj6TgSfzqq3ddqVCLi0r+SmD6wXhIRU2OIv/92RFwZ1P8k3suyrFZkMSj+xTOOX+tummqW5Ckcip9GxOUxxIfz7J3O/uf2oM9fGs91Xwd//qePfB5Pqrf/mynqB+P39n9TQ/Y/Tx2sp8NjPPPur+aHxn874pnpPO7tOLz/6cVP8vhJHIl/7Zh9/Pa39vYGLjjQ5KD938FY8+2N+/Pbu3s31zeW1xprjc3FxYWXl15Zemnp1vzd9Waj+HdgmB996tfvPa7/l4bErx3uf9/2f354l69e+H8xi/++++Dhx/JKZVD8G9cGf/9eGRI/Lb77PlOUO8uv98r7efmgZ3/5u2cf1//VIf2vjuj/jeH9P+gLL3zj+38auKRvawAAH4Tt3b17y81mY+sxheox3nO8Qu8g9dQNvjaefJ6gQjwZaZRVyL6X/2Wcrp1Trt5XyBo/OPnq0zGGNGb6PqdTcdIGk4j9TlvH/IM8zLE6AAB86L1/0J+UnQoAAAAAAAAAAAAAAAAAAACcWye8LVk1IvI5ldG3Ezsac7+crgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPNb/AgAA//90fsLg") r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) r4 = add_key$keyring(&(0x7f00000003c0), &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000000)='ceph\x00', 0x0, &(0x7f0000000080)="010000000037a788a11d1f000000000000006923c63a4541062101b60a2156566de77062086575a59ea9cb", 0x2b, r4) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000240)='\x00', &(0x7f00000002c0)='./file0\x00', r2) keyctl$search(0xa, r3, &(0x7f0000000180)='id_legacy\x00', &(0x7f00000001c0)={'syz', 0x2}, r4) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00'}, 0x18) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x45, 0xf}]}) syz_clone3(0x0, 0x0) listen(r5, 0xfffffff8) r6 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x2, @local}, 0x10) close_range(r5, 0xffffffffffffffff, 0x0) 1.222226047s ago: executing program 8 (id=686): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) readv(r0, &(0x7f0000000340)=[{&(0x7f0000000180)=""/58, 0x3a}], 0x1) 1.030511085s ago: executing program 8 (id=688): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1c1) mount(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x14010, 0x0) r0 = socket(0x11, 0x3, 0x0) connect$vsock_stream(r0, &(0x7f00000000c0)={0x28, 0x0, 0x2710, @local}, 0x10) getpeername$packet(r0, &(0x7f0000001040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001080)=0x14) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000200)=@filter={'filter\x00', 0xe, 0x4, 0x3c0, 0xffffffff, 0xf0, 0x240, 0xf0, 0xffffffff, 0xffffffff, 0x328, 0x328, 0x328, 0xffffffff, 0x4, &(0x7f0000000000), {[{{@ip={@broadcast, @loopback, 0xff, 0xffffffff, 'vlan1\x00', 'macvlan0\x00', {}, {}, 0x62, 0x2, 0x42}, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'veth0\x00', {0x63, 0x518, 0x7fff, 0x586b, 0x2, 0x200, 0xfffffffc, 0x78, 0x80}, {0x8000000000000001}}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0xf0, 0x150, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x4, 0x2, 0x2}}, @common=@ah={{0x30}, {[0x10001, 0x6]}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x0, 0x7, 0x2, 0x2, 0x1, 0x3]}, {0x2, [0x4, 0x1, 0x7, 0x1, 0x0, 0x3], 0x2}}}}, {{@ip={@remote, @empty, 0xff000000, 0x0, 'vlan1\x00', 'vcan0\x00', {}, {}, 0x29, 0x2, 0x8}, 0x0, 0xa0, 0xe8, 0x0, {}, [@common=@ah={{0x30}, {[0x1, 0x5]}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@multicast1, 'pim6reg1\x00', {0x8}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x420) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000004095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaa}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000008c0)='afs_cell\x00', r1}, 0x18) semget$private(0x0, 0x4, 0x29b) pwritev(r0, &(0x7f0000000880)=[{&(0x7f00000007c0)="cc935b0a0bf2211d99710cf6efd16540f6cd17ac8c323ee0d3fb4f72ec57efc997bde837783cf7861747470060bdf65de3a976935cb2d6819ca063291d9b8eb0f3354859dc0b682164e5cb00dd531741e3e8ecd4591b76e012d85e040c48196b129553b94b48f5b25cdbfd448021f10a1872c92914e6125fb75318ab76e4169bfcd50152c1940b89cf60a43816dab6054780d5fa814fda1064dc3830945dc7478f3209c0c393c858fc145e34794205", 0xaf}], 0x1, 0x6, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x4c, 0x2, 0x6, 0x801, 0xe4340000, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x4c}}, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)={0x5c, 0x9, 0x6, 0x801, 0x0, 0x0, {0x7}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x34, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @private0}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0xe1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x88}, @IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e1f}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90) sendmsg$IPSET_CMD_LIST(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x7, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20004080}, 0x48810) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000080)) recvmsg(r2, &(0x7f000000c1c0)={0x0, 0x0, 0x0}, 0x20) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000280)={0x1f, 0xffff, 0x3}, 0x6) io_setup(0x8f0, &(0x7f0000002400)=0x0) add_key(&(0x7f0000000480)='rxrpc\x00', &(0x7f00000004c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000006c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000700)={0x3c, r6, 0x10c, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x8, 0x65}}}}, [@NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x0, {0x0, 0x40, 0xd01, 0x2}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x65e3c7013af77711) io_submit(r5, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2002000000, 0x4, 0x0, 0x1, 0x0, r4, &(0x7f0000000040)="0200ffff0000", 0x6, 0x0, 0x0, 0x2}]) 949.455869ms ago: executing program 9 (id=689): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x4, 0xc8}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB], 0x50) syz_init_net_socket$nfc_raw(0x27, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x11, 0x18, 0x0, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='kfree\x00', r2}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x27, 0x1, 0x0, 0x0, 0x0, 0x7, 0x8604, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x1, @perf_bp={0x0, 0x2}, 0x0, 0x10000, 0x0, 0x6, 0x8, 0x20005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) sendmsg$NL80211_CMD_SET_TID_CONFIG(r4, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000300)={&(0x7f0000001500)={0x568, r5, 0x301, 0x70bd26, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xffff, 0x44}}}}, [@NL80211_ATTR_TID_CONFIG={0x15c, 0x11d, 0x0, 0x1, [{0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xd7}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x74}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xfffffffffffffffe}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x83}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x2}]}, {0xd4, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xf2}, @NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x3}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x8c, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xc5f1, 0x200, 0x3, 0x5, 0x3, 0x2, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7ff, 0x9, 0x800, 0x2c51, 0x8, 0x7f, 0x5800, 0x401]}}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x1, 0xc, 0x6c, 0x6, 0x5, 0x78, 0x6, 0xb, 0xb, 0x9, 0x4, 0x3, 0x2, 0x9, 0x5, 0x6c, 0x36, 0xb, 0x8]}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xfff8, 0x1, 0x1, 0x9, 0x3ff, 0xcd, 0x6]}}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x1, 0x2, 0x6, 0x6c, 0x3, 0x24, 0x24, 0x16, 0x12, 0x2, 0x1b, 0x30, 0x16, 0x60, 0xb, 0x1b, 0x0]}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}]}, {0x14, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x1}]}, {0x20, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x3ff}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}]}, @NL80211_ATTR_TID_CONFIG={0x8, 0x11d, 0x0, 0x1, [{0x4}]}, @NL80211_ATTR_TID_CONFIG={0x4}, @NL80211_ATTR_TID_CONFIG={0x198, 0x11d, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x5}]}, {0x8, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_OVERRIDE={0x4}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}]}, {0x50, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x91}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0x72}, @NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5, 0x9, 0x1}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xcf}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x2}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x38}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}]}, {0x80, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x3}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x9527}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5, 0xc, 0x2}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x4}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x200000000}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x34, 0xd, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x100, 0xaca, 0x7, 0xff7, 0x67f2, 0x7, 0x9, 0x2]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}]}, {0xa0, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x94, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x78, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x3, 0x8}, {0x0, 0x5}, {0x4, 0x6}, {0x5, 0xa}, {0x5}, {0x3, 0x8}, {0x2, 0x6}, {0x5, 0x2}, {0x0, 0x1}, {0x4, 0x6}, {0x7, 0x1}, {0x5, 0x2}, {0x5, 0x3}, {0x5, 0x4}, {0x6, 0x9}, {0x5, 0x1}, {0x7, 0xa}, {0x6, 0x3}, {0x3, 0x5}, {0x4, 0x4}, {0x1, 0x2}, {0x1, 0x2}, {0x1, 0x1}, {0x1}, {0x6, 0x6}, {}, {0x6, 0x4}, {0x2, 0x1}, {0x5, 0x5}, {0x7, 0xa}, {0x7, 0x6}, {0x0, 0x2}, {0x3, 0x4}, {0x5, 0x3}, {0x7, 0x1}, {0x5, 0x7}, {0x0, 0x4}, {0x2, 0x8}, {0x1, 0x1}, {0x2, 0x5}, {0x5, 0x5}, {0x7, 0x4}, {0x1, 0x9}, {0x2, 0x3}]}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x6c, 0x60, 0x48, 0x60, 0x16, 0x36, 0xc, 0x12, 0x1, 0x18, 0x9, 0x1b, 0x60, 0x48, 0x60, 0x1b, 0x2, 0x6c, 0x24, 0x5, 0x12, 0x6, 0xc, 0x36, 0x16, 0x1]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x101, 0x3, 0xe96, 0xfffe, 0x2, 0x8, 0x8, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x9, 0x0, 0x236d, 0x1, 0x5, 0x0, 0x8]}}]}]}]}]}, @NL80211_ATTR_TID_CONFIG={0x1d4, 0x11d, 0x0, 0x1, [{0x124, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x104, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x7c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0xd7ca, 0x7fff, 0xfffa, 0x0, 0x0, 0x8, 0x4]}}, @NL80211_TXRATE_LEGACY={0x9, 0x1, [0x5166964301436659, 0x60, 0x16, 0x48, 0x16]}, @NL80211_TXRATE_LEGACY={0x12, 0x1, [0x0, 0xb, 0x6c, 0x6, 0x9, 0x24, 0x3, 0x1, 0x1b, 0x60, 0x18, 0x6c, 0x586880f13f40918b, 0x60]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x1, 0x800, 0xc000, 0x4, 0x80, 0x6, 0x2]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3ff, 0x4, 0x2, 0x7fff, 0x7, 0xa, 0x3, 0x1000]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0xf0, 0x9c9e, 0x90, 0x4, 0xa, 0xb, 0x7ff]}}]}, @NL80211_BAND_60GHZ={0x4c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x20, 0x1, [0x36, 0x6, 0x1b, 0x16, 0x18, 0x16, 0x60, 0x5, 0x1, 0x12, 0x9, 0x30, 0xb, 0x16, 0x12, 0x48, 0x16, 0x1b, 0x24, 0x10, 0x3, 0x5, 0x1b, 0x48, 0x6, 0x3, 0x4, 0x9]}, @NL80211_TXRATE_LEGACY={0x16, 0x1, [0xc, 0x18, 0xc, 0x1, 0xc, 0x24, 0x6, 0x48, 0x16, 0x48, 0x48, 0xb, 0x30, 0x18, 0x1, 0x12, 0x1, 0x18]}]}, @NL80211_BAND_6GHZ={0x38, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x16]}, @NL80211_TXRATE_LEGACY={0x21, 0x1, [0x4, 0x6, 0x36, 0x12, 0x6c, 0x36, 0x0, 0xc, 0x2, 0xc, 0x74, 0xb, 0x24, 0x3, 0x9, 0x4, 0x58, 0x6c, 0x2, 0x18, 0x6475aabf69df7630, 0xc, 0x6, 0x2, 0xd, 0x48, 0x5, 0x3, 0x6]}]}]}, @NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x5}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xe9}]}, {0x4}, {0x3c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0xb7}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0x3e}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0x7}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0x4c}, @NL80211_TID_CONFIG_ATTR_TIDS={0x6, 0x5, 0xb2}]}, {0x6c, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_AMPDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x4}, @NL80211_TID_CONFIG_ATTR_TX_RATE={0x38, 0xd, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x34, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_LEGACY={0xb, 0x1, [0x2, 0x24, 0x70, 0x18, 0x0, 0x0, 0x6]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x424, 0xe, 0x2, 0x568, 0x1ff, 0x7ff, 0x144f]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_PEER_SUPP={0xc, 0x3, 0xfffffffffffffffe}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5}]}]}, @NL80211_ATTR_TID_CONFIG={0x74, 0x11d, 0x0, 0x1, [{0x54, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RETRY_LONG={0x5, 0x8, 0xe4}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc, 0x2, 0x7}, @NL80211_TID_CONFIG_ATTR_VIF_SUPP={0xc}, @NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}, @NL80211_TID_CONFIG_ATTR_RETRY_SHORT={0x5, 0x7, 0xed}, @NL80211_TID_CONFIG_ATTR_NOACK={0x5, 0x6, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL={0x5, 0xa, 0x1}]}, {0x10, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x4}, @NL80211_TID_CONFIG_ATTR_AMSDU_CTRL={0x5, 0xb, 0x1}]}]}]}, 0x568}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0xc020f509, &(0x7f0000000280)={r4, 0x7, 0x104, 0x7ff}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) sigaltstack(0x0, &(0x7f0000000640)={&(0x7f0000000480)=""/202, 0x0, 0xca}) r6 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) r7 = syz_io_uring_setup(0x2085, &(0x7f0000000380)={0x0, 0x86f7, 0x10000, 0x3, 0x188}, &(0x7f0000002000)=0x0, &(0x7f0000000440)=0x0) syz_io_uring_submit(r8, r9, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x22}) io_uring_enter(r7, 0x48e9, 0xf2bb, 0x2, 0x0, 0x0) ioctl$EVIOCGABS20(r6, 0x40044591, 0x0) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, 0x0, 0x880) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') 821.946215ms ago: executing program 2 (id=692): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x14, 0x0, 0xfe, 0x0, 0x0, 0x2, 0x1c00}, [@RTA_DST={0x8, 0x1, {0x100}}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008001}, 0x4000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x8084) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000001000/0x4000)=nil) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) lsetxattr$security_selinux(&(0x7f0000000900)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000940), &(0x7f0000000980)='system_u:object_r:netutils_exec_t:s0\x00', 0xf, 0x0) 758.698687ms ago: executing program 9 (id=693): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000008000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@mpls_delroute={0x24, 0x19, 0x1, 0x0, 0x0, {0x1c, 0x14, 0x14, 0x0, 0xfe, 0x0, 0x0, 0x2, 0x1c00}, [@RTA_DST={0x8, 0x1, {0x100}}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008001}, 0x4000000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r2}, 0x18) sendmsg$BATADV_CMD_GET_DAT_CACHE(0xffffffffffffffff, 0x0, 0x8084) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000001000/0x4000)=nil) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r4}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file1/file3\x00', 0x11e) renameat2(0xffffffffffffff9c, &(0x7f0000000400)='./file1/file3\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010100000000000000000a0000000900010073797a300000000048000000030a010200000000000000000a0000000900010073797a30000000000900030073797a3100000000080007006e617400140004800800014000000004080002"], 0x190}}, 0x0) socket$packet(0x11, 0x3, 0x300) lsetxattr$security_selinux(&(0x7f0000000900)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000940), &(0x7f0000000980)='system_u:object_r:netutils_exec_t:s0\x00', 0xf, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000c00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x9}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x3}]}, @NFT_MSG_DELCHAIN={0x1c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffc}]}], {0x14}}, 0x70}, 0x1, 0x0, 0x0, 0x400}, 0x8000) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00B\x00', @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000080000000c86edb87fdd0e59d46386b798f1adc66000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r7}, 0x18) close(0xffffffffffffffff) sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000640)={&(0x7f0000000500)={0x48, 0x0, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x39}}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_PORT={0x6, 0x1, 0x4e22}, @FOU_ATTR_PEER_V6={0x14, 0x9, @ipv4={'\x00', '\xff\xff', @broadcast}}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @local}]}, 0x48}, 0x1, 0x0, 0x0, 0x40081}, 0x20000880) r8 = syz_io_uring_setup(0xbc3, &(0x7f0000001480)={0x0, 0x124a, 0x80, 0x4, 0x1bd}, &(0x7f00000008c0)=0x0, &(0x7f0000000900)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r8, 0x47f8, 0x0, 0x0, 0x0, 0x0) 758.233597ms ago: executing program 2 (id=694): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000240)={'veth1_to_bridge\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) 730.299519ms ago: executing program 2 (id=695): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd9b, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r2}, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000580)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYBLOB="01000000040200f2c8dc1b"], 0x38}, 0x1, 0x0, 0x0, 0x20000844}, 0x0) 708.64518ms ago: executing program 9 (id=696): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x2, 0x3e0, 0x1f8, 0x2f8, 0x1f8, 0x1f8, 0x2f8, 0x2f8, 0x4, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28}}, {{@arp={@multicast2, @empty, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'vxcan1\x00', 'nr0\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac, @broadcast}}}, {{@arp={@remote, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg\x00', 'vcan0\x00'}, 0xc0, 0x100}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "dcbc4f0fcafe5fd600342efa7968d220b64d039e8a81d171eeb2e9630554"}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x430) 685.02109ms ago: executing program 2 (id=697): syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000bc0)='./file0\x00', 0x1a08404, &(0x7f0000000300)={[{@bh}, {@noblock_validity}]}, 0x1, 0xbb6, &(0x7f0000000c00)="$eJzs3M1rXOUaAPDnnEy+c5v0crn3tggGpCqK07QpFbpqXYsKunDZmExKyPTDJIIJXaR1ry5EXBSkf4Lg3m5cCS7qQutfUMQiRTdtFyNnPtIxk5nEZDLHpr8fvDnve96TeZ4nJ5nzHpiTAJ5ak9mXNOJIRJxPIsbr+9OIGKj2hiLWa8c9vH91NmtJVCpv/5ZEEhEP7l+dbbxWUt+O1gdDEXH7tST+/VFr3OXVtcWZcrm0VB8fX7l45fjy6torCxdnLpQulC6dmn711PTp6eku1nr3yntfPPPDG89fv/nx1JufH/ouibMxVp9rrqNbJmNy42fSrBARM90OlpO+ej3NdSaFHBMCAKCjtGkN998Yj754vHgbj29/zDU5AAAAoCsqfREVAAAA4IBL3P8DAADAAdf4HMCD+1dnGy3fTyT01r1zETFRq7/xfHNtphDr1e1Q9EfEyO9JND/WmtS+bc8ms0hff1/KWmz3HPJwFwJusn4tIv6/1flPqvVPVJ/ibq0/jYipLsSf3DTu9e/fXuo/24X4edcPwNPp1rnahaz1+pfW1j+DtdHm619hi2vXbuR9/Wus/x62rP/SjfVfX5v131s7jHH00Uu32801r//e/eTnuSx+tt1TUX/DvWsRRwtb1Z9s1J+0qf/8DmOMzt690W4uqz+rt9F6XX/lZsSx6mqutf6GpNP/Jzo+v1AuTdW+bvH6q6c7x28+/1nL4jfuBXohO/8jsbvzf2WHMSb+9+uRdnPb15/+MpC8U+0N1Pd8OLOysnQiYiB5vXX/yc65NI5pvEZW/4vPdf7736r+7D1hvf5zyH57rtW32fj6ppijx05+tfv691dW/9wuz/+nO4zx5Tc33m83l3f9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwZ0ogYiyQtbvTTtFiMGI2I/8RIWr68vPLy/OUPLs1lcxET0Z/OL5RLUxExXhsn2fhEtf94fHLTeDoiDkfEZ+PD1XFx9nJ5Lu/iAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2DAaEWORpMWISCPij/E0LRbzzgoAAADouom8EwAAAAD2nft/AAAAOPha7v8LfxkN9TIXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqTDz966k0TE+pnhassM1Of6c80M2G/pzg4b2e88gN7ryzsBIDeFpn6lUqnkmArQY+7xgWSb+aG2M4NdzwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAf64Xjty6k0TE+pnhassM1Of6c80M2G9p3gkAuenrNJlsuwN4ghXyTgDIjXt8oLayf1SpaZ0favudg3uOCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCTY6zakrQYEWm1n6bFYsS/ImIi+pP5hXJpKiIORcRP4/2D2fhE3kkDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQdcura4sz5XJpSUdHp4ud4ehZrOH6H3ObYwbbT3Xo5PzGBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABALpZX1xZnyuXS0nLemQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5W15dW5wpl0tL+9jJu0YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPLzZwAAAP//0L4Jug==") r0 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) bpf$PROG_LOAD(0x5, 0x0, 0x0) pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) ptrace(0x10, 0x0) ptrace$ARCH_SET_GS(0x1e, 0x0, 0x0, 0x1001) msgctl$IPC_SET(0x0, 0x1, &(0x7f0000000180)={{0x0, 0x0, 0x0, 0x0, 0xee00, 0x140, 0x3ff}, 0x0, 0x0, 0xffffffff, 0xc, 0x5, 0xc0e, 0x7, 0x4, 0x1, 0x1}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) r3 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000044c0)=0x0) stat(0x0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getgid() fsetxattr$security_selinux(r2, &(0x7f0000000240), &(0x7f00000002c0)='system_u:object_r:modules_dep_t:s0\x00', 0x23, 0x0) lchown(0x0, 0x0, r6) r7 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$PIO_UNIMAPCLR(r7, 0x4b68, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$caif_stream(0x25, 0x1, 0x4) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000004640)=[{{&(0x7f0000000880)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x8000}}, {{&(0x7f0000003a80)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000003ec0)=[{&(0x7f0000003b00)="1eccf6acf51ce3f5059f6a100437c8698454b978d6d49e68ce6a894b75fea009038992f1b9c6b41dddfcfeac38a9c4ae6eeb556dd443c01341d2daa8aa96cbd106125248ffc55e6b9e1e9d47afb5844df9d311857ae42fdea74455e2be4dcddc2ae21ee3781364be669b977bad952ef6e9b35bdc3248e45834903c5dcb7d6f374efc", 0x82}, {&(0x7f00000003c0)="49df1aa6bf043b3f6d7a600956af9c3cef9deb7996382895432205749842846110770733c425108089ee8b1350cda7425ecd403c4f971aa0e421913ab2bbbdd8e0e9550e98f75df02384cd3bd200d5b482c96687ef6f6bccd3da27505661055d253f2615274b4fbeb7c596b1aa2ceb4ee0bacd63e4d0b7ee485aba04f467fe9c676eb90bfa02458ce025eafead2fabeebc6d6418c660680891a9889f471db7a1a95c57d57059361ca67288f4f3788b46650efa07f0ef25ec5956f4e223711bc60ac5", 0xc2}, {&(0x7f0000003c80)="ad8c6e7b970cefe461a27305f0100d6c56199798936383e81babb568b521f39d40e356e432b8e55a711ccb6b9b0bbb558a30cae3c187f8cc03b7293e20520b369f997cd4a7200d3bc70f4c471f21e228d82f9661034644cf03513b597ab443412757b3600c26c014489c6f0b18d1e30d094ab5fd96115fac5c29fd1ad5fcf56e5afc833f670c0d5048396d25b87bf64fd00e48ab5e104ea02ccd953fd26619a8b8bbdc4a2cad51dc688df4d5c4d53e691a4581ff913d7de89a8dadfbd04b8a0daadef3665a934ca0", 0xc8}, {&(0x7f0000000c40)="095bc6829f02c7e246a3046af626cf18df99493df6be3bfa9390f1821bb5f319086910e4515c0bdcff31181f05a7c3c2e06213cb0a", 0x35}, {0x0}, {&(0x7f0000003dc0)="30cf70bdd46e249dad0e51e4e8c1be86a405ac7cd8ad0ca7790be3598f167afbb6", 0x21}, {&(0x7f0000000140)="35fa2be9b694bff1c5c7ee4576ec3c45f0c6851cae736332a9db59f158f4048858d1a1a2e1dc74f7496b1bc5a9a574b474060a1aee63521d1589df9948f5482816b6e5a859c75c17c3cb2abd88335663000000000000000000", 0x59}], 0x7, 0x0, 0x0, 0x804}}, {{&(0x7f0000003f40)=@abs={0x1, 0x0, 0x4e24}, 0x6e, &(0x7f0000004140)=[{&(0x7f00000000c0)="0d823f77e3b138553bfbdec1c5fff465f639607a8c77cc9457a605e41c7a0878d4dcb72c845c326136754544ced8ead1344ece0fc55f0d83fea2b18a51aed015", 0x40}, {&(0x7f0000004040)}, {&(0x7f0000004100)="0d990965ee85d72e16e1b8c8cb2e69200e8027539a9202bfb7663d51360390732fd3481341b0fa73a0ae645c423b5c534dc08f0f48a4", 0x36}], 0x3, &(0x7f0000002000)=ANY=[@ANYBLOB="1c0000000000000001000000", @ANYRES64, @ANYBLOB="799755ae53d9b66d851e4461acbeb488388fdd2cbdb57a279f8639bddb1c78415d62a5e752ce917db216de84d07ef3a96a6eb45c2fb4288ba49714ae2b9071096f34ae2b750045e0afec290129e977497e5ee7bfe57f571c895fd793aea52f80db1ade14df99b51337eee15b99cefccb3c40f519c71822b0718a243d23ad6ac6af1433471632e5a11727d9cebea04a4d7c0e2bdca5433dfd70c64c10f3fffa044a384dc24cc9c3e30dd0da30e12263325db1fa874054ce03aa906307d7b5aeed3126c7deeaa13ee626142e93da175b5baf87d7f4d629114097690fdd33242e5476d99a587c19943094071550ed73acdcd476dc7f2b9fafb5eae9a02e2c4a090ff0d0091627769347722fff7ec113aef19170e1a473cd19da689f452d35417060f9062d58966c71d4b2da9f7d3ba35051c83c5b198b790cc328b9a3b710bc8ff2076c56f0ded73dc9591a646f047c49838211b6394f142fc5fdb65fb6a5b603a97c7052bd1d544a7e9c5bad461de23336b7bcd2aed921082490b7e5a06f91be9e5ef9a5fdc98b4cb7bba9f9ff8a1b89d040ec81491be20930e77cfb26939b14c5d4988fd1a47498633864d3d8eca2ba4b6e765ec3646895cc90694fcfb4bedf491a52d6fe7c2fc0a86d2eddca62fda899691ef1c21c4a918dfe750dbf15f273674ba7cb714c89d21fa96c77568464f3f18684f6f0f79f730f2697386d90b9fb47a994a4a7a82b9a5f9bbab909254d5627b8a1785a3d0bea58ccc6659f6c09b9ac1eef3cf0abca8a3c1e2ba2159e1fa6bfce2b3b60241c4518fbed097624fcf7fc84c5315e4b44198620cc4f790909529859d06d412f906bc18f0f99faf0f0fac21ad8bf09130582b5e341180c755a3f3b38599d0f73987ce905d5188962952390985da4247d6a9eba3a6e3bb51e623b280c1355d5b2f117f14fd057248ffb24f804ef17f74a61c2b91c117d25100be59223bb587450fc9022c20ff8817d1c2295654d8a3e5c1a7bccbb72c5e99eb18a1b8a106c9e169fdf3232926b0077cdc458ae9c6507f401eca8b4d744cc5f5f40f075778471b5898642e6f57d6b567f683e29d44643b9ba8380e000c81a90f4eb58f9a41be4fb762e44effec290bfd43b884d7f8063fc7cf2116dfb5940b7c8646934f6e3121abd0a21a62e09d639cc731c986984b77ab94dda1f103df7ead0d8cc7361455dfdfbfa0370c1fa7bc31218436962e694b7c3d7def08f8d5b0e9fe18c33fc7c32d72ce0eb55296e4e4ee5bb384266b2337ce46d2ec3a453542db3e6ecccf4762f9e8a2dc674de264c72ae554395630433adf0bb700bb33f5ca1d87fa70abb29670b7a27c0707cc723db14b46103767875c99a7a2d7d6f561564b052da5237fc635f653e0c84a012347a5c50e915300e352963579bdc2c91f51c009d044430e681eafe32d325b0fed76773241488044828e54decbfa7b9ce6a0d10cad7b48797aaab4e8613e930d07dd86f3e06abcfa29813bc1e9b72ccc8248e676ea4a73f419cad8e09f1867bba6e322a2fb010ff67309becddb48e1e848e3a2dbdfaa18f597b57edc87372577eceb0e51882601708ed88975b95bd29cb20c91a39d0e4e2bd24a0a11ba4a4562efa64c74bff7c6fed28fc6269ff16f83e0d6df4a489647dc6d64fc1fc681ccd1b785024b06bb1fe52c274b7104e93c3572f55c446ae1302a433c419b14a80a4ae304c9b9b9a80cac53c6d8e300b0189883d7e1b4fedbba085eb0e45837f0396f9b8ab8841ea38f65c79cefe20787bc0563197b6855cfc6a05c0274054a66b345121f141f9a2f35c2730e3acb84ee4a2d50fe24c0648d0e07999257570afcea03b4b8630a530243fc5f4c4271b4186af196e2e638bc816186db937f2ef512eddcd3ff252c01c400d47369e9937bec9cb471ace721ba42894711cb9222fc3aa0b89da0da36be7cee7d21236da6da9733a710ec39c3e11267bfc0464b6dc4a947fba8af404a387506545baa092b289a0fd97e6c2c93080f5608208e50783102d20ce77d9e1113df2e835408f9d9b1b795ac4054828f124ccf65b4fbe6ebb800f8d3f1b416e07b010f9965bf69cf7a2d90effbccf2e28cf96fdfc9c694d79853470d7d722395491536dd301d07b74472456eb266c92740edfae25fa03fcc59457a10cc8dfedf91ac0009eb2b1e2b15f59aa90f2fa70e8045e1dc333ab0a6d28caacc6b12397ae09be485642349fa2ee1f25b69ffcd90bf76820a3255903339fe299e394cb7e4ca0f9244d971d8e8ecb7ebfd3e9408f56044c278f3135d06d5c6ec7a3ae8df387a3a971bd566aa6e1d77d787697ead87a1f6f66927e61bdee57d943b74a7d02a2eae1c9130fc183524e175ca448f263a94ac69202f248aa8339045a6cc911f27a417f5d901ef4c2bc122eb2ae09a597dbb2cc4b648d2d58100d73f72975ea60aa513bd4e4e4e7190378aadaae09367b3fec92ce1d36fd12409bf9080964841b2da43f8425f9fed34d907d727d44ccc7c2b80f194323c3cce390153fcf3b4b1dfd250d317199b2144a5858afd0628c269b0c1c643463cb622d320408dbdd8e960a68ce235a30c1db166eb253e944cc728469aa44346487b81fa58418de61283dc443edc4997124797bae5f38cb7b4b50db490bfee575d87135f900cfe1c52a3a324a60735872deed1f51ff43d786fb943c5784220ae2ccda56b078b8c3fdc790089f5f355b56a57cff7506f3b2e5ae09cbb8024f834b02b0d4802ce59c979ab27fea570ec8a08c7f694c054c743b3c2c97a2d5f07a4a402486661eb88dbcac107eaa9a9f5e9b689b028347e405ed112972d1cd37d9489ac36498f86465a30ed9028f52d788bec9b09ce09990eecc2eb49b2304c18c0b0182e37bb14cea5626de04b4a1455ad3c05fe75debd94517643c41ca1c698130086d955ae698ca12d094d7ac06b2c02bffc205064004c4aa0bb665a165cbbfc37e3b604adf892b0c7d2004d8d67e4604dffb0044fc703e4af49c4ca3f213bf9d6de90ed3506b01ab68446a9b4aaab196578ad18ea491c1db35133e906724a7037d4b16eafdc5f5fa1daa9dfaa0db653f816fc875d52e58bfd6d38771bf025ab55ad81be10eea877d64fbaac4dc50e7a0da907c5240ffcedd27f1b7cc11e73ffd71f9dcd814a8fb022ec4d040139247e4f122fc03de944f78952730ee102c1dbf5856f2dbc7ff2f83efb313549be1479acbed127bf59dad5706b724c92154cad1694ceaa03b055affbea8f51b8194df81cebd94122d60558fee0190d10006d2882cd16d5b54144e30780e8e7d9f004d68490ce63f3594a1008e0f80697a24e9be3d405efe0f496949c6395aa4258bc5be97ccccdebd5ccef7d340d914f21aa10ad1c38c1584cbab8968f1c259d564ac71b1b842678220ce8dd2045186007e0d7df984bcd6977f6e5071407c0cb3c25468de93bac83ee70ac16da213473fd540ecf7a1154d8db39080fd9a16743659737e2fd5877b1ad966d3cd4044b5c3c2c5bf120f897c2221c4f917593c174069591eea914bdb1ceb2ff6966a1c55631e7513bf47d375bca29117089dc68f236b83c23c58cbf9cf79e5de8dba6c15a31e2d494aa06e3e609234480a86a17bd7eaf55651d299efedb040972c554bcb0cfbde20a65424b3cabb1c01a06dab2b715fa13a232e54b5405a015f59eae05bb47849e82cada4dea49a37b0da909fd24102e3b26eda20f78ffe1597fd615d5e65b296c6407a477d2aa7b3f4d5d8f57a594cee6269b92077eec9e30fc6a9bbdec25694b5de461228ff4c339e22a9b05838c0a90d40fe8bfdda5c2a7a06d7e2e2d77386d3a43fde995169f388e1727aeac586da20e8f7e511bdccfe841d493e0987f5f6e1683da9d7e71b84ce1737db8e6074581d49e39e2d0de4fdfa0d55eaa43be76cd76a017b49a011e64ca13465bc30c85df68287bca8a4146268ea8f0f85917e20dd9b5839dae357f749d9377e48668bbf07d9c6f3ae3e2f6f5b3ac153b26217e867502dabae98e8b36f5bfc965f5e53dfcf42a25803481933b128d15bbc588e1efa91160a1cb46fdef1136c3e7b3dfc1215d63e28997c51f23e67fe5ac1270bd44cff587b5cfde9fdd43ff37ddef345336584d58c75dd7f37a1f666aaf6802bd41a33d714758c3df95b1e54265adf0fbfddc1c58648bda14dc1aea3132a7c227ee74d9efd9a4643a5f0b3617c086d9c311d9f701d9bf62060c7c9ba866c056790abe3740c69dd69566676dfa2146d3467a89aaaa42bf8b5a956d269bedb0d6df251a106ba35ad7c346f3b89619e6690504a6a24c9b930abd253efb47ca59270b5549897d54a5c34955f03000445df05fc4fb322d354b3492ac5891dec420a2b4ad117634316d0032986b576d9931cbc36d2f89b08c79ac7df49da7751fa7dd3669f17151814a6da303b4fee617e28db515b525c0fd996994d6bab7f82e2996a455db6447d892bb199fcc4097a32ab1c62251f9848680d3d8029298abf89dad265d9b9a9885630fa81d80fa2911b552266f848888c54d08e9c5245feb0dbd328f8ec8b65a32ae2f45128524d76542d5fd4edc16e968c985cdba35211c0e2ba04637297e7ed4842a915369fbe35dfb8f3cafa6404ecfa33c1791c1032be656a02e946efadd2a4782b53cb0082c1f79cb67b32502d039492d7f63b461e6b3811ec64f48a48be1b222433b4c6699f422b6c909d4c7da993165ab9b2a9420a8c3ad6e6658d5cf9ba6f381842fd65ac4cb7634894b5b59150facefe36db9f1b147b8893a0d473e4a9d88014807e3f3481c2dacae827d3bebc2908421acb5e74f2fd49b9ecb38b37f3308de327a32ac8e86d58721e24a9f3bbb99a0cd3be18bcdd4a9384b253ca46e050c0addc26c0e91ddcbaa2a77c12acd07063acaaa96a5ee9aa741cf70e53a540c4ae7fb0bf8479edd7e63dce2ab4ff207cd533b926ad0f9d5f01acd4463cca937696301a97cff0b327ee69e747245ccbc77a4b0b9d4ab4b50b8d0efed1787a79382c1c9770368d9d742adfab0b75f58f45c6ed026e13ad3e191b9dc8d14dc74ad837c7aa9cc326d9d443090364a7e4b43b83ebfc6e4cd5a4a9bc17741258e787fc6dc130924b5677c1a27e810f3288f16f188febabbb41b9baa9b5ea9a6feb3ecc2e3d39bf3d3d82a5cbd3fec49d2d1455abd40335fae4c6f2782f6280fc1d1af1be68461bd0a353f8f9986d0f86dfeb3c5a526d448f6cd314b82a898267bfc4bee221c24a97abd89a80667c4d5c91e1a82f09875477ba67f14259b9bd942752aaa09ffb990ae987c5fbcf6e541e2c3bda121a2b2f416613581d43f412a73d2ad115d1f8c3a1dfbbbac127cb6c8ea4d8d1f7c05aa55658ca868cc72390cf7b8cc549525aae2e650ad8718657865dcd4a07d57f6296201260c66d176b10af9fd88497ee4050e467da9eee085e3767da60a6b3db19bb5da5e1de38b5a1ea52ef275e51ba8bbba32b8e9874b67b79fe531a487689d16251b0c17aabe86d2ee1d6001dc3e4906e6db2dd6f36dc05179e047d15c36984572b754f6e09c05d4783b95038895f9a6dd43c103383157be029903474aa711188255cde29df5f26ca09414f23549c4fd2f1dc23365d4cdf3f13b8ba92bc18fd6165ac27612d203af032066a61bcaf87c689f97d42bb2b808c7b50505bedbb6b5a0dfde6d07fe882fa8b115cc8bd39bd55f72ad46ccb3c689d0663f7c5dee98f107f7e2a4e3e747b96b36ff4987ed3e61b8f743584283443363da0ecf071f3fbc50d180f7ef46895aa2b9e91f987853ee7100eea", @ANYRES32, @ANYBLOB="000000001400000000000000010000", @ANYRES32, @ANYBLOB="000000001c010000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c0000000000000001eaff00511342ca02000000", @ANYBLOB="179f6eace42f7cb8217eb7b785c13a09c7ea2310be26e316c5c7cc1a34dc66e7f531c7d82a407cb63f888d5908727b4cdc4505c566b26aa07daf94298622e12a3dd0abf49dff4138ad6f5220209321d9fc129f56a44a8df3711ede6bda5b70e3bbbe32a6c3c686edbfe5e997afa97a25818246921bd40f4c198d70e7bd349d6ea990d1eab92de1450a86b6e9c877e89dee503bf383cc57f9a647265926694776eb3b10e71da8198b16017159c74f16ff262c622f9111a50f76afebe6398cddfe601d997c5d2e443b45792977ec40a250c884b881fc1ba037f511cd302b8a55af0d34cb33857bb883", @ANYRES32=0x0, @ANYRES16=r3, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0000010000000000ffffffffffffff0000000000", @ANYRES32=r7, @ANYRES8=r4, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r8, @ANYBLOB="00000000280000000000000001000000010000", @ANYRES32=r9, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r2, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32], 0x110, 0x811}}], 0x3, 0x40001) r10 = getgid() r11 = getegid() lsetxattr$system_posix_acl(&(0x7f0000000080)='./file2\x00', &(0x7f0000000340)='system.posix_acl_default\x00', &(0x7f0000000b00)={{}, {0x1, 0x6}, [{0x2, 0x2, 0xee01}, {0x2, 0x6}, {}, {0x2, 0x7}, {0x2, 0x7, 0xee00}, {0x2, 0x5}, {0x2, 0x1, 0xee01}], {0x4, 0x2}, [{0x8, 0x2}, {0x8, 0x2}, {0x8, 0x6}, {0x8, 0x1, r6}, {0x8, 0x2, r10}, {0x8, 0x4, 0xee00}, {0x8, 0x4, r11}], {0x10, 0x2}, {0x20, 0x4}}, 0x94, 0xebab338399109ecf) r12 = open(&(0x7f0000000400)='./file2\x00', 0x145142, 0xa1) sendfile(r12, r12, 0x0, 0x800000009) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 672.645311ms ago: executing program 8 (id=698): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000040000000c"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000880)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000080000000c"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002300000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000180)='kfree\x00', r5, 0x0, 0x5}, 0x18) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a31000000002c0003800800014000000000180003801400010076657468315f746f5f626f6e6400000008000240000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e657665300000000000000000001400010076657468315f746f5f626f6e64000000080002"], 0x10c}}, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r3, 0x8934, &(0x7f0000000000)={'veth0_macvtap\x00', 0x1ff}) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000000)={@cgroup, 0xffffffffffffffff, 0x22, 0x1}, 0x20) readv(r2, &(0x7f0000000340)=[{&(0x7f0000000180)=""/58, 0x3a}], 0x1) 642.147772ms ago: executing program 9 (id=699): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000300)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x3, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1b, 0x2000000000000016, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x18000, &(0x7f0000000000), 0x1, 0x632, &(0x7f0000001280)="$eJzs3c9rHNcdAPDvzEqyZauVXUqpTUsFPdhQvJZcU7c92e6hPhhqqA8h5GBhSY7w+geWDLZjsAw5JJBACLmG4Ev+gZBr0DXkFgKJbzkHnBCc5JAEb5jZWWuz2rU3kla78Xw+MDNvfmjf++7s2/dmZkcTQGlNZaM0Yl9EnEsiJlvWTURj5VSx3cOvb5/PhiTq9f9/lURSLGtu/6iY7s5GSeNvPj4Z8bvK+nyXbt66OFurN9yJOLx86erhpZu3Di1emr0wf2H+8syRfx49Nv2vmQ+3Js7dxfTU6f/96fWXX/zHwie1Q0kcj7OjL81FWxxbZarx7kYWYuvykYg4liU6vC+wnSrF53E0Iv4Qk1HJ5xomY/G1gRYO6Kt6pdE+1cfqQOkk0UwMuCDANmv2A5rH9v04Dh5mD05k4xsd4h8pjt535sdGux4mLUdG2dKIPVuQ/0pE/Hh7/9vZEF3OQ4xsQT5d878bEX/stP+TPP49eaRZ/GmkLX+XpaeLcxtZ+f6ziTIkLenePn93NpHbz/2S+Fv3Qxb/8WKaLT/Z5fWfdopnqm2+bPUPgMFYPVE05FlHJNbav6xn2Oz/RHv/p/5+fm2ove3aiO7tX7oFr/50ef9vpFP732zvd+ZteNrWD0ti5dsznV9ytH3B56+eerNb/lMt/b9syPJv9gV7sOmu4YO7Efvb4n8lf+uTx/s/6dD/zfp753rM47+ffnmq27pNxr9p9XsRBzoe/6z1SrNU2/XJJJrXJ4/OHF5YrM1PN8Yd8/jgoxfe7Zb/oOPP9v+uLvE/af9ny672mMd7Z+5daqR2rFs38dT40y/GkrN5aiwfr1WvseR0sUljcmN2efnakSeXpblNPp1pxH/wr53rf5f484OP8eZXZg+uPnfxYbd1m9z/j+o9bthNFv/cBvf/Gz3m8d3z1//cbd36+NfOSYxvNCgAAAAAAAAoqTS/Bpuk1cfpNK0WF95+H7vS2pWl5b8tXLl+eS7iYP57yNG0eaV7sjGfZPMzxe9hm/NH2ub/HhF7I+Ktyng+Xz1/pTY36OABAAAAAAAAAAAAAAAAAABgSOwu7v9/VDwP7JtKmlargy4VsG36+YA5YLip/1Beef3fnuetAUNG+w/l1bH++1KAUlDVobzUfygv9R/KS/2H8lL/oby61/91a+72uywAAAAAwJbZ+5fV+yMRsfLv8XzIjBXrRgdaMqDf1HEor8qgCwAMzOML/G7/h9Lpqf//ffHPAftfHGAAkpb0SjORdw7qT678q0nfywYAAAAAAAAAAAAANBzYt3o/cf8/lJLb/qC8Nnb/f2XjfwoMjU7/+t/jQKAcHONDyfVwEmBntxXu/wcAAAAAAAAAAACAbTORD0laLX4GPBFpWq1G/CYi9sRosrBYm5+OiN9GxGeV0R3Z/MygCw0AAAAAAAAAAAAAAAAAAADPmKWbty7O1mrz11oTP6xb8mwnmk88HZbytCYi6XsWabQtGY+IYYi9P4mRliVJxEq257filZPNf35iGN6fIjHgLyYAAAAAAAAAAAAAAAAAACihlnuPO9v/zjaXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC239rz//uXGHSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCv008BAAD//xS+O5U=") fsetxattr$security_capability(r0, &(0x7f0000000100), &(0x7f0000000140)=@v2={0x2000000, [{0x8, 0xd20}, {0xfffffff8, 0x1}]}, 0x14, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) cachestat(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x3, 0xc3bb) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff47}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00'}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0xe, 0x0) iopl(0x3) 614.076723ms ago: executing program 7 (id=700): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xc, &(0x7f0000000300)=ANY=[], 0x0, 0x3, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x18, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1b, 0x2000000000000016, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000001600000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f00000005c0)='./file1\x00', 0x18000, &(0x7f0000000000), 0x1, 0x632, &(0x7f0000001280)="$eJzs3c9rHNcdAPDvzEqyZauVXUqpTUsFPdhQvJZcU7c92e6hPhhqqA8h5GBhSY7w+geWDLZjsAw5JJBACLmG4Ev+gZBr0DXkFgKJbzkHnBCc5JAEb5jZWWuz2rU3kla78Xw+MDNvfmjf++7s2/dmZkcTQGlNZaM0Yl9EnEsiJlvWTURj5VSx3cOvb5/PhiTq9f9/lURSLGtu/6iY7s5GSeNvPj4Z8bvK+nyXbt66OFurN9yJOLx86erhpZu3Di1emr0wf2H+8syRfx49Nv2vmQ+3Js7dxfTU6f/96fWXX/zHwie1Q0kcj7OjL81FWxxbZarx7kYWYuvykYg4liU6vC+wnSrF53E0Iv4Qk1HJ5xomY/G1gRYO6Kt6pdE+1cfqQOkk0UwMuCDANmv2A5rH9v04Dh5mD05k4xsd4h8pjt535sdGux4mLUdG2dKIPVuQ/0pE/Hh7/9vZEF3OQ4xsQT5d878bEX/stP+TPP49eaRZ/GmkLX+XpaeLcxtZ+f6ziTIkLenePn93NpHbz/2S+Fv3Qxb/8WKaLT/Z5fWfdopnqm2+bPUPgMFYPVE05FlHJNbav6xn2Oz/RHv/p/5+fm2ove3aiO7tX7oFr/50ef9vpFP732zvd+ZteNrWD0ti5dsznV9ytH3B56+eerNb/lMt/b9syPJv9gV7sOmu4YO7Efvb4n8lf+uTx/s/6dD/zfp753rM47+ffnmq27pNxr9p9XsRBzoe/6z1SrNU2/XJJJrXJ4/OHF5YrM1PN8Yd8/jgoxfe7Zb/oOPP9v+uLvE/af9ny672mMd7Z+5daqR2rFs38dT40y/GkrN5aiwfr1WvseR0sUljcmN2efnakSeXpblNPp1pxH/wr53rf5f484OP8eZXZg+uPnfxYbd1m9z/j+o9bthNFv/cBvf/Gz3m8d3z1//cbd36+NfOSYxvNCgAAAAAAAAoqTS/Bpuk1cfpNK0WF95+H7vS2pWl5b8tXLl+eS7iYP57yNG0eaV7sjGfZPMzxe9hm/NH2ub/HhF7I+Ktyng+Xz1/pTY36OABAAAAAAAAAAAAAAAAAABgSOwu7v9/VDwP7JtKmlargy4VsG36+YA5YLip/1Beef3fnuetAUNG+w/l1bH++1KAUlDVobzUfygv9R/KS/2H8lL/oby61/91a+72uywAAAAAwJbZ+5fV+yMRsfLv8XzIjBXrRgdaMqDf1HEor8qgCwAMzOML/G7/h9Lpqf//ffHPAftfHGAAkpb0SjORdw7qT678q0nfywYAAAAAAAAAAAAANBzYt3o/cf8/lJLb/qC8Nnb/f2XjfwoMjU7/+t/jQKAcHONDyfVwEmBntxXu/wcAAAAAAAAAAACAbTORD0laLX4GPBFpWq1G/CYi9sRosrBYm5+OiN9GxGeV0R3Z/MygCw0AAAAAAAAAAAAAAAAAAADPmKWbty7O1mrz11oTP6xb8mwnmk88HZbytCYi6XsWabQtGY+IYYi9P4mRliVJxEq257filZPNf35iGN6fIjHgLyYAAAAAAAAAAAAAAAAAACihlnuPO9v/zjaXCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC239rz//uXGHSMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMCv008BAAD//xS+O5U=") fsetxattr$security_capability(r0, &(0x7f0000000100), &(0x7f0000000140)=@v2={0x2000000, [{0x8, 0xd20}, {0xfffffff8, 0x1}]}, 0x14, 0x2) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) cachestat(0xffffffffffffffff, 0x0, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x3, 0xc3bb) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) write$cgroup_pid(0xffffffffffffffff, &(0x7f00000001c0), 0x12) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff47}, 0x90) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00'}, 0x10) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0xe, 0x0) iopl(0x3) 534.929857ms ago: executing program 8 (id=701): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000a99985000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r0}, 0x18) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000640)={0x14, 0x3, 0x6, 0x401, 0x0, 0x0, {0x7, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$batadv(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000540)={'syztnl2\x00', &(0x7f00000004c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x9, 0x81, 0xfffffff9, 0x20, @private0, @mcast1, 0x8000, 0x7, 0x8000, 0x8e1}}) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000240)="b9ff0307600300ffff9e08f086dd", 0x0, 0xfd, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x74, r5, {0x9}, {}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x8881}, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r6, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x0, 0x300, 0x300, 0x8, 0x300}}) pipe2(&(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000cc0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r7, @ANYBLOB=',wfdno=', @ANYRESHEX=r8, @ANYBLOB="2c756e616d653dd0"]) 316.846536ms ago: executing program 8 (id=702): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r1, 0x0, 0x400007}, 0x18) r2 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) writev(r2, &(0x7f0000000080)=[{&(0x7f00000000c0)="01000000c00000005a90f57f07703aefe7364ebbee07022c2277ae2a00"/42, 0xff9c}, {&(0x7f0000000040)="aa1d484ea0000000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41cfbf0e9d85e44", 0x2b}], 0x2) 189.609872ms ago: executing program 2 (id=703): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000080)="aefdda9d240103005a90f57f02703aeff0f64eb9ee07962c220852f426072a00"/42, 0x2a}], 0x1) readv(r0, &(0x7f0000000340)=[{&(0x7f0000000180)=""/58, 0x3a}], 0x1) 143.130263ms ago: executing program 8 (id=704): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000010c0)=ANY=[@ANYBLOB], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) open(&(0x7f0000000040)='./file0\x00', 0xc0200, 0x100) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000140)='./file1\x00', 0x200000, &(0x7f0000000480)={[{@resgid}, {}, {@data_err_ignore}, {@nobarrier}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@orlov}, {@nogrpid}, {@nombcache}, {@stripe={'stripe', 0x3d, 0x2}}]}, 0x3, 0x572, &(0x7f0000000c40)="$eJzs3c9rHFUcAPDvbJL+1qZQinqQQA9WajdN4o8KQutRtFjQe12SaSjZdEt2U5pYaHuwIF6kCCIWxD/Au8fiH6B/RUELRUrQg5fIbGbbbZLNJunWbJ3PB6Z9b2ayb96++b79zs4uG0BhjWT/lCJejoivk4iDbdsGI984srLf0sNrk9mSxPLyJ38mkeTrWvsn+f/788pLEfHLFxHHS2vbrS8szlSq1XQur482Zi+P1hcWT1ycrUyn0+ml8YmJU29NjL/7zts96+vr5/7+7uO7H5z66ujStz/dP3Q7iTNxIN/W3o+ncKO9MhIj+XMyFGdW7TjWg8b6SbLTB8C2DORxPhTZHHAwBvKoB/7/rkfEMlBQifiHgmrlAa1r+x5dBz83Hry/cgG0tv+DK++NxJ7mtdG+peSJK6Psene4B+1nbfz8x53b2RJd3oe43oP2AFpu3IyIk4ODa+e/JJ//tu9k883jja1uo2ivP7CT7mb5zxvr5T+lR/lPrJP/7F8ndreje/yX7vegmY6y/O+9dfPfR1PX8EBee6GZ8w0lFy5W05MR8WJEHIuh3Vl9o/s5p5buLXfa1p7/ZUvWfisXzI/j/uDuJ/9mqtKoPE2f2z24GfHK4/w3iTXz/55mrrt6/LPn41xW+PXLrm0cSe+82mlb9/63630GvPxjxGvrjv/jO1rJxvcnR5vnw2jrrFjrr1tHfuvU/tb633vZ+O/buP/DSfv92vrW2/hhzz9pp23bPf93JZ82y7vydVcrjcbcWMSu5KO168cf/22r3to/6/+xoxvPf+ud/3sj4rNN9v/W4Vsdd+2H8Z/a0vhvvXDvw8+/79T+5sb/zWbpWL5mM/PfZg/waZ47AAAAAAAA6DeliDgQSan8qFwqlcsrn+84HPtK1Vq9cfxCbf7SVDS/KzscQ6XWne6DbZ+HGMs/D9uqj6+qT0TEoYj4ZmBvs16erFWndrrzAAAAAAAAAAAAAAAAAAAA0Cf2d/j+f+b3gZ0+OuCZ85PfUFxd478Xv/QE9CWv/1Bc4h+KS/xDcYl/KC7xD8Ul/qG4xD8Ul/gHAAAAAAAAAAAAAAAAAAAAAAAAAACAnjp39my2LC89vDaZ1aeuLMzP1K6cmErrM+XZ+cnyZG3ucnm6VpuupuXJ2my3x6vWapfHxmP+6mgjrTdG6wuL52dr85ca5y/OVqbT8+nQf9IrAAAAAAAAAAAAAAAAAAAAeL7UFxZnKtVqOqfQsXA6+uIwtl1Iuo3y6fxk2NIjR14Y3PkOKjyDwg5PTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQ5t8AAAD//8nLNLM=") r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x441, 0x104) fallocate(r2, 0x0, 0x3, 0x800000) lsetxattr$trusted_overlay_upper(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180), &(0x7f0000006e00)=ANY=[], 0xe02, 0x1) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) 0s ago: executing program 2 (id=705): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0xb, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={0x0, r0}, 0x18) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'syztnl1\x00', &(0x7f0000000c00)={'ip6gre0\x00', 0x0, 0x29, 0x0, 0x2, 0x5, 0x59, @loopback, @loopback, 0x700, 0xb6, 0x1, 0x9}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00', 0x0}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000280)={@remote, r3}, 0x14) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r3, {0xfff1, 0x10}, {0x8, 0x4}, {0x6, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x8804) getsockopt$inet6_mreq(r0, 0x29, 0x0, &(0x7f0000000380)={@private0}, &(0x7f0000000480)=0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000240)={0xffffffffffffffff, 0x58, &(0x7f0000000880)}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000680)={'syztnl2\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x2f, 0x9, 0xa2, 0x5e6, 0x10, @mcast2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10, 0x7800, 0x2, 0x3}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000006c0)={'ip6tnl0\x00', &(0x7f0000000740)={'syztnl0\x00', 0x0, 0x29, 0x4, 0x50, 0x3, 0x10, @local, @empty, 0x7, 0x7800, 0xffff8001, 0x800}}) r4 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'geneve1\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f00000005c0)={@empty, @remote, @remote, 0x6, 0x2, 0x0, 0x0, 0xb7, 0x2000213, r5}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000840)={'syztnl0\x00', &(0x7f00000007c0)={'syztnl1\x00', 0x0, 0x29, 0x8, 0x2, 0x0, 0x20, @mcast2, @empty, 0x8000, 0x10, 0xe, 0x1}}) sendmsg$ETHTOOL_MSG_WOL_GET(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000a40)={&(0x7f0000000ec0)=ANY=[], 0x1d8}, 0x1, 0x0, 0x0, 0x9}, 0x20000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{}, &(0x7f0000000040), 0x0}, 0x20) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="a8000000", @ANYRES16=r8, @ANYBLOB="05002abd7000fddbdf25010000008c0008803000008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b08000300070000005800008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff3000098028000080060001000a000000140002000000000000000000000000000000000105000300000000000400008008000100", @ANYRES32=r9, @ANYBLOB="ec4e08a9ec26b25e254670402fc2233c17789b870c0549465af9419dd39731793a5f7e61fe0b8ee5054314076eac1707367d0ca64becdbbcbcdc2c1b825e09971277d6858ef0f384c84804fe0a0f3fb497d7fce6d69982a8f751400e05f085012118088970ee5a256cf29e263baa3e2fe8f7106c10920a1008404d5e09f908e914b84b822a4f"], 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x181) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r10, &(0x7f0000000100)={0xa, 0x4e22, 0x5ccc6e74, @ipv4={'\x00', '\xff\xff', @loopback}, 0xffff2d76}, 0x1c) listen(r10, 0x3) mount$9p_tcp(&(0x7f0000000100), &(0x7f0000000080)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='trans=tcp,port=0x0000000000004e22']) close_range(r10, r10, 0x0) kernel console output (not intermixed with test programs): T4389] ___sys_sendmsg+0x17b/0x1d0 [ 50.507181][ T4389] __x64_sys_sendmsg+0xd4/0x160 [ 50.507264][ T4389] x64_sys_call+0x17ba/0x3000 [ 50.507289][ T4389] do_syscall_64+0xd8/0x2a0 [ 50.507396][ T4389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 50.507437][ T4389] RIP: 0033:0x7fe7cd21f749 [ 50.507455][ T4389] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 50.507473][ T4389] RSP: 002b:00007fe7cbc87038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 50.507490][ T4389] RAX: ffffffffffffffda RBX: 00007fe7cd475fa0 RCX: 00007fe7cd21f749 [ 50.507502][ T4389] RDX: 0000000000000000 RSI: 0000200000000300 RDI: 0000000000000004 [ 50.507514][ T4389] RBP: 00007fe7cbc87090 R08: 0000000000000000 R09: 0000000000000000 [ 50.507529][ T4389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 50.507545][ T4389] R13: 00007fe7cd476038 R14: 00007fe7cd475fa0 R15: 00007ffd16f041e8 [ 50.507610][ T4389] [ 50.509152][ T29] audit: type=1400 audit(1764835784.326:799): avc: denied { read write } for pid=4380 comm="syz.3.263" name="sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 50.720360][ T29] audit: type=1400 audit(1764835784.326:800): avc: denied { open } for pid=4380 comm="syz.3.263" path="/dev/sg0" dev="devtmpfs" ino=135 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 50.744263][ T29] audit: type=1400 audit(1764835784.326:801): avc: denied { ioctl } for pid=4380 comm="syz.3.263" path="/dev/sg0" dev="devtmpfs" ino=135 ioctlcmd=0x2285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 50.773979][ T4399] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.794680][ T4397] syzkaller0: entered promiscuous mode [ 50.800194][ T4397] syzkaller0: entered allmulticast mode [ 50.822778][ T4397] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 50.905840][ T4399] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 50.935931][ T4412] loop3: detected capacity change from 0 to 1024 [ 50.954773][ T4412] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 50.967048][ T4412] ext4 filesystem being mounted at /49/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 51.011194][ T4418] loop2: detected capacity change from 0 to 512 [ 51.031670][ T4399] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.043015][ T4418] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 51.074195][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 51.085112][ T4418] EXT4-fs (loop2): 1 truncate cleaned up [ 51.098435][ T4418] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.136063][ T4399] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 51.156708][ T29] audit: type=1400 audit(1764835784.976:802): avc: denied { append } for pid=4425 comm="syz.3.276" name="qrtr-tun" dev="devtmpfs" ino=258 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 51.258654][ T3317] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.267700][ T55] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.276401][ T55] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.305729][ T55] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.322598][ T55] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.420617][ T4442] xt_hashlimit: max too large, truncated to 1048576 [ 51.431586][ T4442] xt_CT: You must specify a L4 protocol and not use inversions on it [ 51.442790][ T4444] bridge_slave_1: left allmulticast mode [ 51.448498][ T4444] bridge_slave_1: left promiscuous mode [ 51.454351][ T4444] bridge0: port 2(bridge_slave_1) entered disabled state [ 51.471960][ T4442] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 51.471960][ T4442] program syz.3.282 not setting count and/or reply_len properly [ 51.489552][ T4444] bridge_slave_0: left allmulticast mode [ 51.495379][ T4444] bridge_slave_0: left promiscuous mode [ 51.501082][ T4444] bridge0: port 1(bridge_slave_0) entered disabled state [ 51.540190][ T4449] loop3: detected capacity change from 0 to 1024 [ 51.568633][ T4449] EXT4-fs (loop3): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 51.582878][ T4449] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 51.620120][ T4458] loop2: detected capacity change from 0 to 512 [ 51.655606][ T4460] loop0: detected capacity change from 0 to 512 [ 51.688676][ T4458] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 51.704832][ T4460] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 51.723792][ T3314] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 51.743357][ T4458] EXT4-fs (loop2): 1 truncate cleaned up [ 51.743595][ T4462] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4462 comm=syz.4.289 [ 51.753819][ T4458] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 51.782633][ T4460] ext4 filesystem being mounted at /55/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 51.799843][ T4462] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4462 comm=syz.4.289 [ 51.923641][ T4478] loop2: detected capacity change from 0 to 256 [ 51.933585][ T4478] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 52.069256][ T4499] loop0: detected capacity change from 0 to 1024 [ 52.082716][ T4499] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 52.104410][ T4499] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 52.122077][ T4499] EXT4-fs (loop0): orphan cleanup on readonly fs [ 52.141546][ T4499] EXT4-fs error (device loop0): ext4_free_blocks:6706: comm syz.0.298: Freeing blocks not in datazone - block = 0, count = 4096 [ 52.218999][ T4499] EXT4-fs (loop0): 1 orphan inode deleted [ 52.604927][ T4536] loop4: detected capacity change from 0 to 512 [ 52.612489][ T4536] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 52.625324][ T4536] EXT4-fs (loop4): 1 truncate cleaned up [ 52.759839][ T4544] loop0: detected capacity change from 0 to 512 [ 52.792588][ T4544] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 52.820490][ T4548] loop4: detected capacity change from 0 to 1024 [ 52.829868][ T4544] EXT4-fs (loop0): 1 truncate cleaned up [ 52.859754][ T4548] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 52.891338][ T4548] EXT4-fs error (device loop4): ext4_validate_block_bitmap:441: comm syz.4.306: bg 0: block 112: padding at end of block bitmap is not set [ 52.981331][ T4566] loop4: detected capacity change from 0 to 1024 [ 52.996424][ T4566] EXT4-fs (loop4): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 53.025537][ T4566] EXT4-fs (loop4): revision level too high, forcing read-only mode [ 53.060976][ T4566] EXT4-fs (loop4): orphan cleanup on readonly fs [ 53.084985][ T4566] EXT4-fs error (device loop4): ext4_free_blocks:6706: comm syz.4.309: Freeing blocks not in datazone - block = 0, count = 4096 [ 53.098652][ T4520] 9pnet_fd: p9_fd_create_tcp (4520): problem connecting socket to 127.0.0.1 [ 53.119530][ T4575] loop0: detected capacity change from 0 to 1024 [ 53.144696][ T4575] EXT4-fs: Ignoring removed orlov option [ 53.169509][ T4566] EXT4-fs (loop4): 1 orphan inode deleted [ 53.194750][ T4575] EXT4-fs (loop0): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 53.260560][ T4592] loop2: detected capacity change from 0 to 1024 [ 53.313070][ T4592] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 53.363191][ T4592] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 53.366030][ T4598] __nla_validate_parse: 13 callbacks suppressed [ 53.366106][ T4598] netlink: 24 bytes leftover after parsing attributes in process `syz.0.316'. [ 53.372745][ T4592] EXT4-fs (loop2): orphan cleanup on readonly fs [ 53.393015][ T4592] EXT4-fs error (device loop2): ext4_free_blocks:6706: comm syz.2.314: Freeing blocks not in datazone - block = 0, count = 4096 [ 53.406710][ T4592] EXT4-fs (loop2): 1 orphan inode deleted [ 53.505391][ T4603] loop0: detected capacity change from 0 to 256 [ 53.532700][ T4603] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 53.771146][ T4610] loop4: detected capacity change from 0 to 1024 [ 53.804080][ T4610] ext4 filesystem being mounted at /56/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 53.941499][ T4616] netlink: 4 bytes leftover after parsing attributes in process `syz.2.320'. [ 53.962310][ T4614] syzkaller0: entered promiscuous mode [ 53.967827][ T4614] syzkaller0: entered allmulticast mode [ 53.980692][ T4614] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 54.137178][ T4623] netlink: 24 bytes leftover after parsing attributes in process `syz.3.322'. [ 54.181720][ T4625] loop2: detected capacity change from 0 to 4096 [ 54.196616][ T4625] EXT4-fs: Ignoring removed bh option [ 54.205808][ T4629] netlink: 16 bytes leftover after parsing attributes in process `syz.3.325'. [ 54.302720][ T4627] loop4: detected capacity change from 0 to 2048 [ 54.380331][ T4636] netlink: 12 bytes leftover after parsing attributes in process `syz.0.327'. [ 54.389305][ T4636] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 54.399633][ T4627] Alternate GPT is invalid, using primary GPT. [ 54.406129][ T4627] loop4: p1 p2 p3 [ 54.472011][ T4627] netlink: 28 bytes leftover after parsing attributes in process `syz.4.324'. [ 54.480932][ T4627] netlink: 28 bytes leftover after parsing attributes in process `syz.4.324'. [ 54.489854][ T4627] netlink: 28 bytes leftover after parsing attributes in process `syz.4.324'. [ 54.571241][ T4644] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4644 comm=syz.2.329 [ 54.602167][ T4644] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4644 comm=syz.2.329 [ 54.639531][ T4646] netlink: 24 bytes leftover after parsing attributes in process `syz.0.330'. [ 54.992710][ T29] kauditd_printk_skb: 112 callbacks suppressed [ 54.992813][ T29] audit: type=1400 audit(1764835788.816:915): avc: denied { create } for pid=4651 comm="syz.2.332" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 55.104684][ T4658] netlink: 12 bytes leftover after parsing attributes in process `syz.4.333'. [ 55.282391][ T4669] loop4: detected capacity change from 0 to 256 [ 55.299357][ T4669] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 55.443365][ T29] audit: type=1400 audit(1764835789.266:916): avc: denied { create } for pid=4670 comm="syz.2.338" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 55.472112][ T4671] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 55.538669][ T4675] loop2: detected capacity change from 0 to 4096 [ 55.572170][ T4675] EXT4-fs: Ignoring removed bh option [ 55.797777][ T4680] loop0: detected capacity change from 0 to 1024 [ 55.837596][ T4680] ext4 filesystem being mounted at /67/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 55.872017][ T29] audit: type=1400 audit(1764835789.686:917): avc: denied { remount } for pid=4684 comm="syz.2.341" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 55.940123][ T4688] xt_hashlimit: max too large, truncated to 1048576 [ 55.957877][ T4689] xt_hashlimit: max too large, truncated to 1048576 [ 55.966175][ T4688] xt_CT: You must specify a L4 protocol and not use inversions on it [ 55.975470][ T4689] xt_CT: You must specify a L4 protocol and not use inversions on it [ 55.989857][ T4689] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 55.989857][ T4689] program syz.0.342 not setting count and/or reply_len properly [ 56.054701][ T4693] xt_hashlimit: max too large, truncated to 1048576 [ 56.062355][ T4693] xt_CT: You must specify a L4 protocol and not use inversions on it [ 56.136539][ T4697] loop2: detected capacity change from 0 to 512 [ 56.198339][ T4697] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 56.242047][ T4697] ext4 filesystem being mounted at /91/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 56.282343][ T4703] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 56.390797][ T4712] loop0: detected capacity change from 0 to 1024 [ 56.404077][ T4710] loop4: detected capacity change from 0 to 4096 [ 56.435255][ T4714] loop2: detected capacity change from 0 to 512 [ 56.445917][ T4710] EXT4-fs: Ignoring removed bh option [ 56.452175][ T4714] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 56.503381][ T4714] ext4 filesystem being mounted at /93/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 56.516763][ T4712] ext4 filesystem being mounted at /72/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 56.650803][ T4723] loop0: detected capacity change from 0 to 1024 [ 56.668464][ T4723] EXT4-fs (loop0): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 56.722105][ T4723] EXT4-fs (loop0): revision level too high, forcing read-only mode [ 56.730277][ T4723] EXT4-fs (loop0): orphan cleanup on readonly fs [ 56.736837][ T4723] EXT4-fs error (device loop0): ext4_free_blocks:6706: comm syz.0.354: Freeing blocks not in datazone - block = 0, count = 4096 [ 56.750368][ T4723] EXT4-fs (loop0): 1 orphan inode deleted [ 56.764517][ T29] audit: type=1326 audit(1764835790.586:918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.817277][ T29] audit: type=1326 audit(1764835790.606:919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=451 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.840601][ T29] audit: type=1326 audit(1764835790.606:920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.864101][ T29] audit: type=1326 audit(1764835790.606:921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.887350][ T29] audit: type=1326 audit(1764835790.606:922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.910635][ T29] audit: type=1326 audit(1764835790.606:923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.934121][ T29] audit: type=1326 audit(1764835790.636:924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4722 comm="syz.0.354" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc4045af749 code=0x7ffc0000 [ 56.977163][ T4728] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 56.977163][ T4728] program syz.2.356 not setting count and/or reply_len properly [ 57.122701][ T4732] siw: device registration error -23 [ 57.189666][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 16: comm syz-executor: path /73/file1: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 57.208233][ T4736] loop2: detected capacity change from 0 to 1024 [ 57.238074][ T4736] EXT4-fs: inline encryption not supported [ 57.254702][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 17: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.275646][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 18: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.311953][ T4738] loop4: detected capacity change from 0 to 256 [ 57.321437][ T4738] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 57.398112][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 19: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.398276][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 20: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.398440][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 21: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.398573][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 22: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.398750][ T3313] EXT4-fs error (device loop0): ext4_readdir:264: inode #2: block 23: comm syz-executor: path /73/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 57.450067][ T3313] EXT4-fs error (device loop0): ext4_lookup:1784: inode #2: comm syz-executor: '. ' linked to parent dir [ 57.454630][ T3313] EXT4-fs error (device loop0): ext4_lookup:1784: inode #2: comm syz-executor: '. ' linked to parent dir [ 57.684602][ T923] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.733831][ T923] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.784498][ T923] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.833355][ T923] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 57.932130][ T923] bridge_slave_1: left allmulticast mode [ 57.932147][ T923] bridge_slave_1: left promiscuous mode [ 57.932291][ T923] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.933213][ T923] bridge_slave_0: left allmulticast mode [ 57.933231][ T923] bridge_slave_0: left promiscuous mode [ 57.933331][ T923] bridge0: port 1(bridge_slave_0) entered disabled state [ 58.133805][ T923] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 58.135122][ T923] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 58.136061][ T923] bond0 (unregistering): Released all slaves [ 58.148484][ T4770] loop4: detected capacity change from 0 to 512 [ 58.149177][ T4770] ext3: Unknown parameter 'fowner' [ 58.163032][ T4746] lo speed is unknown, defaulting to 1000 [ 58.197464][ T923] tipc: Disabling bearer [ 58.197495][ T923] tipc: Left network mode [ 58.202056][ T923] hsr_slave_0: left promiscuous mode [ 58.202538][ T923] hsr_slave_1: left promiscuous mode [ 58.202847][ T923] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 58.202864][ T923] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 58.203940][ T923] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 58.204029][ T923] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 58.209237][ T923] veth1_macvtap: left promiscuous mode [ 58.209256][ T923] veth0_macvtap: left promiscuous mode [ 58.209317][ T923] veth1_vlan: left promiscuous mode [ 58.209359][ T923] veth0_vlan: left promiscuous mode [ 58.278352][ T923] pim6reg (unregistering): left allmulticast mode [ 58.933041][ T4779] x_tables: duplicate entry at hook 2 [ 58.972973][ T4746] chnl_net:caif_netlink_parms(): no params data found [ 58.988178][ T4784] loop2: detected capacity change from 0 to 1024 [ 59.043806][ T4784] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 59.054665][ T4791] __nla_validate_parse: 11 callbacks suppressed [ 59.054677][ T4791] netlink: 4 bytes leftover after parsing attributes in process `syz.4.367'. [ 59.080302][ T4784] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 59.092146][ T4784] EXT4-fs (loop2): orphan cleanup on readonly fs [ 59.098610][ T4784] EXT4-fs error (device loop2): ext4_free_blocks:6706: comm syz.2.366: Freeing blocks not in datazone - block = 0, count = 4096 [ 59.115140][ T4784] EXT4-fs (loop2): 1 orphan inode deleted [ 59.165511][ T4746] bridge0: port 1(bridge_slave_0) entered blocking state [ 59.172761][ T4746] bridge0: port 1(bridge_slave_0) entered disabled state [ 59.201898][ T4746] bridge_slave_0: entered allmulticast mode [ 59.222491][ T4746] bridge_slave_0: entered promiscuous mode [ 59.243052][ T4746] bridge0: port 2(bridge_slave_1) entered blocking state [ 59.250171][ T4746] bridge0: port 2(bridge_slave_1) entered disabled state [ 59.258472][ T4802] loop4: detected capacity change from 0 to 2048 [ 59.291953][ T4746] bridge_slave_1: entered allmulticast mode [ 59.310772][ T4746] bridge_slave_1: entered promiscuous mode [ 59.324354][ T4802] EXT4-fs (loop4): failed to initialize system zone (-117) [ 59.332002][ T4802] EXT4-fs (loop4): mount failed [ 59.377284][ T4746] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 59.387975][ T4746] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 59.448043][ T4808] netlink: 12 bytes leftover after parsing attributes in process `syz.4.369'. [ 59.458683][ T4746] team0: Port device team_slave_0 added [ 59.466574][ T4746] team0: Port device team_slave_1 added [ 59.521154][ T4812] loop4: detected capacity change from 0 to 512 [ 59.530731][ T4746] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 59.537807][ T4746] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.542519][ T4812] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 59.563824][ T4746] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 59.583367][ T4746] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 59.590359][ T4746] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 59.616390][ T4746] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 59.638381][ T4812] ext4 filesystem being mounted at /71/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 59.681120][ T4746] hsr_slave_0: entered promiscuous mode [ 59.696080][ T4746] hsr_slave_1: entered promiscuous mode [ 59.713089][ T4746] debugfs: 'hsr0' already exists in 'hsr' [ 59.718845][ T4746] Cannot create hsr debugfs directory [ 59.774852][ T4828] siw: device registration error -23 [ 59.848435][ T4831] loop2: detected capacity change from 0 to 1024 [ 59.855605][ T4831] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 59.867143][ T4831] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 59.877795][ T4831] EXT4-fs (loop2): orphan cleanup on readonly fs [ 59.884899][ T4831] EXT4-fs error (device loop2): ext4_free_blocks:6706: comm syz.2.372: Freeing blocks not in datazone - block = 0, count = 4096 [ 59.899545][ T4831] EXT4-fs (loop2): 1 orphan inode deleted [ 60.042468][ T4746] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 60.081011][ T4746] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 60.081204][ T29] kauditd_printk_skb: 265 callbacks suppressed [ 60.081220][ T29] audit: type=1326 audit(1764835793.896:1190): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.119370][ T4746] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 60.147638][ T29] audit: type=1326 audit(1764835793.946:1191): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.152492][ T4746] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 60.170984][ T29] audit: type=1326 audit(1764835793.946:1192): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.201025][ T29] audit: type=1326 audit(1764835793.946:1193): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.224490][ T29] audit: type=1326 audit(1764835793.946:1194): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.247666][ T29] audit: type=1326 audit(1764835793.946:1195): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.271007][ T29] audit: type=1326 audit(1764835793.946:1196): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.294460][ T29] audit: type=1326 audit(1764835793.946:1197): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.317887][ T29] audit: type=1326 audit(1764835793.946:1198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.341340][ T29] audit: type=1326 audit(1764835793.946:1199): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4830 comm="syz.2.372" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 60.546345][ T4746] 8021q: adding VLAN 0 to HW filter on device bond0 [ 60.577370][ T4865] netlink: 16 bytes leftover after parsing attributes in process `syz.4.375'. [ 60.590996][ T4746] 8021q: adding VLAN 0 to HW filter on device team0 [ 60.604832][ T4859] netlink: 12 bytes leftover after parsing attributes in process `syz.2.374'. [ 60.607823][ T838] bridge0: port 1(bridge_slave_0) entered blocking state [ 60.620832][ T838] bridge0: port 1(bridge_slave_0) entered forwarding state [ 60.646245][ T4859] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 60.651150][ T4746] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 60.664146][ T4746] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 60.678430][ T838] bridge0: port 2(bridge_slave_1) entered blocking state [ 60.685553][ T838] bridge0: port 2(bridge_slave_1) entered forwarding state [ 60.803198][ T4875] netlink: 4 bytes leftover after parsing attributes in process `syz.2.377'. [ 60.830191][ T4746] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 60.960328][ T4746] veth0_vlan: entered promiscuous mode [ 60.968533][ T4746] veth1_vlan: entered promiscuous mode [ 60.996709][ T4746] veth0_macvtap: entered promiscuous mode [ 61.004294][ T4746] veth1_macvtap: entered promiscuous mode [ 61.016184][ T4746] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.028875][ T4746] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.040961][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.055257][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.080584][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.091204][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.164774][ T4894] netlink: 12 bytes leftover after parsing attributes in process `syz.5.363'. [ 61.188701][ T4894] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 61.267841][ T4897] FAULT_INJECTION: forcing a failure. [ 61.267841][ T4897] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 61.280991][ T4897] CPU: 1 UID: 0 PID: 4897 Comm: syz.5.378 Not tainted syzkaller #0 PREEMPT(voluntary) [ 61.281064][ T4897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 61.281078][ T4897] Call Trace: [ 61.281084][ T4897] [ 61.281092][ T4897] __dump_stack+0x1d/0x30 [ 61.281118][ T4897] dump_stack_lvl+0xe8/0x140 [ 61.281176][ T4897] dump_stack+0x15/0x1b [ 61.281196][ T4897] should_fail_ex+0x265/0x280 [ 61.281226][ T4897] ? __pfx_ppp_ioctl+0x10/0x10 [ 61.281261][ T4897] should_fail+0xb/0x20 [ 61.281372][ T4897] should_fail_usercopy+0x1a/0x20 [ 61.281403][ T4897] _copy_from_user+0x1c/0xb0 [ 61.281420][ T4897] memdup_user+0x5e/0xd0 [ 61.281499][ T4897] ppp_get_filter+0xdb/0x160 [ 61.281537][ T4897] ppp_ioctl+0xb93/0x11c0 [ 61.281610][ T4897] ? __fget_files+0x184/0x1c0 [ 61.281646][ T4897] ? __pfx_ppp_ioctl+0x10/0x10 [ 61.281680][ T4897] __se_sys_ioctl+0xce/0x140 [ 61.281706][ T4897] __x64_sys_ioctl+0x43/0x50 [ 61.281809][ T4897] x64_sys_call+0x14b0/0x3000 [ 61.281837][ T4897] do_syscall_64+0xd8/0x2a0 [ 61.281866][ T4897] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 61.281945][ T4897] RIP: 0033:0x7fe015d4f749 [ 61.281964][ T4897] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 61.281985][ T4897] RSP: 002b:00007fe0147af038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 61.282007][ T4897] RAX: ffffffffffffffda RBX: 00007fe015fa5fa0 RCX: 00007fe015d4f749 [ 61.282022][ T4897] RDX: 00002000000000c0 RSI: 0000000040107447 RDI: 0000000000000003 [ 61.282040][ T4897] RBP: 00007fe0147af090 R08: 0000000000000000 R09: 0000000000000000 [ 61.282052][ T4897] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 61.282066][ T4897] R13: 00007fe015fa6038 R14: 00007fe015fa5fa0 R15: 00007ffcadb59708 [ 61.282088][ T4897] [ 61.622759][ T4905] xt_hashlimit: max too large, truncated to 1048576 [ 61.635325][ T4875] 9pnet_fd: p9_fd_create_tcp (4875): problem connecting socket to 127.0.0.1 [ 61.652966][ T4905] xt_CT: You must specify a L4 protocol and not use inversions on it [ 61.734617][ T4907] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4907 comm=syz.2.382 [ 61.743231][ T4909] siw: device registration error -23 [ 61.747771][ T4907] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=4907 comm=syz.2.382 [ 61.887906][ T4914] x_tables: duplicate entry at hook 2 [ 61.919227][ T4916] loop5: detected capacity change from 0 to 256 [ 61.945136][ T4916] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 62.001037][ T4918] loop2: detected capacity change from 0 to 512 [ 62.048580][ T4918] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 62.071382][ T4918] EXT4-fs (loop2): 1 truncate cleaned up [ 62.794063][ T4954] netlink: 16 bytes leftover after parsing attributes in process `syz.5.389'. [ 63.566355][ T923] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.635217][ T923] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.685015][ T4957] lo speed is unknown, defaulting to 1000 [ 63.745897][ T923] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 63.835964][ T923] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 64.063901][ T923] bridge_slave_1: left allmulticast mode [ 64.069610][ T923] bridge_slave_1: left promiscuous mode [ 64.075485][ T923] bridge0: port 2(bridge_slave_1) entered disabled state [ 64.162546][ T923] bridge_slave_0: left allmulticast mode [ 64.168275][ T923] bridge_slave_0: left promiscuous mode [ 64.174163][ T923] bridge0: port 1(bridge_slave_0) entered disabled state [ 64.372293][ T923] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 64.413606][ T923] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 64.442941][ T923] bond0 (unregistering): Released all slaves [ 64.455868][ T4957] chnl_net:caif_netlink_parms(): no params data found [ 64.497174][ T923] hsr_slave_0: left promiscuous mode [ 64.522223][ T923] hsr_slave_1: left promiscuous mode [ 64.528052][ T923] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 64.535536][ T923] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 64.582389][ T923] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 64.589860][ T923] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 64.615961][ T923] veth1_macvtap: left promiscuous mode [ 64.621572][ T923] veth0_macvtap: left promiscuous mode [ 64.631807][ T923] veth1_vlan: left promiscuous mode [ 64.637050][ T923] veth0_vlan: left promiscuous mode [ 64.988434][ T3394] lo speed is unknown, defaulting to 1000 [ 64.994459][ T3394] infiniband syz0: ib_query_port failed (-19) [ 65.142999][ T4957] bridge0: port 1(bridge_slave_0) entered blocking state [ 65.150231][ T4957] bridge0: port 1(bridge_slave_0) entered disabled state [ 65.201987][ T4957] bridge_slave_0: entered allmulticast mode [ 65.208456][ T4957] bridge_slave_0: entered promiscuous mode [ 65.244296][ T4957] bridge0: port 2(bridge_slave_1) entered blocking state [ 65.251379][ T4957] bridge0: port 2(bridge_slave_1) entered disabled state [ 65.282019][ T4957] bridge_slave_1: entered allmulticast mode [ 65.312404][ T4957] bridge_slave_1: entered promiscuous mode [ 65.359210][ T4957] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 65.383458][ T4957] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 65.443820][ T4957] team0: Port device team_slave_0 added [ 65.450421][ T4957] team0: Port device team_slave_1 added [ 65.508290][ T4957] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 65.515357][ T4957] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.541361][ T4957] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 65.619158][ T5001] netlink: 4 bytes leftover after parsing attributes in process `syz.2.392'. [ 65.654902][ T4957] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 65.662053][ T4957] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 65.688031][ T4957] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 65.784631][ T4957] hsr_slave_0: entered promiscuous mode [ 65.796297][ T4957] hsr_slave_1: entered promiscuous mode [ 65.802344][ T4957] debugfs: 'hsr0' already exists in 'hsr' [ 65.808096][ T4957] Cannot create hsr debugfs directory [ 66.051474][ T4957] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 66.069301][ T4957] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 66.088434][ T4957] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 66.106239][ T4957] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 66.187832][ T4957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 66.210863][ T4957] 8021q: adding VLAN 0 to HW filter on device team0 [ 66.233203][ T31] bridge0: port 1(bridge_slave_0) entered blocking state [ 66.240383][ T31] bridge0: port 1(bridge_slave_0) entered forwarding state [ 66.286146][ T31] bridge0: port 2(bridge_slave_1) entered blocking state [ 66.293309][ T31] bridge0: port 2(bridge_slave_1) entered forwarding state [ 66.407335][ T5001] 9pnet_fd: p9_fd_create_tcp (5001): problem connecting socket to 127.0.0.1 [ 66.422348][ T4957] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.483492][ T5052] xt_hashlimit: max too large, truncated to 1048576 [ 66.491061][ T5052] xt_CT: You must specify a L4 protocol and not use inversions on it [ 66.605110][ T5061] netlink: 4 bytes leftover after parsing attributes in process `syz.2.394'. [ 66.660434][ T4957] veth0_vlan: entered promiscuous mode [ 66.674744][ T4957] veth1_vlan: entered promiscuous mode [ 66.706764][ T4957] veth0_macvtap: entered promiscuous mode [ 66.723792][ T4957] veth1_macvtap: entered promiscuous mode [ 66.747029][ T4957] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.766256][ T4957] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.783050][ T12] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.802620][ T12] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.817009][ T12] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.831565][ T12] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.855268][ T29] kauditd_printk_skb: 24 callbacks suppressed [ 66.855352][ T29] audit: type=1400 audit(1764835800.676:1224): avc: denied { mounton } for pid=4957 comm="syz-executor" path="/root/syzkaller.sLx6fu/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=9833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 67.140599][ T5076] loop6: detected capacity change from 0 to 512 [ 67.163995][ T5076] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 67.209399][ T5076] ext4 filesystem being mounted at /1/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 67.365796][ T5086] loop6: detected capacity change from 0 to 512 [ 67.376799][ T5086] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 67.411260][ T5061] 9pnet_fd: p9_fd_create_tcp (5061): problem connecting socket to 127.0.0.1 [ 67.433655][ T5086] ext4 filesystem being mounted at /3/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 67.494617][ T5092] netlink: 20 bytes leftover after parsing attributes in process `syz.2.398'. [ 67.531566][ T5092] loop2: detected capacity change from 0 to 1024 [ 67.572857][ T5092] EXT4-fs: Ignoring removed orlov option [ 67.606194][ T5092] EXT4-fs (loop2): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 67.627288][ T5094] netlink: 28 bytes leftover after parsing attributes in process `syz.6.399'. [ 67.702389][ T5097] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 67.835972][ T29] audit: type=1400 audit(1764835801.656:1225): avc: denied { setopt } for pid=5098 comm="syz.2.400" lport=2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 68.026722][ T5109] tmpfs: Unknown parameter '' [ 68.036094][ T29] audit: type=1400 audit(1764835801.846:1226): avc: denied { mounton } for pid=5108 comm="syz.2.401" path="/syzcgroup/unified/syz2" dev="cgroup2" ino=31 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 68.064593][ T5109] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 68.115257][ T29] audit: type=1400 audit(1764835801.936:1227): avc: denied { read } for pid=5108 comm="syz.2.401" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 68.616352][ T5114] netlink: 20 bytes leftover after parsing attributes in process `syz.6.403'. [ 69.072111][ T5127] x_tables: duplicate entry at hook 2 [ 69.271960][ T5134] x_tables: duplicate underflow at hook 3 [ 69.284631][ T5135] loop6: detected capacity change from 0 to 1024 [ 69.332126][ T5135] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 69.367121][ T5135] EXT4-fs (loop6): revision level too high, forcing read-only mode [ 69.381649][ T5135] EXT4-fs (loop6): orphan cleanup on readonly fs [ 69.388432][ T5135] EXT4-fs error (device loop6): ext4_free_blocks:6706: comm syz.6.409: Freeing blocks not in datazone - block = 0, count = 4096 [ 69.402123][ T5135] EXT4-fs (loop6): 1 orphan inode deleted [ 69.408335][ T5135] EXT4-fs mount: 51 callbacks suppressed [ 69.408348][ T5135] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 69.418783][ T5138] syzkaller0: entered promiscuous mode [ 69.431916][ T5138] syzkaller0: entered allmulticast mode [ 69.446730][ T29] audit: type=1326 audit(1764835803.256:1228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5132 comm="syz.6.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f200ba9f749 code=0x7ffc0000 [ 69.470095][ T29] audit: type=1326 audit(1764835803.256:1229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5132 comm="syz.6.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f200ba9f749 code=0x7ffc0000 [ 69.493482][ T29] audit: type=1326 audit(1764835803.256:1230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5132 comm="syz.6.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=451 compat=0 ip=0x7f200ba9f749 code=0x7ffc0000 [ 69.518395][ T29] audit: type=1326 audit(1764835803.256:1231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5132 comm="syz.6.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f200ba9f749 code=0x7ffc0000 [ 69.541829][ T29] audit: type=1326 audit(1764835803.256:1232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5132 comm="syz.6.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f200ba9f749 code=0x7ffc0000 [ 69.565238][ T29] audit: type=1326 audit(1764835803.256:1233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5132 comm="syz.6.409" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f200ba9f749 code=0x7ffc0000 [ 69.634624][ T5144] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 69.925422][ T55] bridge_slave_1: left allmulticast mode [ 69.931137][ T55] bridge_slave_1: left promiscuous mode [ 69.937066][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.959670][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 16: comm syz-executor: path /11/file1: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 69.981591][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 17: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.003461][ T55] bridge_slave_0: left allmulticast mode [ 70.009132][ T55] bridge_slave_0: left promiscuous mode [ 70.014927][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.022461][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 18: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.047334][ T5162] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5162 comm=syz.2.414 [ 70.061486][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 19: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.084150][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 20: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.084864][ T5162] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5162 comm=syz.2.414 [ 70.120277][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 21: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.182984][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 22: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.224674][ T55] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 70.235829][ T4957] EXT4-fs error (device loop6): ext4_readdir:264: inode #2: block 23: comm syz-executor: path /11/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 70.257538][ T55] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 70.267962][ T55] bond0 (unregistering): Released all slaves [ 70.315336][ T55] hsr_slave_0: left promiscuous mode [ 70.321297][ T55] hsr_slave_1: left promiscuous mode [ 70.327125][ T55] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 70.335100][ T55] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 70.369543][ T4957] EXT4-fs error (device loop6): ext4_lookup:1784: inode #2: comm syz-executor: '. ' linked to parent dir [ 70.395269][ T4957] EXT4-fs error (device loop6): ext4_lookup:1784: inode #2: comm syz-executor: '. ' linked to parent dir [ 70.652161][ T5140] chnl_net:caif_netlink_parms(): no params data found [ 70.735369][ T5189] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 70.818702][ T5201] netlink: 24 bytes leftover after parsing attributes in process `syz.2.419'. [ 70.828281][ T5140] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.835389][ T5140] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.842635][ T4957] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 70.862386][ T5140] bridge_slave_0: entered allmulticast mode [ 70.880842][ T5140] bridge_slave_0: entered promiscuous mode [ 70.905341][ T5140] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.912451][ T5140] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.935509][ T5140] bridge_slave_1: entered allmulticast mode [ 70.956465][ T5140] bridge_slave_1: entered promiscuous mode [ 71.001107][ T5213] loop2: detected capacity change from 0 to 1024 [ 71.029245][ T5213] EXT4-fs (loop2): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 71.063691][ T5140] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 71.075585][ T5213] EXT4-fs error (device loop2): ext4_read_block_bitmap_nowait:483: comm syz.2.422: Invalid block bitmap block 0 in block_group 0 [ 71.089934][ T5213] EXT4-fs error (device loop2): ext4_acquire_dquot:6945: comm syz.2.422: Failed to acquire dquot type 0 [ 71.091202][ T5140] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 71.101462][ T5213] EXT4-fs error (device loop2): ext4_free_blocks:6706: comm syz.2.422: Freeing blocks not in datazone - block = 0, count = 4096 [ 71.123949][ T5213] EXT4-fs error (device loop2): ext4_read_inode_bitmap:139: comm syz.2.422: Invalid inode bitmap blk 0 in block_group 0 [ 71.141911][ T31] EXT4-fs error (device loop2): ext4_release_dquot:6981: comm kworker/u8:1: Failed to release dquot type 0 [ 71.161928][ T5213] EXT4-fs error (device loop2) in ext4_free_inode:361: Corrupt filesystem [ 71.182109][ T5213] EXT4-fs (loop2): 1 orphan inode deleted [ 71.200927][ T5213] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 71.232103][ T5213] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 71.258883][ T5140] team0: Port device team_slave_0 added [ 71.281421][ T5140] team0: Port device team_slave_1 added [ 71.384765][ T5140] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.391785][ T5140] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.417885][ T5140] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.429804][ T5140] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.436843][ T5140] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.462805][ T5140] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.484026][ T5238] FAULT_INJECTION: forcing a failure. [ 71.484026][ T5238] name failslab, interval 1, probability 0, space 0, times 0 [ 71.496890][ T5238] CPU: 0 UID: 0 PID: 5238 Comm: syz.2.424 Not tainted syzkaller #0 PREEMPT(voluntary) [ 71.496921][ T5238] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 71.496938][ T5238] Call Trace: [ 71.496947][ T5238] [ 71.496958][ T5238] __dump_stack+0x1d/0x30 [ 71.496983][ T5238] dump_stack_lvl+0xe8/0x140 [ 71.497036][ T5238] dump_stack+0x15/0x1b [ 71.497085][ T5238] should_fail_ex+0x265/0x280 [ 71.497125][ T5238] should_failslab+0x8c/0xb0 [ 71.497230][ T5238] kmem_cache_alloc_noprof+0x50/0x4a0 [ 71.497270][ T5238] ? alloc_empty_file+0x76/0x200 [ 71.497347][ T5238] alloc_empty_file+0x76/0x200 [ 71.497386][ T5238] alloc_file_pseudo+0xc6/0x160 [ 71.497415][ T5238] anon_inode_getfd+0xbf/0x190 [ 71.497443][ T5238] bpf_enable_stats+0xc5/0x110 [ 71.497546][ T5238] __sys_bpf+0x28a/0x7c0 [ 71.497619][ T5238] __x64_sys_bpf+0x41/0x50 [ 71.497651][ T5238] x64_sys_call+0x28e1/0x3000 [ 71.497728][ T5238] do_syscall_64+0xd8/0x2a0 [ 71.497758][ T5238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 71.497790][ T5238] RIP: 0033:0x7fe7cd21f749 [ 71.497805][ T5238] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 71.497826][ T5238] RSP: 002b:00007fe7cbc87038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 71.497846][ T5238] RAX: ffffffffffffffda RBX: 00007fe7cd475fa0 RCX: 00007fe7cd21f749 [ 71.497858][ T5238] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000020 [ 71.497874][ T5238] RBP: 00007fe7cbc87090 R08: 0000000000000000 R09: 0000000000000000 [ 71.497890][ T5238] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 71.497980][ T5238] R13: 00007fe7cd476038 R14: 00007fe7cd475fa0 R15: 00007ffd16f041e8 [ 71.498005][ T5238] [ 71.725838][ T5140] hsr_slave_0: entered promiscuous mode [ 71.732020][ T5140] hsr_slave_1: entered promiscuous mode [ 71.776356][ T5247] netlink: 'syz.2.425': attribute type 21 has an invalid length. [ 71.784185][ T5247] netlink: 164 bytes leftover after parsing attributes in process `syz.2.425'. [ 71.872055][ T5209] chnl_net:caif_netlink_parms(): no params data found [ 71.882773][ T5256] netlink: 24 bytes leftover after parsing attributes in process `syz.2.426'. [ 72.137866][ T5209] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.145622][ T5209] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.156344][ T5209] bridge_slave_0: entered allmulticast mode [ 72.162840][ T5209] bridge_slave_0: entered promiscuous mode [ 72.169888][ T5209] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.176998][ T5209] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.184468][ T5209] bridge_slave_1: entered allmulticast mode [ 72.211724][ T5209] bridge_slave_1: entered promiscuous mode [ 72.272233][ T5209] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.291267][ T5209] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.333269][ T5283] netlink: 12 bytes leftover after parsing attributes in process `syz.2.429'. [ 72.342208][ T5140] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 72.363956][ T5140] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 72.381920][ T5283] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 72.426477][ T5140] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 72.446075][ T5209] team0: Port device team_slave_0 added [ 72.452275][ T5140] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 72.474958][ T5209] team0: Port device team_slave_1 added [ 72.563023][ T5209] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.570003][ T5209] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.595998][ T5209] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.643177][ T29] kauditd_printk_skb: 41 callbacks suppressed [ 72.643192][ T29] audit: type=1326 audit(1764835806.466:1272): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 72.686235][ T5209] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.693250][ T5209] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.719493][ T29] audit: type=1326 audit(1764835806.506:1273): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=66 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 72.719528][ T29] audit: type=1326 audit(1764835806.506:1274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 72.742877][ T5209] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.766104][ T29] audit: type=1326 audit(1764835806.506:1275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 72.799972][ T29] audit: type=1326 audit(1764835806.506:1276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe7cd21f783 code=0x7ffc0000 [ 72.823302][ T29] audit: type=1326 audit(1764835806.506:1277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe7cd21e1ff code=0x7ffc0000 [ 72.846457][ T29] audit: type=1326 audit(1764835806.506:1278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7fe7cd21f7d7 code=0x7ffc0000 [ 72.869871][ T29] audit: type=1326 audit(1764835806.506:1279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe7cd21df90 code=0x7ffc0000 [ 72.893335][ T29] audit: type=1326 audit(1764835806.506:1280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe7cd21e3aa code=0x7ffc0000 [ 72.916573][ T29] audit: type=1326 audit(1764835806.506:1281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5298 comm="syz.2.431" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 72.994740][ T5209] hsr_slave_0: entered promiscuous mode [ 73.001046][ T5209] hsr_slave_1: entered promiscuous mode [ 73.037619][ T5209] debugfs: 'hsr0' already exists in 'hsr' [ 73.043402][ T5209] Cannot create hsr debugfs directory [ 73.057526][ T5140] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.115453][ T5140] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.155330][ T1767] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.162505][ T1767] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.197274][ T383] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.204383][ T383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.373702][ T5209] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 73.394164][ T5209] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 73.431680][ T5209] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 73.455568][ T5209] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 73.523871][ T5140] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.620425][ T5209] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.673920][ T5209] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.694988][ T923] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.702151][ T923] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.751517][ T383] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.758779][ T383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.878020][ T5140] veth0_vlan: entered promiscuous mode [ 73.909218][ T5140] veth1_vlan: entered promiscuous mode [ 73.949196][ T5140] veth0_macvtap: entered promiscuous mode [ 73.964178][ T5140] veth1_macvtap: entered promiscuous mode [ 73.999419][ T5140] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.015784][ T5140] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.047473][ T52] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.073597][ T52] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.098502][ T5209] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 74.123148][ T52] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.158219][ T5394] netlink: 24 bytes leftover after parsing attributes in process `syz.2.435'. [ 74.161902][ T52] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.437546][ T5420] loop7: detected capacity change from 0 to 1024 [ 74.452564][ T5209] veth0_vlan: entered promiscuous mode [ 74.457084][ T5420] EXT4-fs: Ignoring removed orlov option [ 74.484890][ T5209] veth1_vlan: entered promiscuous mode [ 74.490405][ T5420] EXT4-fs (loop7): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 74.523923][ T5420] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 74.533239][ T5209] veth0_macvtap: entered promiscuous mode [ 74.543605][ T5209] veth1_macvtap: entered promiscuous mode [ 74.582109][ T5209] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 74.609882][ T5209] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 74.670296][ T383] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.678307][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 74.690161][ T383] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.712401][ T5425] syzkaller0: entered promiscuous mode [ 74.717915][ T5425] syzkaller0: entered allmulticast mode [ 74.746545][ T383] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.774339][ T383] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 74.791700][ T5431] loop8: detected capacity change from 0 to 512 [ 74.792130][ T5425] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 74.822861][ T5431] ext3: Unknown parameter 'fowner' [ 74.870452][ T5435] xt_hashlimit: max too large, truncated to 1048576 [ 74.891083][ T5435] xt_CT: You must specify a L4 protocol and not use inversions on it [ 74.923292][ T5435] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 74.923292][ T5435] program syz.7.442 not setting count and/or reply_len properly [ 75.026489][ T5443] tmpfs: Unknown parameter '' [ 75.042057][ T5443] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 75.074407][ T5445] loop7: detected capacity change from 0 to 512 [ 75.103804][ T5445] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 75.146962][ T5445] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 75.179655][ T5445] ext4 filesystem being mounted at /7/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 75.245982][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.288409][ T5450] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5450 comm=syz.7.447 [ 75.447402][ T5455] xt_hashlimit: max too large, truncated to 1048576 [ 75.454840][ T5455] xt_CT: You must specify a L4 protocol and not use inversions on it [ 75.486132][ T5457] netlink: 4 bytes leftover after parsing attributes in process `syz.7.450'. [ 75.507773][ T5457] bridge0: entered promiscuous mode [ 75.514702][ T5457] macsec1: entered allmulticast mode [ 75.520089][ T5457] bridge0: entered allmulticast mode [ 75.528662][ T5457] bridge0: port 3(macsec1) entered blocking state [ 75.535241][ T5457] bridge0: port 3(macsec1) entered disabled state [ 75.545720][ T5457] bridge0: left allmulticast mode [ 75.550856][ T5457] bridge0: left promiscuous mode [ 75.694395][ T5460] loop8: detected capacity change from 0 to 1024 [ 75.716195][ T5462] netlink: 24 bytes leftover after parsing attributes in process `syz.7.452'. [ 75.717131][ T5460] EXT4-fs: Ignoring removed orlov option [ 75.779097][ T5460] EXT4-fs (loop8): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 75.824782][ T5460] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 75.830458][ T5464] bridge_slave_0: left allmulticast mode [ 75.842684][ T5464] bridge_slave_0: left promiscuous mode [ 75.848386][ T5464] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.863401][ T5464] bridge_slave_1: left allmulticast mode [ 75.869073][ T5464] bridge_slave_1: left promiscuous mode [ 75.874789][ T5464] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.885971][ T5464] bond0: (slave bond_slave_0): Releasing backup interface [ 75.899062][ T5464] bond0: (slave bond_slave_1): Releasing backup interface [ 75.934329][ T5464] team0: Port device team_slave_0 removed [ 75.937225][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 75.950573][ T5464] team0: Port device team_slave_1 removed [ 75.969479][ T5464] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 75.977056][ T5464] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 76.005984][ T5473] xt_hashlimit: max too large, truncated to 1048576 [ 76.021614][ T5464] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 76.029108][ T5464] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 76.037336][ T5473] xt_CT: You must specify a L4 protocol and not use inversions on it [ 76.047433][ T5473] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 76.047433][ T5473] program syz.8.455 not setting count and/or reply_len properly [ 76.067809][ T5464] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 76.235413][ T5480] netlink: 'syz.8.457': attribute type 2 has an invalid length. [ 76.243133][ T5480] netlink: 'syz.8.457': attribute type 1 has an invalid length. [ 76.250775][ T5480] netlink: 5 bytes leftover after parsing attributes in process `syz.8.457'. [ 76.320392][ T5480] netlink: 44 bytes leftover after parsing attributes in process `syz.8.457'. [ 76.351193][ T5482] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5482 comm=syz.7.459 [ 76.430629][ T5487] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 76.469671][ T5491] loop8: detected capacity change from 0 to 512 [ 76.477277][ T5491] ext3: Unknown parameter 'fowner' [ 76.773053][ T5493] loop7: detected capacity change from 0 to 128 [ 76.814415][ T5510] tmpfs: Unknown parameter '' [ 76.819556][ T5510] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 76.831762][ T52] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.863861][ T5495] chnl_net:caif_netlink_parms(): no params data found [ 76.893176][ T52] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.950528][ T5517] xt_hashlimit: max too large, truncated to 1048576 [ 76.958715][ T5517] xt_CT: You must specify a L4 protocol and not use inversions on it [ 76.968829][ T52] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 76.980336][ T5517] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 76.980336][ T5517] program syz.7.467 not setting count and/or reply_len properly [ 77.006110][ T5495] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.013275][ T5495] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.026391][ T5519] loop7: detected capacity change from 0 to 512 [ 77.028952][ T5495] bridge_slave_0: entered allmulticast mode [ 77.039408][ T5519] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 77.039842][ T5495] bridge_slave_0: entered promiscuous mode [ 77.056088][ T52] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 77.067357][ T5495] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.074523][ T5495] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.082294][ T5495] bridge_slave_1: entered allmulticast mode [ 77.089752][ T5495] bridge_slave_1: entered promiscuous mode [ 77.090104][ T5519] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 77.109414][ T5519] ext4 filesystem being mounted at /18/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 77.131698][ T5495] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.142981][ T5495] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.169154][ T5495] team0: Port device team_slave_0 added [ 77.184235][ T5495] team0: Port device team_slave_1 added [ 77.205035][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.224591][ T5495] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.231558][ T5495] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.257597][ T5495] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.315810][ T5495] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.322843][ T5495] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 77.348920][ T5495] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.378834][ T5530] FAULT_INJECTION: forcing a failure. [ 77.378834][ T5530] name failslab, interval 1, probability 0, space 0, times 0 [ 77.391592][ T5530] CPU: 1 UID: 0 PID: 5530 Comm: syz.8.472 Not tainted syzkaller #0 PREEMPT(voluntary) [ 77.391654][ T5530] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 77.391745][ T5530] Call Trace: [ 77.391754][ T5530] [ 77.391764][ T5530] __dump_stack+0x1d/0x30 [ 77.391794][ T5530] dump_stack_lvl+0xe8/0x140 [ 77.391829][ T5530] dump_stack+0x15/0x1b [ 77.391859][ T5530] should_fail_ex+0x265/0x280 [ 77.391896][ T5530] should_failslab+0x8c/0xb0 [ 77.392023][ T5530] __kmalloc_noprof+0xa5/0x590 [ 77.392056][ T5530] ? security_inode_init_security+0xb4/0x320 [ 77.392088][ T5530] ? __pfx_shmem_initxattrs+0x10/0x10 [ 77.392117][ T5530] security_inode_init_security+0xb4/0x320 [ 77.392174][ T5530] shmem_symlink+0xc9/0x3d0 [ 77.392205][ T5530] ? selinux_inode_symlink+0x22/0x30 [ 77.392277][ T5530] vfs_symlink+0x1b4/0x1f0 [ 77.392317][ T5530] do_symlinkat+0xf0/0x470 [ 77.392416][ T5530] __x64_sys_symlink+0x50/0x60 [ 77.392482][ T5530] x64_sys_call+0x24a9/0x3000 [ 77.392537][ T5530] do_syscall_64+0xd8/0x2a0 [ 77.392566][ T5530] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 77.392605][ T5530] RIP: 0033:0x7f17045ff749 [ 77.392625][ T5530] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 77.392645][ T5530] RSP: 002b:00007f170305f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000058 [ 77.392741][ T5530] RAX: ffffffffffffffda RBX: 00007f1704855fa0 RCX: 00007f17045ff749 [ 77.392757][ T5530] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000200000000000 [ 77.392780][ T5530] RBP: 00007f170305f090 R08: 0000000000000000 R09: 0000000000000000 [ 77.392796][ T5530] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 77.392812][ T5530] R13: 00007f1704856038 R14: 00007f1704855fa0 R15: 00007fffb3d77848 [ 77.392834][ T5530] [ 77.585400][ T5525] vlan2: entered allmulticast mode [ 77.590559][ T5525] bridge_slave_0: entered allmulticast mode [ 77.622710][ T5495] hsr_slave_0: entered promiscuous mode [ 77.628956][ T5495] hsr_slave_1: entered promiscuous mode [ 77.635795][ T5495] debugfs: 'hsr0' already exists in 'hsr' [ 77.641538][ T5495] Cannot create hsr debugfs directory [ 77.705735][ T5540] xt_hashlimit: max too large, truncated to 1048576 [ 77.722552][ T5540] xt_CT: You must specify a L4 protocol and not use inversions on it [ 77.772476][ T5552] netlink: 24 bytes leftover after parsing attributes in process `syz.8.473'. [ 77.804643][ T52] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 77.833377][ T52] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 77.863112][ T52] bond0 (unregistering): Released all slaves [ 77.883552][ T52] bond1 (unregistering): Released all slaves [ 77.941640][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 77.949130][ T52] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 77.994349][ T52] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 78.002055][ T52] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 78.014083][ T5565] netlink: 12 bytes leftover after parsing attributes in process `syz.8.479'. [ 78.038937][ T52] veth1_macvtap: left promiscuous mode [ 78.044533][ T52] veth0_macvtap: left promiscuous mode [ 78.050048][ T52] veth1_vlan: left promiscuous mode [ 78.084238][ T52] veth0_vlan: left promiscuous mode [ 78.115015][ T29] kauditd_printk_skb: 174 callbacks suppressed [ 78.115033][ T29] audit: type=1326 audit(1764835811.936:1456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 78.173884][ T29] audit: type=1326 audit(1764835811.966:1457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=66 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 78.197216][ T29] audit: type=1326 audit(1764835811.966:1458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 78.220593][ T29] audit: type=1326 audit(1764835811.966:1459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 78.244035][ T29] audit: type=1326 audit(1764835811.966:1460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fe7cd21f783 code=0x7ffc0000 [ 78.267363][ T29] audit: type=1326 audit(1764835811.966:1461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fe7cd21e1ff code=0x7ffc0000 [ 78.290745][ T29] audit: type=1326 audit(1764835811.976:1462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7fe7cd21f7d7 code=0x7ffc0000 [ 78.314169][ T29] audit: type=1326 audit(1764835811.976:1463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fe7cd21df90 code=0x7ffc0000 [ 78.337623][ T29] audit: type=1326 audit(1764835811.976:1464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7fe7cd21e3aa code=0x7ffc0000 [ 78.361028][ T29] audit: type=1326 audit(1764835811.976:1465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=5575 comm="syz.2.480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe7cd21f749 code=0x7ffc0000 [ 78.375117][ T5585] xt_TCPMSS: Only works on TCP SYN packets [ 78.441605][ T5585] loop7: detected capacity change from 0 to 1024 [ 78.472522][ T5585] EXT4-fs: Ignoring removed orlov option [ 78.484840][ T5585] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 78.499123][ T5585] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 78.657862][ T5495] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 78.676188][ T5604] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 78.678619][ T5495] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 78.702108][ T5495] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 78.711736][ T5495] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 78.803074][ T5495] 8021q: adding VLAN 0 to HW filter on device bond0 [ 78.833353][ T5495] 8021q: adding VLAN 0 to HW filter on device team0 [ 78.843784][ T383] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.850898][ T383] bridge0: port 1(bridge_slave_0) entered forwarding state [ 78.866328][ T66] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.873527][ T66] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.024142][ T5495] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.060881][ T5639] netlink: 24 bytes leftover after parsing attributes in process `syz.2.487'. [ 79.173530][ T5663] netlink: 8 bytes leftover after parsing attributes in process `syz.2.489'. [ 79.226760][ T1767] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.267904][ T1767] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.286724][ T5663] netlink: 4 bytes leftover after parsing attributes in process `syz.2.489'. [ 79.327123][ T5683] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5683 comm=syz.7.490 [ 79.341659][ T5683] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5683 comm=syz.7.490 [ 79.359365][ T5495] veth0_vlan: entered promiscuous mode [ 79.377542][ T1767] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.389896][ T5690] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 79.401195][ T5495] veth1_vlan: entered promiscuous mode [ 79.450634][ T1767] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.482835][ T5495] veth0_macvtap: entered promiscuous mode [ 79.548392][ T5644] chnl_net:caif_netlink_parms(): no params data found [ 79.562296][ T5495] veth1_macvtap: entered promiscuous mode [ 79.668606][ T5495] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.704354][ T1767] bridge_slave_1: left allmulticast mode [ 79.710108][ T1767] bridge_slave_1: left promiscuous mode [ 79.715921][ T1767] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.726635][ T5713] netlink: 24 bytes leftover after parsing attributes in process `syz.7.496'. [ 79.735837][ T1767] bridge_slave_0: left allmulticast mode [ 79.741553][ T1767] bridge_slave_0: left promiscuous mode [ 79.748017][ T1767] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.782207][ T5715] netlink: 28 bytes leftover after parsing attributes in process `syz.8.498'. [ 79.884915][ T1767] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 79.895236][ T1767] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 79.905542][ T1767] bond0 (unregistering): Released all slaves [ 79.915889][ T5495] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.923621][ T5644] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.930697][ T5644] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.938684][ T5644] bridge_slave_0: entered allmulticast mode [ 79.948830][ T5644] bridge_slave_0: entered promiscuous mode [ 79.955677][ T5721] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 79.968701][ T1767] hsr_slave_0: left promiscuous mode [ 79.985274][ T1767] hsr_slave_1: left promiscuous mode [ 79.993734][ T1767] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 80.001153][ T1767] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 80.008881][ T1767] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 80.016368][ T1767] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 80.026848][ T1767] veth1_macvtap: left promiscuous mode [ 80.032508][ T1767] veth0_macvtap: left promiscuous mode [ 80.038100][ T1767] veth1_vlan: left promiscuous mode [ 80.043443][ T1767] veth0_vlan: left promiscuous mode [ 80.112918][ T1767] team0 (unregistering): Port device team_slave_1 removed [ 80.123931][ T1767] team0 (unregistering): Port device team_slave_0 removed [ 80.160845][ T5644] bridge0: port 2(bridge_slave_1) entered blocking state [ 80.168137][ T5644] bridge0: port 2(bridge_slave_1) entered disabled state [ 80.177018][ T5733] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 80.177443][ T5644] bridge_slave_1: entered allmulticast mode [ 80.191392][ T5644] bridge_slave_1: entered promiscuous mode [ 80.202341][ T5730] syzkaller0: entered promiscuous mode [ 80.207834][ T5730] syzkaller0: entered allmulticast mode [ 80.228609][ T31] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.238762][ T5644] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 80.250575][ T31] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.264051][ T5644] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 80.273302][ T31] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.282545][ T31] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.310838][ T5644] team0: Port device team_slave_0 added [ 80.318544][ T5644] team0: Port device team_slave_1 added [ 80.344222][ T5736] loop7: detected capacity change from 0 to 512 [ 80.354153][ T5736] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 80.357459][ T5644] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.370957][ T5644] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.397066][ T5644] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.401001][ T5738] xt_hashlimit: max too large, truncated to 1048576 [ 80.412541][ T5644] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.421706][ T5644] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 80.447712][ T5644] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.450218][ T5738] xt_CT: You must specify a L4 protocol and not use inversions on it [ 80.470597][ T5736] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 80.491480][ T5736] ext4 filesystem being mounted at /29/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 80.526660][ T5644] hsr_slave_0: entered promiscuous mode [ 80.542036][ T5644] hsr_slave_1: entered promiscuous mode [ 80.548065][ T5644] debugfs: 'hsr0' already exists in 'hsr' [ 80.553045][ T5747] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 80.553045][ T5747] program syz.9.504 not setting count and/or reply_len properly [ 80.553888][ T5644] Cannot create hsr debugfs directory [ 80.667614][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.811498][ T5772] netlink: 12 bytes leftover after parsing attributes in process `syz.7.509'. [ 80.835125][ T5773] syzkaller0: entered promiscuous mode [ 80.840638][ T5773] syzkaller0: entered allmulticast mode [ 80.897814][ T5773] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 80.980306][ T5644] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 81.014837][ T5644] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 81.043643][ T5644] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 81.089431][ T5644] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.132642][ T5799] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5799 comm=syz.8.512 [ 81.146241][ T5799] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5799 comm=syz.8.512 [ 81.158288][ T5644] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.181268][ T5644] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.196056][ T1925] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.203157][ T1925] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.219092][ T1925] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.226250][ T1925] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.309510][ T5815] netlink: 28 bytes leftover after parsing attributes in process `syz.8.515'. [ 81.329791][ T5815] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 81.377885][ T5821] loop9: detected capacity change from 0 to 1024 [ 81.404586][ T5644] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.422531][ T5830] loop8: detected capacity change from 0 to 512 [ 81.422747][ T5821] EXT4-fs (loop9): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 81.443984][ T5830] ext3: Unknown parameter 'fowner' [ 81.464509][ T5821] EXT4-fs (loop9): revision level too high, forcing read-only mode [ 81.473712][ T5821] EXT4-fs (loop9): orphan cleanup on readonly fs [ 81.480235][ T5821] EXT4-fs error (device loop9): ext4_free_blocks:6706: comm syz.9.516: Freeing blocks not in datazone - block = 0, count = 4096 [ 81.502200][ T5821] EXT4-fs (loop9): 1 orphan inode deleted [ 81.508623][ T5821] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 81.582518][ T5644] veth0_vlan: entered promiscuous mode [ 81.608823][ T5644] veth1_vlan: entered promiscuous mode [ 81.639308][ T5644] veth0_macvtap: entered promiscuous mode [ 81.659156][ T5644] veth1_macvtap: entered promiscuous mode [ 81.685824][ T5644] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.713238][ T5644] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.732477][ T55] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.766168][ T55] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.788637][ T55] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.809705][ T5865] syzkaller0: entered promiscuous mode [ 81.815390][ T5865] syzkaller0: entered allmulticast mode [ 81.839445][ T55] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.853919][ T5865] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 81.904767][ T5874] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 81.904767][ T5874] program syz.2.523 not setting count and/or reply_len properly [ 81.959602][ T5879] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5879 comm=syz.2.524 [ 81.991546][ T5886] netlink: 28 bytes leftover after parsing attributes in process `syz.0.526'. [ 82.002865][ T5879] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5879 comm=syz.2.524 [ 82.071482][ T5895] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 82.081755][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 82.154807][ T5903] FAULT_INJECTION: forcing a failure. [ 82.154807][ T5903] name failslab, interval 1, probability 0, space 0, times 0 [ 82.167515][ T5903] CPU: 0 UID: 0 PID: 5903 Comm: syz.7.529 Not tainted syzkaller #0 PREEMPT(voluntary) [ 82.167550][ T5903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 82.167616][ T5903] Call Trace: [ 82.167624][ T5903] [ 82.167635][ T5903] __dump_stack+0x1d/0x30 [ 82.167666][ T5903] dump_stack_lvl+0xe8/0x140 [ 82.167694][ T5903] dump_stack+0x15/0x1b [ 82.167787][ T5903] should_fail_ex+0x265/0x280 [ 82.167816][ T5903] should_failslab+0x8c/0xb0 [ 82.167856][ T5903] __kmalloc_node_track_caller_noprof+0xa5/0x5a0 [ 82.167980][ T5903] ? sidtab_sid2str_get+0xa0/0x130 [ 82.168077][ T5903] kmemdup_noprof+0x2b/0x70 [ 82.168123][ T5903] sidtab_sid2str_get+0xa0/0x130 [ 82.168146][ T5903] security_sid_to_context_core+0x1eb/0x2e0 [ 82.168220][ T5903] security_sid_to_context+0x27/0x40 [ 82.168246][ T5903] selinux_lsmprop_to_secctx+0x67/0xf0 [ 82.168275][ T5903] security_lsmprop_to_secctx+0x1a3/0x1c0 [ 82.168314][ T5903] audit_log_subj_ctx+0xa4/0x3e0 [ 82.168360][ T5903] ? skb_put+0xa9/0xf0 [ 82.168471][ T5903] audit_log_task_context+0x48/0x70 [ 82.168500][ T5903] audit_log_task+0xf4/0x250 [ 82.168589][ T5903] ? kstrtouint+0x76/0xc0 [ 82.168621][ T5903] audit_seccomp+0x61/0x100 [ 82.168653][ T5903] ? __seccomp_filter+0x832/0x1260 [ 82.168683][ T5903] __seccomp_filter+0x843/0x1260 [ 82.168712][ T5903] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 82.168770][ T5903] ? vfs_write+0x7e8/0x960 [ 82.168807][ T5903] ? __rcu_read_unlock+0x4f/0x70 [ 82.168834][ T5903] ? __fget_files+0x184/0x1c0 [ 82.168954][ T5903] __secure_computing+0x82/0x150 [ 82.169000][ T5903] syscall_trace_enter+0xcf/0x1e0 [ 82.169078][ T5903] do_syscall_64+0xb2/0x2a0 [ 82.169110][ T5903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.169131][ T5903] RIP: 0033:0x7f87f20ef749 [ 82.169166][ T5903] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 82.169293][ T5903] RSP: 002b:00007f87f0b57038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 82.169317][ T5903] RAX: ffffffffffffffda RBX: 00007f87f2345fa0 RCX: 00007f87f20ef749 [ 82.169333][ T5903] RDX: 0000200000000cc0 RSI: 000000000000541a RDI: 0000000000000004 [ 82.169349][ T5903] RBP: 00007f87f0b57090 R08: 0000000000000000 R09: 0000000000000000 [ 82.169361][ T5903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 82.169373][ T5903] R13: 00007f87f2346038 R14: 00007f87f2345fa0 R15: 00007fff1b381648 [ 82.169396][ T5903] [ 82.567655][ T5922] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 82.567655][ T5922] program syz.7.533 not setting count and/or reply_len properly [ 82.614628][ T5929] syzkaller0: entered promiscuous mode [ 82.620162][ T5929] syzkaller0: entered allmulticast mode [ 82.630977][ T5929] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 82.710020][ T5945] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5945 comm=syz.7.538 [ 82.748497][ T5945] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=5945 comm=syz.7.538 [ 82.755201][ T5900] netlink: 'syz.9.527': attribute type 4 has an invalid length. [ 82.764200][ T5954] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 82.871666][ T5969] netlink: 12 bytes leftover after parsing attributes in process `syz.7.543'. [ 82.965273][ T5982] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 82.965273][ T5982] program syz.7.548 not setting count and/or reply_len properly [ 83.028171][ T5990] syzkaller0: entered promiscuous mode [ 83.033834][ T5990] syzkaller0: entered allmulticast mode [ 83.047700][ T5990] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 83.224643][ T6025] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 83.266555][ T6030] netlink: 12 bytes leftover after parsing attributes in process `syz.7.555'. [ 83.344131][ T6039] netlink: 24 bytes leftover after parsing attributes in process `syz.7.556'. [ 83.386441][ T6048] FAULT_INJECTION: forcing a failure. [ 83.386441][ T6048] name failslab, interval 1, probability 0, space 0, times 0 [ 83.399329][ T6048] CPU: 0 UID: 0 PID: 6048 Comm: syz.9.557 Not tainted syzkaller #0 PREEMPT(voluntary) [ 83.399358][ T6048] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 83.399428][ T6048] Call Trace: [ 83.399435][ T6048] [ 83.399443][ T6048] __dump_stack+0x1d/0x30 [ 83.399470][ T6048] dump_stack_lvl+0xe8/0x140 [ 83.399493][ T6048] dump_stack+0x15/0x1b [ 83.399513][ T6048] should_fail_ex+0x265/0x280 [ 83.399593][ T6048] should_failslab+0x8c/0xb0 [ 83.399628][ T6048] kmem_cache_alloc_noprof+0x50/0x4a0 [ 83.399663][ T6048] ? alloc_empty_file+0x76/0x200 [ 83.399729][ T6048] alloc_empty_file+0x76/0x200 [ 83.399753][ T6048] alloc_file_pseudo+0xc6/0x160 [ 83.399844][ T6048] sock_alloc_file+0x9c/0x1e0 [ 83.399960][ T6048] do_accept+0x1e4/0x3a0 [ 83.399998][ T6048] __sys_accept4+0xbe/0x170 [ 83.400043][ T6048] __x64_sys_accept4+0x51/0x60 [ 83.400153][ T6048] x64_sys_call+0x2b3e/0x3000 [ 83.400232][ T6048] do_syscall_64+0xd8/0x2a0 [ 83.400259][ T6048] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 83.400278][ T6048] RIP: 0033:0x7fce27f7f749 [ 83.400292][ T6048] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 83.400387][ T6048] RSP: 002b:00007fce269be038 EFLAGS: 00000246 ORIG_RAX: 0000000000000120 [ 83.400410][ T6048] RAX: ffffffffffffffda RBX: 00007fce281d6090 RCX: 00007fce27f7f749 [ 83.400423][ T6048] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 83.400434][ T6048] RBP: 00007fce269be090 R08: 0000000000000000 R09: 0000000000000000 [ 83.400473][ T6048] R10: 0000000000080800 R11: 0000000000000246 R12: 0000000000000001 [ 83.400484][ T6048] R13: 00007fce281d6128 R14: 00007fce281d6090 R15: 00007fffbe004d18 [ 83.400507][ T6048] [ 83.626500][ T6056] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 83.626500][ T6056] program syz.8.559 not setting count and/or reply_len properly [ 83.714650][ T6070] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 83.788439][ T6078] netlink: 24 bytes leftover after parsing attributes in process `syz.8.563'. [ 83.839034][ T6087] netlink: 12 bytes leftover after parsing attributes in process `syz.2.566'. [ 83.896626][ T6096] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 83.955531][ T29] kauditd_printk_skb: 268 callbacks suppressed [ 83.955620][ T29] audit: type=1326 audit(1764835817.776:1733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 83.989049][ T6102] loop8: detected capacity change from 0 to 512 [ 84.015088][ T29] audit: type=1326 audit(1764835817.776:1734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 84.038686][ T29] audit: type=1326 audit(1764835817.816:1735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=66 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 84.061960][ T29] audit: type=1326 audit(1764835817.816:1736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 84.068097][ T6102] ext3: Unknown parameter 'fowner' [ 84.085306][ T29] audit: type=1326 audit(1764835817.816:1737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=319 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 84.085342][ T29] audit: type=1326 audit(1764835817.816:1738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f17045ff783 code=0x7ffc0000 [ 84.085376][ T29] audit: type=1326 audit(1764835817.816:1739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f17045fe1ff code=0x7ffc0000 [ 84.085439][ T29] audit: type=1326 audit(1764835817.816:1740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=11 compat=0 ip=0x7f17045ff7d7 code=0x7ffc0000 [ 84.135487][ T6106] loop7: detected capacity change from 0 to 512 [ 84.137020][ T29] audit: type=1326 audit(1764835817.816:1741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f17045fdf90 code=0x7ffc0000 [ 84.213396][ T29] audit: type=1326 audit(1764835817.816:1742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6100 comm="syz.8.570" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f17045ff34b code=0x7ffc0000 [ 84.243528][ T6106] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 84.372671][ T6106] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.393402][ T6106] ext4 filesystem being mounted at /51/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 84.469502][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.548562][ T6139] syzkaller0: entered promiscuous mode [ 84.554341][ T6139] syzkaller0: entered allmulticast mode [ 84.586065][ T6139] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 84.829252][ T6160] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 84.869102][ T6164] tipc: Started in network mode [ 84.874106][ T6164] tipc: Node identity 667ba26e891a, cluster identity 4711 [ 84.881315][ T6164] tipc: Enabled bearer , priority 0 [ 84.938207][ T6163] tipc: Disabling bearer [ 85.074067][ T6184] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6184 comm=syz.8.586 [ 85.102653][ T6184] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6184 comm=syz.8.586 [ 85.171421][ T6192] syzkaller0: entered promiscuous mode [ 85.177052][ T6192] syzkaller0: entered allmulticast mode [ 85.207355][ T6193] syz.7.588 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 85.236238][ T6201] netlink: 'syz.8.590': attribute type 4 has an invalid length. [ 85.244078][ T6201] netlink: 60 bytes leftover after parsing attributes in process `syz.8.590'. [ 85.244894][ T6192] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 85.654498][ T6231] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.670734][ T6235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.592'. [ 85.713470][ T6239] loop8: detected capacity change from 0 to 736 [ 85.745680][ T6239] iso9660: Unknown parameter 'noc1JzڃNompress' [ 85.761950][ T6231] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.849886][ T6231] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.877445][ T6254] xt_hashlimit: max too large, truncated to 1048576 [ 85.893903][ T6254] xt_CT: You must specify a L4 protocol and not use inversions on it [ 85.913033][ T6256] xt_CT: You must specify a L4 protocol and not use inversions on it [ 85.946014][ T6231] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.023429][ T6267] SELinux: Context system_u:object is not valid (left unmapped). [ 86.058049][ T5586] netdevsim netdevsim9 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.089647][ T5586] netdevsim netdevsim9 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.118884][ T6275] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 86.118884][ T6275] program syz.2.601 not setting count and/or reply_len properly [ 86.121929][ T5586] netdevsim netdevsim9 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.161308][ T6277] netlink: 24 bytes leftover after parsing attributes in process `syz.7.600'. [ 86.225835][ T5586] netdevsim netdevsim9 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 86.280423][ T6284] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 86.335399][ T6289] loop9: detected capacity change from 0 to 1024 [ 86.400105][ T6289] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 86.474167][ T6299] EXT4-fs error (device loop9): ext4_mb_generate_buddy:1289: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 86.502023][ T6299] EXT4-fs (loop9): Remounting filesystem read-only [ 86.549054][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 86.775340][ T6320] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 86.775340][ T6320] program syz.8.613 not setting count and/or reply_len properly [ 86.819730][ T6325] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6325 comm=syz.9.615 [ 86.836352][ T6325] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6325 comm=syz.9.615 [ 86.919874][ T6331] xt_hashlimit: max too large, truncated to 1048576 [ 87.022878][ T6331] xt_CT: You must specify a L4 protocol and not use inversions on it [ 87.039279][ T6333] loop9: detected capacity change from 0 to 1024 [ 87.079952][ T6333] EXT4-fs: Ignoring removed oldalloc option [ 87.096799][ T6344] loop8: detected capacity change from 0 to 512 [ 87.097847][ T6333] EXT4-fs: Ignoring removed bh option [ 87.126629][ T6344] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 87.136537][ T6333] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 87.168968][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.181258][ T6344] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 87.277185][ T6344] ext4 filesystem being mounted at /41/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 87.321378][ T6360] loop9: detected capacity change from 0 to 1024 [ 87.347324][ T6362] veth0_to_team: entered promiscuous mode [ 87.354485][ T6362] SELinux: Context system_u:object_r:fsa is not valid (left unmapped). [ 87.384489][ T6360] EXT4-fs: Ignoring removed orlov option [ 87.390702][ T6360] EXT4-fs (loop9): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 87.391151][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.430358][ T6360] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 87.472456][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.541071][ T6378] xt_hashlimit: max too large, truncated to 1048576 [ 87.548849][ T6378] xt_CT: You must specify a L4 protocol and not use inversions on it [ 87.604321][ T6383] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 87.643419][ T6383] netlink: 28 bytes leftover after parsing attributes in process `syz.8.629'. [ 87.694445][ T6394] tmpfs: Unknown parameter '' [ 87.711293][ T6394] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 87.722655][ T6398] netlink: 28 bytes leftover after parsing attributes in process `syz.7.633'. [ 88.248895][ T6444] loop8: detected capacity change from 0 to 512 [ 88.271094][ T6444] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 88.323198][ T6444] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 88.352538][ T6444] ext4 filesystem being mounted at /45/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 88.404404][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.453721][ T6453] netlink: 'syz.8.639': attribute type 3 has an invalid length. [ 88.461440][ T6453] netlink: 'syz.8.639': attribute type 3 has an invalid length. [ 88.732343][ T6466] syzkaller0: entered promiscuous mode [ 88.737895][ T6466] syzkaller0: entered allmulticast mode [ 88.758808][ T6472] loop8: detected capacity change from 0 to 1024 [ 88.773455][ T6466] SELinux: security_context_str_to_sid ( ) failed with errno=-22 [ 88.782587][ T6472] EXT4-fs (loop8): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 88.819182][ T6472] EXT4-fs (loop8): revision level too high, forcing read-only mode [ 88.982208][ T6472] EXT4-fs (loop8): orphan cleanup on readonly fs [ 88.988661][ T6472] EXT4-fs error (device loop8): ext4_free_blocks:6706: comm syz.8.646: Freeing blocks not in datazone - block = 0, count = 4096 [ 89.002219][ T6472] EXT4-fs (loop8): 1 orphan inode deleted [ 89.008322][ T6472] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 89.053169][ T29] kauditd_printk_skb: 271 callbacks suppressed [ 89.053186][ T29] audit: type=1326 audit(1764835822.876:2014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.131867][ T29] audit: type=1326 audit(1764835822.906:2015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=451 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.155279][ T29] audit: type=1326 audit(1764835822.906:2016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.169216][ T6478] loop7: detected capacity change from 0 to 1024 [ 89.178734][ T29] audit: type=1326 audit(1764835822.906:2017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.208404][ T29] audit: type=1326 audit(1764835822.906:2018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.212539][ T6478] EXT4-fs: Ignoring removed orlov option [ 89.231863][ T29] audit: type=1326 audit(1764835822.906:2019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.291587][ T6478] EXT4-fs (loop7): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 89.353314][ T6478] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 89.374398][ T29] audit: type=1326 audit(1764835823.096:2020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.397913][ T29] audit: type=1326 audit(1764835823.096:2021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.421271][ T29] audit: type=1326 audit(1764835823.146:2022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.444597][ T29] audit: type=1326 audit(1764835823.146:2023): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6470 comm="syz.8.646" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f17045ff749 code=0x7ffc0000 [ 89.527402][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.586295][ T6486] loop7: detected capacity change from 0 to 512 [ 89.593663][ T6486] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 89.644920][ T6486] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 89.657770][ T6486] ext4 filesystem being mounted at /70/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 89.705974][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.722620][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.782636][ T6492] tmpfs: Unknown parameter '' [ 89.790567][ T6490] vlan2: entered allmulticast mode [ 89.800039][ T6492] RDS: rds_bind could not find a transport for fc00::, load rds_tcp or rds_rdma? [ 89.879665][ T6500] netlink: 28 bytes leftover after parsing attributes in process `syz.8.653'. [ 89.981192][ T6505] tmpfs: Bad value for 'nr_inodes' [ 90.582933][ T6503] syz.8.654 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), order=0, oom_score_adj=1000 [ 90.597186][ T6503] CPU: 0 UID: 0 PID: 6503 Comm: syz.8.654 Not tainted syzkaller #0 PREEMPT(voluntary) [ 90.597217][ T6503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 90.597230][ T6503] Call Trace: [ 90.597237][ T6503] [ 90.597245][ T6503] __dump_stack+0x1d/0x30 [ 90.597311][ T6503] dump_stack_lvl+0xe8/0x140 [ 90.597341][ T6503] dump_stack+0x15/0x1b [ 90.597442][ T6503] dump_header+0x81/0x220 [ 90.597470][ T6503] oom_kill_process+0x342/0x400 [ 90.597497][ T6503] out_of_memory+0x979/0xb80 [ 90.597537][ T6503] try_charge_memcg+0x610/0xa10 [ 90.597583][ T6503] obj_cgroup_charge_pages+0xa6/0x150 [ 90.597675][ T6503] __memcg_kmem_charge_page+0x9f/0x170 [ 90.597732][ T6503] __alloc_frozen_pages_noprof+0x188/0x360 [ 90.597771][ T6503] alloc_pages_mpol+0xb3/0x260 [ 90.597818][ T6503] ? alloc_pages_noprof+0xf4/0x130 [ 90.597854][ T6503] alloc_pages_noprof+0x90/0x130 [ 90.597913][ T6503] __vmalloc_node_range_noprof+0x7a5/0xed0 [ 90.597952][ T6503] ? ___kmalloc_large_node+0x50/0x130 [ 90.598003][ T6503] __kvmalloc_node_noprof+0x47f/0x690 [ 90.598066][ T6503] ? ip_set_alloc+0x24/0x30 [ 90.598095][ T6503] ? ip_set_alloc+0x24/0x30 [ 90.598116][ T6503] ? __kmalloc_cache_noprof+0x246/0x4c0 [ 90.598140][ T6503] ip_set_alloc+0x24/0x30 [ 90.598170][ T6503] hash_netiface_create+0x282/0x740 [ 90.598277][ T6503] ? __pfx_hash_netiface_create+0x10/0x10 [ 90.598319][ T6503] ip_set_create+0x3cc/0x970 [ 90.598361][ T6503] ? __nla_parse+0x40/0x60 [ 90.598406][ T6503] nfnetlink_rcv_msg+0x4c6/0x590 [ 90.598481][ T6503] ? cmp_ex_search+0x25/0x40 [ 90.598572][ T6503] netlink_rcv_skb+0x123/0x220 [ 90.598601][ T6503] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 90.598691][ T6503] nfnetlink_rcv+0x167/0x16c0 [ 90.598736][ T6503] ? kmem_cache_free+0xe3/0x3a0 [ 90.598782][ T6503] ? __kfree_skb+0x109/0x150 [ 90.598826][ T6503] ? nlmon_xmit+0x4f/0x60 [ 90.598854][ T6503] ? consume_skb+0x49/0x150 [ 90.598923][ T6503] ? nlmon_xmit+0x4f/0x60 [ 90.598950][ T6503] ? dev_hard_start_xmit+0x3b0/0x3e0 [ 90.598994][ T6503] ? __dev_queue_xmit+0x138d/0x1ec0 [ 90.599073][ T6503] ? __dev_queue_xmit+0x148/0x1ec0 [ 90.599103][ T6503] ? ref_tracker_free+0x37d/0x3e0 [ 90.599144][ T6503] ? __netlink_deliver_tap+0x4dc/0x500 [ 90.599251][ T6503] netlink_unicast+0x5c0/0x690 [ 90.599273][ T6503] netlink_sendmsg+0x58b/0x6b0 [ 90.599330][ T6503] ? __pfx_netlink_sendmsg+0x10/0x10 [ 90.599364][ T6503] __sock_sendmsg+0x145/0x180 [ 90.599401][ T6503] ____sys_sendmsg+0x31e/0x4a0 [ 90.599487][ T6503] ___sys_sendmsg+0x17b/0x1d0 [ 90.599536][ T6503] __x64_sys_sendmsg+0xd4/0x160 [ 90.599630][ T6503] x64_sys_call+0x17ba/0x3000 [ 90.599681][ T6503] do_syscall_64+0xd8/0x2a0 [ 90.599781][ T6503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.599804][ T6503] RIP: 0033:0x7f17045ff749 [ 90.599824][ T6503] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 90.599848][ T6503] RSP: 002b:00007f170305f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 90.599873][ T6503] RAX: ffffffffffffffda RBX: 00007f1704855fa0 RCX: 00007f17045ff749 [ 90.599890][ T6503] RDX: 0000000000000800 RSI: 0000200000000200 RDI: 000000000000000a [ 90.599924][ T6503] RBP: 00007f1704683f91 R08: 0000000000000000 R09: 0000000000000000 [ 90.599941][ T6503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 90.599958][ T6503] R13: 00007f1704856038 R14: 00007f1704855fa0 R15: 00007fffb3d77848 [ 90.599984][ T6503] [ 90.599993][ T6503] memory: usage 307200kB, limit 307200kB, failcnt 47 [ 90.668831][ T6501] FAULT_INJECTION: forcing a failure. [ 90.668831][ T6501] name fail_futex, interval 1, probability 0, space 0, times 1 [ 90.669041][ T6503] memory+swap: usage 307448kB, limit 9007199254740988kB, failcnt 0 [ 90.674899][ T6501] CPU: 1 UID: 0 PID: 6501 Comm: syz.2.652 Not tainted syzkaller #0 PREEMPT(voluntary) [ 90.674938][ T6501] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 90.674956][ T6501] Call Trace: [ 90.674965][ T6501] [ 90.674977][ T6501] __dump_stack+0x1d/0x30 [ 90.675010][ T6501] dump_stack_lvl+0xe8/0x140 [ 90.675119][ T6501] dump_stack+0x15/0x1b [ 90.675144][ T6501] should_fail_ex+0x265/0x280 [ 90.675186][ T6501] should_fail+0xb/0x20 [ 90.675239][ T6501] get_futex_key+0x130/0xc00 [ 90.675344][ T6501] ? _raw_spin_unlock_irqrestore+0x2b/0x60 [ 90.675401][ T6501] futex_wake+0x7d/0x360 [ 90.675456][ T6501] ? __rcu_read_unlock+0x4f/0x70 [ 90.675544][ T6501] do_futex+0x323/0x380 [ 90.675585][ T6501] mm_release+0xb2/0x1e0 [ 90.675630][ T6501] exit_mm_release+0x25/0x30 [ 90.675754][ T6501] exit_mm+0x38/0x180 [ 90.675785][ T6501] do_exit+0x427/0x15d0 [ 90.675868][ T6501] ? _raw_spin_lock_bh+0x56/0xb0 [ 90.675948][ T6501] ? _raw_spin_unlock_bh+0x36/0x40 [ 90.675990][ T6501] do_group_exit+0xff/0x140 [ 90.676066][ T6501] ? get_signal+0xe50/0xf70 [ 90.676105][ T6501] get_signal+0xe58/0xf70 [ 90.676150][ T6501] ? __sys_sendto+0x2bf/0x330 [ 90.676195][ T6501] arch_do_signal_or_restart+0x96/0x450 [ 90.676237][ T6501] exit_to_user_mode_loop+0x6a/0x740 [ 90.676278][ T6501] ? __x64_sys_sendto+0x76/0x90 [ 90.676322][ T6501] do_syscall_64+0x202/0x2a0 [ 90.676361][ T6501] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.676463][ T6501] RIP: 0033:0x7fe7cd21f749 [ 90.676483][ T6501] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 90.676508][ T6501] RSP: 002b:00007fe7cbc66038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 90.676534][ T6501] RAX: fffffffffffffe00 RBX: 00007fe7cd476090 RCX: 00007fe7cd21f749 [ 90.676576][ T6501] RDX: ffffffffffffff94 RSI: 0000200000000000 RDI: 0000000000000004 [ 90.676593][ T6501] RBP: 00007fe7cbc66090 R08: 0000000000000000 R09: 0000000000000000 [ 90.676611][ T6501] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 90.676671][ T6501] R13: 00007fe7cd476128 R14: 00007fe7cd476090 R15: 00007ffd16f041e8 [ 90.676717][ T6501] [ 90.746423][ T6507] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 90.750309][ T6503] kmem: usage 306932kB, limit 9007199254740988kB, failcnt 0 [ 91.206425][ T6503] Memory cgroup stats for /syz8: [ 91.207351][ T6503] cache 147456 [ 91.215716][ T6503] rss 118784 [ 91.218988][ T6503] shmem 0 [ 91.221988][ T6503] mapped_file 0 [ 91.225449][ T6503] dirty 0 [ 91.228399][ T6503] writeback 0 [ 91.231692][ T6503] workingset_refault_anon 21 [ 91.236327][ T6503] workingset_refault_file 0 [ 91.240837][ T6503] swap 258048 [ 91.244232][ T6503] swapcached 122880 [ 91.248042][ T6503] pgpgin 9364 [ 91.251329][ T6503] pgpgout 9298 [ 91.254755][ T6503] pgfault 16555 [ 91.258229][ T6503] pgmajfault 12 [ 91.261696][ T6503] inactive_anon 36864 [ 91.265714][ T6503] active_anon 86016 [ 91.269531][ T6503] inactive_file 122880 [ 91.273630][ T6503] active_file 24576 [ 91.277434][ T6503] unevictable 0 [ 91.280939][ T6503] hierarchical_memory_limit 314572800 [ 91.286404][ T6503] hierarchical_memsw_limit 9223372036854771712 [ 91.292621][ T6503] total_cache 147456 [ 91.296593][ T6503] total_rss 118784 [ 91.300354][ T6503] total_shmem 0 [ 91.303868][ T6503] total_mapped_file 0 [ 91.307906][ T6503] total_dirty 0 [ 91.311485][ T6503] total_writeback 0 [ 91.315353][ T6503] total_workingset_refault_anon 21 [ 91.320479][ T6503] total_workingset_refault_file 0 [ 91.325548][ T6503] total_swap 258048 [ 91.329368][ T6503] total_swapcached 122880 [ 91.333852][ T6503] total_pgpgin 9364 [ 91.337672][ T6503] total_pgpgout 9298 [ 91.341590][ T6503] total_pgfault 16555 [ 91.345617][ T6503] total_pgmajfault 12 [ 91.349607][ T6503] total_inactive_anon 36864 [ 91.354162][ T6503] total_active_anon 86016 [ 91.358499][ T6503] total_inactive_file 122880 [ 91.363174][ T6503] total_active_file 24576 [ 91.367539][ T6503] total_unevictable 0 [ 91.371529][ T6503] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz8,task_memcg=/syz8,task=syz.8.654,pid=6502,uid=0 [ 91.386135][ T6503] Memory cgroup out of memory: Killed process 6503 (syz.8.654) total-vm:94112kB, anon-rss:1264kB, file-rss:22440kB, shmem-rss:0kB, UID:0 pgtables:132kB oom_score_adj:1000 [ 91.740860][ T6530] netlink: 4 bytes leftover after parsing attributes in process `syz.9.663'. [ 91.766988][ T6503] syz.8.654 (6503) used greatest stack depth: 7280 bytes left [ 91.777430][ T6530] team0 (unregistering): Port device team_slave_0 removed [ 91.828202][ T6535] loop8: detected capacity change from 0 to 1024 [ 91.856872][ T6530] team0 (unregistering): Port device team_slave_1 removed [ 91.893854][ T6535] EXT4-fs (loop8): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 91.967037][ T6535] ext4 filesystem being mounted at /53/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 91.992400][ T6538] netlink: 12 bytes leftover after parsing attributes in process `syz.7.666'. [ 92.001307][ T6538] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 92.041043][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 92.104433][ T6550] loop9: detected capacity change from 0 to 512 [ 92.127391][ T6550] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 92.146208][ T6556] netlink: 20 bytes leftover after parsing attributes in process `syz.7.671'. [ 92.179447][ T6550] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 92.192881][ T6560] xt_hashlimit: max too large, truncated to 1048576 [ 92.212360][ T6550] ext4 filesystem being mounted at /35/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 92.222798][ T6560] xt_CT: You must specify a L4 protocol and not use inversions on it [ 92.290620][ T6566] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6566 comm=syz.2.674 [ 92.303974][ T6566] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6566 comm=syz.2.674 [ 92.350405][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 92.360198][ T6569] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 92.360198][ T6569] program syz.8.675 not setting count and/or reply_len properly [ 92.478591][ T6579] netlink: 4 bytes leftover after parsing attributes in process `syz.8.678'. [ 92.498096][ T6579] team0 (unregistering): Port device team_slave_0 removed [ 92.534307][ T6579] team0 (unregistering): Port device team_slave_1 removed [ 92.554005][ T6584] loop9: detected capacity change from 0 to 1024 [ 92.571624][ T6584] EXT4-fs (loop9): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 92.624445][ T6584] EXT4-fs (loop9): revision level too high, forcing read-only mode [ 92.651983][ T6584] EXT4-fs (loop9): orphan cleanup on readonly fs [ 92.658520][ T6584] EXT4-fs error (device loop9): ext4_free_blocks:6706: comm syz.9.681: Freeing blocks not in datazone - block = 0, count = 4096 [ 92.716325][ T6584] EXT4-fs (loop9): 1 orphan inode deleted [ 92.779048][ T6592] loop8: detected capacity change from 0 to 1024 [ 92.785933][ T6584] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 92.821342][ T6592] EXT4-fs: Ignoring removed orlov option [ 92.829074][ T6592] EXT4-fs (loop8): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 92.850629][ T6595] loop7: detected capacity change from 0 to 512 [ 92.857562][ T6595] ext3: Unknown parameter 'fowner' [ 92.998352][ T6592] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 93.066084][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.226825][ T6619] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6619 comm=syz.2.687 [ 93.239852][ T6619] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6619 comm=syz.2.687 [ 93.334746][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 93.423611][ T6635] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6635 comm=syz.9.689 [ 93.437266][ T6635] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6635 comm=syz.9.689 [ 93.693275][ T6652] loop9: detected capacity change from 0 to 1024 [ 93.717772][ T6652] EXT4-fs (loop9): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 93.734447][ T6654] loop7: detected capacity change from 0 to 1024 [ 93.741031][ T6652] EXT4-fs (loop9): revision level too high, forcing read-only mode [ 93.749730][ T6652] EXT4-fs (loop9): orphan cleanup on readonly fs [ 93.760082][ T6652] EXT4-fs error (device loop9): ext4_free_blocks:6706: comm syz.9.699: Freeing blocks not in datazone - block = 0, count = 4096 [ 93.792409][ T6652] EXT4-fs (loop9): 1 orphan inode deleted [ 93.796273][ T6660] netlink: 4 bytes leftover after parsing attributes in process `syz.8.701'. [ 93.811868][ T6654] EXT4-fs (loop7): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 93.832413][ T6652] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 93.853309][ T6654] EXT4-fs (loop7): revision level too high, forcing read-only mode [ 93.871986][ T6654] EXT4-fs (loop7): orphan cleanup on readonly fs [ 93.888726][ T6654] EXT4-fs error (device loop7): ext4_free_blocks:6706: comm syz.7.700: Freeing blocks not in datazone - block = 0, count = 4096 [ 93.913505][ T6654] EXT4-fs (loop7): 1 orphan inode deleted [ 93.929574][ T6654] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 94.051991][ T6665] sg_write: data in/out 156/65394 bytes for SCSI command 0x0-- guessing data in; [ 94.051991][ T6665] program syz.8.702 not setting count and/or reply_len properly [ 94.148794][ T29] kauditd_printk_skb: 187 callbacks suppressed [ 94.148879][ T29] audit: type=1326 audit(1764835827.966:2211): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6653 comm="syz.7.700" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87f20ef749 code=0x7ffc0000 [ 94.209041][ T6667] loop8: detected capacity change from 0 to 1024 [ 94.241897][ T29] audit: type=1326 audit(1764835827.966:2212): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6653 comm="syz.7.700" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87f20ef749 code=0x7ffc0000 [ 94.263937][ T6667] EXT4-fs: Ignoring removed orlov option [ 94.292376][ T6667] EXT4-fs (loop8): stripe (2) is not aligned with cluster size (16), stripe is disabled [ 94.332027][ T29] audit: type=1326 audit(1764835828.156:2213): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6653 comm="syz.7.700" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f87f20ef749 code=0x7ffc0000 [ 94.346761][ T6672] netlink: 4 bytes leftover after parsing attributes in process `syz.2.705'. [ 94.375931][ T29] audit: type=1326 audit(1764835828.156:2214): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6653 comm="syz.7.700" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87f20ef749 code=0x7ffc0000 [ 94.375961][ T6667] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 94.376056][ T29] ================================================================== [ 94.376105][ T29] BUG: KCSAN: data-race in data_push_tail / string [ 94.376159][ T29] [ 94.376168][ T29] write to 0xffffffff88e871f0 of 1 bytes by task 6667 on cpu 1: [ 94.376190][ T29] string+0x187/0x220 [ 94.376226][ T29] vsnprintf+0x532/0x860 [ 94.376254][ T29] vscnprintf+0x41/0x90 [ 94.376282][ T29] printk_sprint+0x30/0x2d0 [ 94.376315][ T29] vprintk_store+0x599/0x860 [ 94.376351][ T29] vprintk_emit+0x15a/0x610 [ 94.376387][ T29] vprintk_default+0x26/0x30 [ 94.376423][ T29] vprintk+0x1d/0x30 [ 94.376447][ T29] _printk+0x79/0xa0 [ 94.376483][ T29] __ext4_msg+0x18f/0x1a0 [ 94.376514][ T29] ext4_fill_super+0x2fbd/0x3800 [ 94.376547][ T29] get_tree_bdev_flags+0x291/0x300 [ 94.376581][ T29] get_tree_bdev+0x1f/0x30 [ 94.376612][ T29] ext4_get_tree+0x1c/0x30 [ 94.376642][ T29] vfs_get_tree+0x57/0x1d0 [ 94.376674][ T29] do_new_mount+0x24d/0x6a0 [ 94.376707][ T29] path_mount+0x4ab/0xb80 [ 94.376739][ T29] __se_sys_mount+0x28c/0x2e0 [ 94.376786][ T29] __x64_sys_mount+0x67/0x80 [ 94.376836][ T29] x64_sys_call+0x2cca/0x3000 [ 94.376864][ T29] do_syscall_64+0xd8/0x2a0 [ 94.376892][ T29] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.376917][ T29] [ 94.376924][ T29] read to 0xffffffff88e871f0 of 8 bytes by task 29 on cpu 0: [ 94.376944][ T29] data_push_tail+0x100/0x470 [ 94.376979][ T29] data_alloc+0x11b/0x390 [ 94.377012][ T29] prb_reserve+0x964/0xb60 [ 94.377046][ T29] vprintk_store+0x56d/0x860 [ 94.377091][ T29] vprintk_emit+0x15a/0x610 [ 94.377129][ T29] vprintk_default+0x26/0x30 [ 94.377168][ T29] vprintk+0x1d/0x30 [ 94.377188][ T29] _printk+0x79/0xa0 [ 94.377232][ T29] kauditd_hold_skb+0x1b1/0x1c0 [ 94.377260][ T29] kauditd_send_queue+0x273/0x2c0 [ 94.377283][ T29] kauditd_thread+0x442/0x680 [ 94.377304][ T29] kthread+0x489/0x510 [ 94.377338][ T29] ret_from_fork+0x149/0x290 [ 94.377366][ T29] ret_from_fork_asm+0x1a/0x30 [ 94.377393][ T29] [ 94.377399][ T29] value changed: 0x00000000ffffe29d -> 0x662d345458453601 [ 94.377414][ T29] [ 94.377420][ T29] Reported by Kernel Concurrency Sanitizer on: [ 94.377436][ T29] CPU: 0 UID: 0 PID: 29 Comm: kauditd Not tainted syzkaller #0 PREEMPT(voluntary) [ 94.377467][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 94.377483][ T29] ================================================================== [ 94.656998][ T29] audit: type=1326 audit(1764835828.156:2215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6653 comm="syz.7.700" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87f20ef749 code=0x7ffc0000 [ 94.680398][ T29] audit: type=1326 audit(1764835828.186:2216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6651 comm="syz.9.699" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce27f7f749 code=0x7ffc0000 [ 94.703748][ T29] audit: type=1326 audit(1764835828.186:2217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6651 comm="syz.9.699" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce27f7f749 code=0x7ffc0000 [ 94.727071][ T29] audit: type=1326 audit(1764835828.196:2218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6651 comm="syz.9.699" exe="/root/syz-executor" sig=0 arch=c000003e syscall=258 compat=0 ip=0x7fce27f7f749 code=0x7ffc0000 [ 94.750481][ T29] audit: type=1326 audit(1764835828.196:2219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6651 comm="syz.9.699" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce27f7f749 code=0x7ffc0000 [ 94.774048][ T29] audit: type=1326 audit(1764835828.196:2220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6651 comm="syz.9.699" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fce27f7f749 code=0x7ffc0000 [ 94.799013][ T5209] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 94.808664][ T5140] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 94.818566][ T5495] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 95.143912][ T6672] 9pnet_fd: p9_fd_create_tcp (6672): problem connecting socket to 127.0.0.1