last executing test programs: 40.800337922s ago: executing program 1 (id=2197): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000680)=[{&(0x7f0000000040)="00214500002c00000000400600000a0000010a0000020050b8070000000100000001601003f60000000001010101", 0x40}], 0x1, 0x6, 0x0) pwritev(r0, 0x0, 0x0, 0x3, 0x0) 40.660208878s ago: executing program 1 (id=2203): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd7000000000000a010101000000000000000000000000ac1414aa00000000000000000000000000000080000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000008000100000000000e0000000000000000000000000000000000000000000000ffffffffffffffff040000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff0000000001000600000000004400050000000000000000000000000000000000000000003c"], 0xfc}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) sendmsg$key(0xffffffffffffffff, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg(r1, &(0x7f0000000440)={&(0x7f0000000040)=@in6={0xa, 0x4e21, 0x5, @mcast2, 0x9}, 0x80, 0x0}, 0x20000000) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xef, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_bp={0x0, 0x1}, 0x114147, 0x4, 0x0, 0x5, 0x7, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x9) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0xe, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) 40.648642729s ago: executing program 1 (id=2206): socket$kcm(0x2, 0x922000000001, 0x106) sendmsg$AUDIT_ADD_RULE(0xffffffffffffffff, 0x0, 0x4000000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x248, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x40000000, 0x10001}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0xffffffffffffffff, 0x9010, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf50a43945a8ef38c}, 0xce6b9b20411c70f4, 0x800000000000ca, 0x0, 0x9, 0xffffffbffffffffc, 0x0, 0x0, 0x0, 0xf, 0x0, 0x3}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0xb) recvmsg$unix(r2, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r4, &(0x7f0000000100)=ANY=[@ANYRES8=r3, @ANYBLOB], 0x9a) bpf$PROG_LOAD(0x5, &(0x7f0000004d40)={0xc, 0xe, &(0x7f0000000040)=ANY=[@ANYRESDEC=r1], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10}, 0x94) socketpair(0x2b, 0x1, 0xf8, &(0x7f00000001c0)={0xffffffffffffffff}) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0xa}, 0x114244, 0x0, 0xafe8, 0x4, 0x7fff, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x10, 0x4, 0x0, 0x0, 0x0, 0xffdffffffffffffb, 0x102, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, @perf_bp={0x0, 0x4}, 0x8ad8f72e752e9f4c, 0xc8, 0x2, 0x7, 0x0, 0xffff, 0xa}, 0xffffffffffffffff, 0x5, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x20) write$cgroup_subtree(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="8fedcb7910009875f37538e486dd6317ce8102033200fefd000e40000200875a65969ff57b00000000000000000000000000ac1414aa"], 0xfdef) sendmsg$kcm(r5, &(0x7f0000004d00)={&(0x7f0000003240)=@vsock={0x28, 0x0, 0x2710}, 0xfdd8, &(0x7f0000003780)}, 0x44000) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003240)=ANY=[@ANYBLOB="1c0000002600090122bd7008c0e3c1fd795a243c0800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 40.526066275s ago: executing program 1 (id=2212): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @rand_addr=' \x01\x00'}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[], 0x30}], 0x1, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e24, @local}}, [0x568e, 0x510, 0x4, 0xffffffffffffffff, 0x8, 0xffffffffffff7fff, 0x4, 0x6, 0xd41, 0x100, 0x1ff, 0x7ff, 0x101, 0xe, 0x3]}, &(0x7f00000001c0)=0x100) 40.41911804s ago: executing program 1 (id=2214): r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0xe, 0x66e}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000008e00001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2100060, 0x0) 40.241993288s ago: executing program 1 (id=2223): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x12, 0x1, 0x4, 0x2}, 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r0, &(0x7f00000003c0), &(0x7f0000000580)=@tcp=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r0, 0x0, &(0x7f0000000300)=@tcp6=r1, 0x1}, 0x20) 25.232036536s ago: executing program 32 (id=2223): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x12, 0x1, 0x4, 0x2}, 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r0, &(0x7f00000003c0), &(0x7f0000000580)=@tcp=r2}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r0, 0x0, &(0x7f0000000300)=@tcp6=r1, 0x1}, 0x20) 4.827742726s ago: executing program 0 (id=2782): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYBLOB="68000000140001002bbd7000fbdbdf25000000000000000000000000000000007f00000100000000000000000000000000000080000700000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000020000000c00080008400800010000000c"], 0x68}}, 0x4004040) 4.827180726s ago: executing program 0 (id=2783): bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000004a80)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, 0x0}, 0x800) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f00000002c0), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 4.772194808s ago: executing program 0 (id=2784): bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = gettid() r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={0x0}, 0x0, 0x2, 0xfffffffe, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000800000000000000080000006b11790000000000950000000000000086a01daad08289a8473e56551a8bdef7a27248611b7ddd90ccc04164e4cd7e71fafede4e29d7d8acad25185dd5b20cae7e68662febafe1d6a3882bc058e429ff09000000deec3c9c6ecc6913409930ac5bab019f3021b522150148132fc128"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x1e, 0x4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x5a2119bf86ff29ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00}, 0x94) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="39000000140081ae0000dc676f97daf01e2357f9ffffffffffffff0521018701546fabca1b4e8a06a6580e88370200c54c1960b89c40ebb373", 0x39}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000600)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67100000000000560602000fff00006706000020000000170200000ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffbd35010000000000840400000000000014000000100000009500000000000000db13d5d8b741f2cdaabc8383c8f56b8c2b848b00ea6553f304000000815dcf00c3ee7b042d1937ba52037fdedb2150e1918c30b6301f0212feb0cff9fc67357d81b2cc1a9e37d7b75c020b070000003eb22062bafaca036d9ec7"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec600831aa9d3944e60bc2ad06a619c560aa0118b28f68f1eb14549d633b4b23f179fb680716faa43414787559be90843c35ab30acad8a6740140e00721abc2eb362f7bde53b3c992d3e28ccc20ec84fdc569947047f6c09a647ee8c0a74", 0x75}], 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000000010104000000000000000002000000240001801400018008000100ba1e000108000200e00000010c00028805000100"], 0x38}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a000014000280100014800c00158008"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="b707000000000000cf3a646311a300001b0000070000000000000095000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="7b050000000000007112180000000000bc20100000000000950000000000000020ee51fbb64aeb1929611f7c1f40768feebc6e66cd10e54bf22b331676cea1488263d14e9e3cb7f7facf9082ee6f31db22010000007ee1168682e2f387dd12c85db0e7de530af0bde41fcdc84fbd75bdc287953491c2e39531c9ec65ef55d1707391af9217568bf5959ca6367a28fd9fc6979022d22c7ed344b1c15c4dacaae2a0b7f9b80f0806ab4dc6d68ef351ed3299e15b2f1e7742d10a888249ec8ea62ceb1e8766fb5b899ebbab4af07e9cd310257b2fce135a72b14558716f1c61e5"], &(0x7f0000003ff6)='GPL\x00', 0xa, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, 0x0, 0x0) perf_event_open(&(0x7f0000000540)={0x0, 0x80, 0x0, 0xfc, 0x0, 0x0, 0x0, 0x5d35, 0x4000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x8, 0x80000001}, 0x100000, 0x3, 0x0, 0x7, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 4.403216425s ago: executing program 0 (id=2789): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x9, 0x98, 0x0, 0x2, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r4) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000001c0)='ns/net\x00') r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r7 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000240)=r6, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r7, r3, 0x4, r3}, 0x10) 4.222107784s ago: executing program 0 (id=2795): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r1], 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000740)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x1, 0x3, 0x5, 0x9b, @b={0x3, 0x3, 0x4, 0x1, 0xe, 0xf0, 0xd, {}, 0x3, 0x1, 0xd, 0x18, 0x8a, "e1f9ec1a2a2bf352234c86a744745ab75e15acc17ec97dcdd3f01cea87d3f97d695e66f64b86303762eb14ce6599be338874339db0b991d0464e9e52c7fe98b8af0c9981a169042c0f83a3da26529e57c4d00b97b6175653e8032966b4b0414ff6de81a2522a6a4487e2e02da3c94b275545b1604f631e7aea6412c11a850bcd23adfee8d70693870d3e"}}, 0x9a) 4.151356697s ago: executing program 0 (id=2798): io_setup(0x8, &(0x7f0000000000)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x103000, 0x0) ioctl$SNAPSHOT_AVAIL_SWAP_SIZE(r3, 0x80083313, 0x0) socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket$nl_netfilter(0x10, 0x3, 0xc) 4.035833032s ago: executing program 4 (id=2804): bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020705200000000002020207b0ae8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000007a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$packet(0x11, 0x2, 0x300) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000940)=ANY=[], 0xfc}}, 0x0) 3.972829005s ago: executing program 4 (id=2808): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0xc53a, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x4048090) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 3.036259169s ago: executing program 5 (id=2812): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0xe, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000180)={r0, 0xffffffffffffffff, 0x26, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x401, 0x0, 0x1, 0xffffffffffffffff}}, 0x40) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2, 0x4}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}]}}, 0x0, 0x5a, 0x0, 0x3}, 0x28) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.time\x00', 0x26e1, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2980, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000780)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}, 0x10020) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x2, 0x0, 0x0, &(0x7f0000000740)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x3e, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r1}, 0x94) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000000)) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x4b) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_virt_wifi\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8946, &(0x7f0000000080)) 2.968270872s ago: executing program 4 (id=2814): bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) close(0x3) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000004a80)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, 0x0}, 0x800) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r2, &(0x7f00000002c0), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) 2.521803283s ago: executing program 5 (id=2815): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc05, {0x0, 0x0, 0x0, r7, {0x0, 0xfff3}, {0xffff, 0xb}, {0xfff3, 0x4}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.404247978s ago: executing program 2 (id=2816): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000d40)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {0x1, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x7fffffff}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) 2.380783699s ago: executing program 2 (id=2817): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000000c0)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="3bf81bb9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x1) 2.296268733s ago: executing program 4 (id=2818): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x101140, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'rose0\x00', 0x112}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r1, 0x27, 0xe, 0x0, &(0x7f0000000080)="f8ad48cc02cb29dcc8007f5b88a8", 0x0, 0x4, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x1e) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x3, 0x2d1}, 0x20a8, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={&(0x7f0000000000), 0x0, &(0x7f00000001c0)={&(0x7f0000000540)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0x1234, 0x0, 0x0, 0xa}, {@in6=@loopback, 0x4d2, 0x33}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth_trunc={0x60, 0x14, {{'hmac(sha1)\x00'}, 0xa0, 0xa0, '01234567890123456789'}}]}, 0x150}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r3, &(0x7f0000000200)={&(0x7f0000000400)={0xa, 0x1234, 0x4, @loopback}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000300)="00112233", 0x4}], 0x1, &(0x7f0000000a00)=[@hopopts={{0x90, 0x29, 0x36, {0x2e, 0xe, '\x00', [@calipso={0x7, 0x8, {0x1, 0x0, 0x8, 0x400}}, @generic={0x4, 0x23, "2eb6eb53225381000000000000008cdb77f57211809f58a7ded5b51018f0071012802d"}, @enc_lim={0x4, 0x1, 0x3}, @hao={0xc9, 0x10, @private2}, @padn={0x1, 0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @hao={0xc9, 0x10, @remote}, @hao={0xc9, 0x10, @loopback}]}}}], 0x90}, 0x0) 2.226491657s ago: executing program 5 (id=2821): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) perf_event_open(0x0, 0x0, 0x5, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, 0x0, &(0x7f0000000040), 0x1003}, 0x38) socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) socketpair(0x1, 0x2, 0x0, &(0x7f0000000000)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000003f80000850000008600000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2.192416148s ago: executing program 4 (id=2822): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x4000) r1 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1c, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0x4}, 0x94) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x4e21, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e068000000110000000000000000dbc790ad000000fc000000000000001400000000000000000000000100000004000000000000001c000000000000000000000008"], 0x68}, 0x40400c4) 2.15403134s ago: executing program 4 (id=2823): r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000040)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000080), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r1], 0x1c}}, 0x0) write$nci(r0, &(0x7f0000000740)=@NCI_OP_RF_INTF_ACTIVATED_NTF={0x1, 0x1, 0x3, 0x5, 0x9b, @b={0x3, 0x3, 0x4, 0x1, 0xe, 0xf0, 0xd, {}, 0x3, 0x1, 0xd, 0x18, 0x8c, "e1f9ec1a2a2bf352234c86a744745ab75e15acc17ec97dcdd3f01cea87d3f97d695e66f64b86303762eb14ce6599be338874339db0b991d0464e9e52c7fe98b8af0c9981a169042c0f83a3da26529e57c4d00b97b6175653e8032966b4b0414ff6de81a2522a6a4487e2e02da3c94b275545b1604f631e7aea6412c11a850bcd23adfee8d70693870d3e5813"}}, 0x9c) 2.108851902s ago: executing program 5 (id=2825): r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, 0x0, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x142, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0, 0xa}, 0x10a90d, 0x8, 0x9, 0x4, 0x0, 0x0, 0x6}, 0x0, 0x1, 0xffffffffffffffff, 0x8) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000008000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) r4 = socket$kcm(0x2b, 0x1, 0x0) close(r4) r5 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r5, 0x1, 0xd, &(0x7f0000000200), 0x2f) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x30, 0x1402, 0x1, 0x70bd27, 0x25dfdbfb, "", [@RDMA_NLDEV_NET_NS_FD={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000880}, 0x400c010) sendmsg$kcm(r0, &(0x7f0000000280)={&(0x7f0000000100)=@phonet={0x23, 0x0, 0x0, 0x17}, 0x80, 0x0}, 0x0) 2.050841545s ago: executing program 5 (id=2829): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r0, &(0x7f0000001180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f00000008c0)="1a4327465638b8670e9ef99039dc0f60eb2cde85b2639882576537b3beb8b09ca7dd2c4972f132eb493ac7a3dd19bf1a9b8aacd86b333646a9e5342d840708bcd9aa55104cfedd028566dffeaf06fdb5f2d372c586b0b89c64700b3d9abdadd9f9fc7a36e68d46b7c9f80f6bd975de3ed294ef", 0x73}, {&(0x7f0000000980)="70c12f0fa84f4fcbfdb9e33365085ad18b6b869d3b7d05d8f7610180cb11c7f13b66eeb4156bfbb3f635a7dfde1719e1f90fe56dbf21f901857a7eafcf9fde47342a2d78eeb82a302413a3bfdb1c939d405fa6a8234f082b80073226b42969805f104a28759b329d3b6afc406f0d36cbc7d0a61ccbfb631af5416206c4c57c76bd167a93d23cf3783c3febaf24be3685637891f8380306980cd8505739f0", 0x9e}, {&(0x7f0000000a40)="73778c0d766ea105fb79d14c301c6080916c289dc3cfad072f0c96f3fefe267e50eed86d9dfc2921cfe6832450c74b23b3053fb0b963449a26650154545ebfa628468dd509ed54f0aefa06c53ee50750a8f75171be2ccf7a0028f94b6aabf6840340d42157adb59b312e95fb21235f2218b20122fe6a70986f5898d64dfb232a5ed4b5e33d2fc3d4625f96ea7e33efc27bacf87905e1fa8220799ffd2e29c67f48e620a307ed4adb8877506211626dedb8faef37535e9ae3b631078ca2f380a3389ca59c8aa73a27651d4a56ac19950c4bd9d149dbb783b01ce1d8ea832b73847494cf5c32919a5f587996b7b7779762f30c", 0xf2}, {&(0x7f0000000b40)="abf5afe05d4f96614c55e2f4df6e139dbd36b34c6a2b15fd05000e53386f5afad3466fe4dc987d0d6f43b83de758521a3df4da6263843c6c3c449953489752d7d0dfc0a307b6413fb553528a04d888cb07cfb8b4698d47ab8d1627b4c6401e0ee5fdb4dcdbd98b78a17e8aa80d2e042f76dd6b22de5542bd5bdde2ce3e0878fe", 0x80}], 0x4, &(0x7f0000000e00)=ANY=[@ANYBLOB="d8"], 0xd8}}], 0x2, 0x2090) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) write(r0, &(0x7f0000001e00)="39270725d93c4ab6cb559938ef75d3d7fd5c06a228a59b717b6934bdefb8b8e2dfca955f26b8cab29bdfdce27e4f9cb112fe41e0a6799578f252519cd4a289985be050d209b4c9617cfb94f1bed81696b0c741f6d366efd7ad3dc7cef66647abaf4108076fdffecb7457f5b6b01835a3c79b873f6ebbcb5ee659861a7b4cce43711bbd6b13c941fbb38ef7e1fe0c70fa4aa49b98b43615605d51cc4d742b364a4e7a2f3dee73b86af3fa4ca8f616eaaedcf155820e1767f7d66ecd818ece03f32c3367bbd9ce6656123f394b7f26f1e0420a9ac4cb25638c75fc3c487ba76fd64c26da6d7ce7f1ee8f49d6e9cc95f5c94bf93183ebf8e6be081e0b9f34bd6c2fe5f895dc1cc01e3018cef11ad9e2e1baf35254258efbaf3e8898f561bdb5c4c49f9d3146503df48e194ea3d06396e970ea9fc7c47eb9988477ed1a7e8641dfeea7b57b5a9967c58762574262efde8795f20f2d45e964ede39c7a6502c03f863e6a21a33ba324e6474d4f0495054745f3a80e6554d4d1fd5ddbca11c5e3e6f9087ca1981a14baa3a2956faa8f6b1652e8cf30d7c37a060bc6c836862451c4e76fc9cb221db8d4b449c27aa44564cb33ef144ed0c51bdd66675302692d979297f30e2d9523f85afbbf54c5b5e2261f8b792f83b33cca78c44a5c4e6ff96273979acbb447d49c0502cc9f8991e9bc784a2e978912d8102d867b631d54269936f54bb20ee57e2b4ba4b6c44e767aef24f6c3a8bb5a3b2084d793082e4c5e517694b220e35ac140913e0e55257af03c4dcf376f24773642c14279e2b55906b0b8a4a34fa4d73f37a5feeca1cf93395b998ddcc557d0e2ae112cf1566f7097e7acb6c0bdf9350781341bb83936b355779417839a70c3cbe13e9561b0820df44dbd2a24bd3d6d8b0d9e83983cb7ad8f147f980b06be823e93a93395f5e60b7f31f5aeadc81f02e177446888c15d2845fd675b98360ac2f584a8ab618789499babac77e3311c563fa519a8dbbe49b91a46cc355f8e956c04dfc3b8e218dbe0302ff463fc94eceec7050b7477d9542f6d05d36ee13e664dfc0bb165601e6bd70615f3c299a9c7c7004cc9987a76afc54b3c83e5d23c0790f39593437b2592cf0548f21823f61076340a87dae9d3427acc844357d6bdbba726e7a41eb30a916df698ab241b5e4991f41d34afd2c2b99f259ca582f09c8027c3381e64070aad6ec7f7c7c973d55a33eca3cc4245bf488a497ac966aa13", 0x371) 2.011824487s ago: executing program 5 (id=2831): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc05, {0x0, 0x0, 0x0, r7, {0x0, 0xfff3}, {0xffff, 0xb}, {0xfff3, 0x4}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.525570499s ago: executing program 2 (id=2842): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x4000) r1 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1c, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800"/13], 0x0, 0x4}, 0x94) sendmsg$inet(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x4e21, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e068000000110000000000000000dbc790ad000000fc000000000000001400000000000000000000000100000004000000000000001c000000000000000000000008"], 0x68}, 0x40400c4) 1.495545061s ago: executing program 2 (id=2844): socket$kcm(0x2, 0x3, 0x84) close(0xffffffffffffffff) recvmsg(0xffffffffffffffff, 0x0, 0x10020) r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x6c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xe, 0x1, 'hashlimit\x00'}, @NFTA_MATCH_REV={0x8, 0x2, 0x1, 0x0, 0x1}]}}}, {0x10, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xe0}}, 0x0) 1.436611343s ago: executing program 2 (id=2845): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f00000001c0)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.372226097s ago: executing program 2 (id=2846): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000001000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) syz_clone3(&(0x7f000000dd80)={0x100000, 0x0, 0x0, 0x0, {0x13}, 0x0, 0x0, 0x0, 0x0}, 0x58) r1 = msgget$private(0x0, 0x40a) msgrcv(r1, 0x0, 0x0, 0x3, 0x2000) syz_clone3(0x0, 0x0) 126.430574ms ago: executing program 3 (id=2855): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB], &(0x7f0000000180)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b00)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 96.451886ms ago: executing program 3 (id=2856): r0 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="06000000040000000800000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={r1, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x6, 0x6, &(0x7f0000000500)=ANY=[@ANYRES32=r2, @ANYRESHEX=r0, @ANYBLOB="71403969451dab41607da6831e6b0b8e7a120f2cc1b1fff90fbf9c5f0f72fdb55d492eb3f8953173e3db7dfb727bd92e61cbd57fe5934fc2e6cc7b3f6409cb7711d98826eb8891cd54e6880a5dd1d75344c6537cdff97482e6671bc24565f0f78d7a4d3161a274abfbabbf0d9f58c515625a0f49c23f3440c3bea0ab50031a6db00f3b2cbe0cf58bc195a927f0d83a5257cae5ff7afd8246715ffbc99aee7f575558477913d31649d9812870bc248cbbfbcdebb2169ec4faf62f44", @ANYRESHEX=r1, @ANYRES16=r1], &(0x7f0000000d40)='syzkaller\x00', 0xd04, 0x0, 0x0, 0x41100, 0x0, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xff54}, 0x94) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x4, @perf_bp={0x0, 0x3}, 0x100288, 0x2, 0xfffffffe, 0x0, 0x0, 0x72b9}, 0x0, 0x3, r0, 0x3) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x11, 0x68, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x1}, 0x1000, 0x1, 0xffffff7e, 0x8, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x2, 0x0, 0x3, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x215, 0x3fd, 0xfffffffa, 0x0, 0xfffffffffffffffd, 0x1, 0xffff, 0x0, 0x10}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'netdevsim0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x3d) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000080)) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0, &(0x7f0000000300)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x5e, 0x8, 0x0, 0x0}}, 0x10) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r4, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000010) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd27, 0x25dfdbff, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'gretap0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x44800) socket$nl_netfilter(0x10, 0x3, 0xc) 96.249236ms ago: executing program 3 (id=2857): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b702000003f80000850000008600000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 62.112657ms ago: executing program 3 (id=2858): perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x4b7f, 0x8}, 0x8f, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1b, 0x3, &(0x7f0000000580)=@framed={{0x18, 0x5}}, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x200, 0x70bd27, 0x0, {{@in6=@mcast2, @in6=@ipv4={'\x00', '\xff\xff', @private=0xa0100fd}, 0x0, 0x5, 0x0, 0x3, 0xa, 0x20, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xae, 0xfff, 0xffffffffffffffff, 0x400, 0xffffffffffffffff, 0x7fffffff, 0x10000}, {0x2, 0xa00, 0x40800000000000, 0xd21}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x4d3, 0x3c}, 0x0, @in6=@empty, 0x0, 0x4, 0x3, 0x0, 0x49}]}]}, 0xfc}}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB], 0xfc}}, 0x0) r1 = socket$kcm(0xa, 0x5, 0x0) sendmsg$kcm(r1, &(0x7f0000002dc0)={&(0x7f0000001640)=@l2tp6={0xa, 0xfc00, 0x0, @local, 0x3}, 0x80, &(0x7f0000000000)=[{&(0x7f00000002c0)='\t', 0x1}], 0x1}, 0x41) 61.590117ms ago: executing program 3 (id=2859): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000004a80)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10}, 0xc, 0x0}, 0x800) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r1, &(0x7f00000002c0), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 0s ago: executing program 3 (id=2860): r0 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000800000002130000ffff000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) close(0xffffffffffffffff) close(0xffffffffffffffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="fc0000001900010000000000000000893ad4cf00000000000000000000000000fc0100"/47, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000000800"/107], 0xfc}}, 0x408) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x1f00c00e}, 0x2004c001) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000001c0), 0x1103, r1}, 0x38) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r5, &(0x7f0000000780)}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000540)={{r1, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)='%+9llu \x00'}, 0x20) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000880), 0x531c, r6}, 0x38) kernel console output (not intermixed with test programs): ="syz.3.983" path="/242/file0" dev="tmpfs" ino=1299 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 137.741437][ T6356] FAULT_INJECTION: forcing a failure. [ 137.741437][ T6356] name failslab, interval 1, probability 0, space 0, times 0 [ 137.741473][ T6356] CPU: 1 UID: 0 PID: 6356 Comm: syz.2.986 Not tainted syzkaller #0 PREEMPT(lazy) [ 137.741502][ T6356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 137.741515][ T6356] Call Trace: [ 137.741563][ T6356] [ 137.741573][ T6356] __dump_stack+0x1d/0x30 [ 137.741602][ T6356] dump_stack_lvl+0x95/0xd0 [ 137.741658][ T6356] dump_stack+0x15/0x1b [ 137.741683][ T6356] should_fail_ex+0x262/0x280 [ 137.741712][ T6356] ? tcf_idr_create+0x41/0x4a0 [ 137.741746][ T6356] should_failslab+0x8c/0xb0 [ 137.741778][ T6356] __kmalloc_noprof+0xd0/0x4d0 [ 137.741864][ T6356] ? tcf_idr_create+0x41/0x4a0 [ 137.741903][ T6356] tcf_idr_create+0x41/0x4a0 [ 137.741958][ T6356] ? tcf_idr_check_alloc+0x24b/0x2e0 [ 137.742022][ T6356] tcf_ife_init+0x466/0x8a0 [ 137.742053][ T6356] ? __pfx_tcf_ife_init+0x10/0x10 [ 137.742078][ T6356] tcf_action_init_1+0x395/0x4d0 [ 137.742150][ T6356] tcf_action_init+0x29d/0x700 [ 137.742202][ T6356] tc_ctl_action+0x29e/0x860 [ 137.742250][ T6356] ? __pfx_tc_ctl_action+0x10/0x10 [ 137.742302][ T6356] rtnetlink_rcv_msg+0x6a7/0x720 [ 137.742334][ T6356] netlink_rcv_skb+0x11e/0x220 [ 137.742373][ T6356] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 137.742430][ T6356] rtnetlink_rcv+0x1c/0x30 [ 137.742457][ T6356] netlink_unicast+0x5a9/0x680 [ 137.742568][ T6356] netlink_sendmsg+0x5be/0x6f0 [ 137.742608][ T6356] ? __pfx_netlink_sendmsg+0x10/0x10 [ 137.742662][ T6356] ____sys_sendmsg+0x532/0x580 [ 137.742776][ T6356] ___sys_sendmsg+0x195/0x1e0 [ 137.742831][ T6356] __x64_sys_sendmsg+0xd4/0x160 [ 137.742858][ T6356] x64_sys_call+0x22ab/0x2550 [ 137.742885][ T6356] do_syscall_64+0x112/0x360 [ 137.742920][ T6356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 137.743005][ T6356] RIP: 0033:0x7f1b5483e159 [ 137.743025][ T6356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 137.743045][ T6356] RSP: 002b:00007f1b53297028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 137.743093][ T6356] RAX: ffffffffffffffda RBX: 00007f1b54ac5fa0 RCX: 00007f1b5483e159 [ 137.743111][ T6356] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 137.743127][ T6356] RBP: 00007f1b548d506b R08: 0000000000000000 R09: 0000000000000000 [ 137.743143][ T6356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 137.743159][ T6356] R13: 00007f1b54ac6038 R14: 00007f1b54ac5fa0 R15: 00007ffdfc79b828 [ 137.743180][ T6356] [ 137.864081][ T29] audit: type=1400 audit(1789933392.212:479): avc: denied { bind } for pid=6358 comm="syz.4.988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 137.867486][ T6359] netlink: 24 bytes leftover after parsing attributes in process `syz.3.987'. [ 137.867507][ T6359] netlink: 48 bytes leftover after parsing attributes in process `syz.3.987'. [ 137.875074][ T6356] syz.2.986 (6356) used greatest stack depth: 9960 bytes left [ 137.879339][ T29] audit: type=1400 audit(1789933392.232:480): avc: denied { setopt } for pid=6358 comm="syz.4.988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 137.881151][ T29] audit: type=1400 audit(1789933392.242:481): avc: denied { listen } for pid=6358 comm="syz.4.988" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 138.236928][ T6377] 9p: Bad value for 'wfdno' [ 138.437133][ T6388] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1000'. [ 138.437154][ T6388] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1000'. [ 138.582442][ T6393] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1001'. [ 139.302322][ T6412] 9p: Bad value for 'wfdno' [ 139.540500][ T6428] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1015'. [ 139.542202][ T6428] FAULT_INJECTION: forcing a failure. [ 139.542202][ T6428] name fail_futex, interval 1, probability 0, space 0, times 0 [ 139.542236][ T6428] CPU: 1 UID: 0 PID: 6428 Comm: syz.2.1015 Not tainted syzkaller #0 PREEMPT(lazy) [ 139.542262][ T6428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 139.542325][ T6428] Call Trace: [ 139.542332][ T6428] [ 139.542381][ T6428] __dump_stack+0x1d/0x30 [ 139.542413][ T6428] dump_stack_lvl+0x95/0xd0 [ 139.542480][ T6428] dump_stack+0x15/0x1b [ 139.542504][ T6428] should_fail_ex+0x262/0x280 [ 139.542595][ T6428] should_fail+0xb/0x20 [ 139.542620][ T6428] get_futex_key+0x12d/0xb10 [ 139.542646][ T6428] ? ref_tracker_free+0x380/0x3f0 [ 139.542669][ T6428] futex_wait_setup+0x49/0x3e0 [ 139.542733][ T6428] ? __pfx_min_vruntime_cb_rotate+0x10/0x10 [ 139.542802][ T6428] ? hrtimer_active+0xe4/0x110 [ 139.542854][ T6428] __futex_wait+0xa9/0x260 [ 139.542878][ T6428] ? __pfx_futex_wake_mark+0x10/0x10 [ 139.542915][ T6428] futex_wait+0x98/0x1c0 [ 139.542958][ T6428] do_futex+0x391/0x460 [ 139.542988][ T6428] __se_sys_futex+0x2f6/0x370 [ 139.543030][ T6428] __x64_sys_futex+0x78/0x90 [ 139.543064][ T6428] x64_sys_call+0x22e2/0x2550 [ 139.543131][ T6428] do_syscall_64+0x112/0x360 [ 139.543173][ T6428] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 139.543243][ T6428] RIP: 0033:0x7f1b5483e159 [ 139.543262][ T6428] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 139.543301][ T6428] RSP: 002b:00007f1b532970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 139.543321][ T6428] RAX: ffffffffffffffda RBX: 00007f1b54ac5fa8 RCX: 00007f1b5483e159 [ 139.543335][ T6428] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1b54ac5fa8 [ 139.543351][ T6428] RBP: 00007f1b54ac5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 139.543367][ T6428] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 139.543382][ T6428] R13: 00007f1b54ac6038 R14: 00007ffdfc79b740 R15: 00007ffdfc79b828 [ 139.543403][ T6428] [ 139.653071][ T6424] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1013'. [ 139.653095][ T6424] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1013'. [ 140.415746][ T29] kauditd_printk_skb: 4 callbacks suppressed [ 140.415769][ T29] audit: type=1326 audit(1789933394.762:486): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 140.416505][ T29] audit: type=1326 audit(1789933394.772:487): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 140.416900][ T29] audit: type=1326 audit(1789933394.772:488): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 140.474367][ T29] audit: type=1326 audit(1789933394.822:489): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 140.478536][ T29] audit: type=1326 audit(1789933394.832:490): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f1b5483dec2 code=0x7ffc0000 [ 140.955926][ T6460] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1027'. [ 140.956139][ T6460] FAULT_INJECTION: forcing a failure. [ 140.956139][ T6460] name fail_futex, interval 1, probability 0, space 0, times 0 [ 140.956165][ T6460] CPU: 1 UID: 0 PID: 6460 Comm: syz.1.1027 Not tainted syzkaller #0 PREEMPT(lazy) [ 140.956194][ T6460] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 140.956248][ T6460] Call Trace: [ 140.956255][ T6460] [ 140.956263][ T6460] __dump_stack+0x1d/0x30 [ 140.956290][ T6460] dump_stack_lvl+0x95/0xd0 [ 140.956318][ T6460] dump_stack+0x15/0x1b [ 140.956411][ T6460] should_fail_ex+0x262/0x280 [ 140.956436][ T6460] should_fail+0xb/0x20 [ 140.956460][ T6460] get_futex_key+0x12d/0xb10 [ 140.956490][ T6460] ? ref_tracker_free+0x380/0x3f0 [ 140.956585][ T6460] futex_wait_setup+0x49/0x3e0 [ 140.956736][ T6460] ? __pfx_min_vruntime_cb_rotate+0x10/0x10 [ 140.956767][ T6460] ? hrtimer_active+0xe4/0x110 [ 140.956793][ T6460] __futex_wait+0xa9/0x260 [ 140.956900][ T6460] ? __pfx_futex_wake_mark+0x10/0x10 [ 140.956969][ T6460] futex_wait+0x98/0x1c0 [ 140.956991][ T6460] do_futex+0x391/0x460 [ 140.957018][ T6460] __se_sys_futex+0x2f6/0x370 [ 140.957047][ T6460] __x64_sys_futex+0x78/0x90 [ 140.957119][ T6460] x64_sys_call+0x22e2/0x2550 [ 140.957145][ T6460] do_syscall_64+0x112/0x360 [ 140.957179][ T6460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 140.957276][ T6460] RIP: 0033:0x7fbd0351e159 [ 140.957316][ T6460] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 140.957337][ T6460] RSP: 002b:00007fbd01f770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 140.957362][ T6460] RAX: ffffffffffffffda RBX: 00007fbd037a5fa8 RCX: 00007fbd0351e159 [ 140.957382][ T6460] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fbd037a5fa8 [ 140.957397][ T6460] RBP: 00007fbd037a5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 140.957413][ T6460] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 140.957426][ T6460] R13: 00007fbd037a6038 R14: 00007fff26466170 R15: 00007fff26466258 [ 140.957477][ T6460] [ 141.409140][ T29] audit: type=1400 audit(1789933395.762:491): avc: denied { write } for pid=6466 comm="syz.1.1031" path="socket:[12874]" dev="sockfs" ino=12874 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 141.467664][ T29] audit: type=1326 audit(1789933395.822:492): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 141.469169][ T29] audit: type=1326 audit(1789933395.822:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 141.470060][ T29] audit: type=1326 audit(1789933395.822:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f1b5483df57 code=0x7ffc0000 [ 141.470091][ T29] audit: type=1326 audit(1789933395.822:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6448 comm="syz.2.1023" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f1b547fae51 code=0x7ffc0000 [ 141.935630][ T6488] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1038'. [ 142.158672][ T6505] syzkaller0: entered promiscuous mode [ 142.158694][ T6505] syzkaller0: entered allmulticast mode [ 142.274167][ T6517] FAULT_INJECTION: forcing a failure. [ 142.274167][ T6517] name fail_futex, interval 1, probability 0, space 0, times 0 [ 142.274200][ T6517] CPU: 1 UID: 0 PID: 6517 Comm: syz.3.1052 Not tainted syzkaller #0 PREEMPT(lazy) [ 142.274301][ T6517] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 142.274312][ T6517] Call Trace: [ 142.274369][ T6517] [ 142.274378][ T6517] __dump_stack+0x1d/0x30 [ 142.274443][ T6517] dump_stack_lvl+0x95/0xd0 [ 142.274464][ T6517] dump_stack+0x15/0x1b [ 142.274484][ T6517] should_fail_ex+0x262/0x280 [ 142.274511][ T6517] should_fail+0xb/0x20 [ 142.274540][ T6517] get_futex_key+0x12d/0xb10 [ 142.274626][ T6517] ? ref_tracker_free+0x380/0x3f0 [ 142.274654][ T6517] futex_wait_setup+0x49/0x3e0 [ 142.274721][ T6517] ? __cgroup_account_cputime+0x83/0xa0 [ 142.274745][ T6517] ? update_se+0xc1/0x450 [ 142.274768][ T6517] __futex_wait+0xa9/0x260 [ 142.274787][ T6517] ? __pfx_futex_wake_mark+0x10/0x10 [ 142.274876][ T6517] futex_wait+0x98/0x1c0 [ 142.274903][ T6517] do_futex+0x391/0x460 [ 142.274982][ T6517] __se_sys_futex+0x2f6/0x370 [ 142.275010][ T6517] __x64_sys_futex+0x78/0x90 [ 142.275115][ T6517] x64_sys_call+0x22e2/0x2550 [ 142.275285][ T6517] do_syscall_64+0x112/0x360 [ 142.275379][ T6517] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.275405][ T6517] RIP: 0033:0x7f520329e159 [ 142.275425][ T6517] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.275443][ T6517] RSP: 002b:00007f5201cf70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 142.275542][ T6517] RAX: ffffffffffffffda RBX: 00007f5203525fa8 RCX: 00007f520329e159 [ 142.275558][ T6517] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5203525fa8 [ 142.275571][ T6517] RBP: 00007f5203525fa0 R08: 0000000000000000 R09: 0000000000000000 [ 142.275586][ T6517] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.275600][ T6517] R13: 00007f5203526038 R14: 00007ffff2566e90 R15: 00007ffff2566f78 [ 142.275637][ T6517] [ 142.344042][ T6519] loop5: detected capacity change from 0 to 7 [ 142.344655][ T6519] loop5: [ 142.582590][ T6535] loop3: detected capacity change from 0 to 256 [ 142.616156][ T6535] FAT-fs (loop3): IO charset macceltic not found [ 142.783596][ T6552] FAULT_INJECTION: forcing a failure. [ 142.783596][ T6552] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 142.783632][ T6552] CPU: 1 UID: 0 PID: 6552 Comm: syz.3.1067 Not tainted syzkaller #0 PREEMPT(lazy) [ 142.783660][ T6552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 142.783672][ T6552] Call Trace: [ 142.783678][ T6552] [ 142.783686][ T6552] __dump_stack+0x1d/0x30 [ 142.783715][ T6552] dump_stack_lvl+0x95/0xd0 [ 142.783742][ T6552] dump_stack+0x15/0x1b [ 142.783814][ T6552] should_fail_ex+0x262/0x280 [ 142.783844][ T6552] should_fail+0xb/0x20 [ 142.783877][ T6552] should_fail_usercopy+0x1a/0x20 [ 142.783922][ T6552] _copy_to_user+0x20/0xa0 [ 142.783954][ T6552] __x64_sys_clock_adjtime+0x167/0x1d0 [ 142.784000][ T6552] x64_sys_call+0x1f3b/0x2550 [ 142.784023][ T6552] do_syscall_64+0x112/0x360 [ 142.784211][ T6552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 142.784237][ T6552] RIP: 0033:0x7f520329e159 [ 142.784312][ T6552] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.784335][ T6552] RSP: 002b:00007f5201cf7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000131 [ 142.784360][ T6552] RAX: ffffffffffffffda RBX: 00007f5203525fa0 RCX: 00007f520329e159 [ 142.784378][ T6552] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000000 [ 142.784400][ T6552] RBP: 00007f520333506b R08: 0000000000000000 R09: 0000000000000000 [ 142.784412][ T6552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.784425][ T6552] R13: 00007f5203526038 R14: 00007f5203525fa0 R15: 00007ffff2566f78 [ 142.784452][ T6552] [ 143.425452][ T6567] syzkaller0: entered promiscuous mode [ 143.425472][ T6567] syzkaller0: entered allmulticast mode [ 143.510414][ T6242] syz.3.932 (6242) used greatest stack depth: 8240 bytes left [ 143.591804][ T6571] syzkaller0: entered promiscuous mode [ 143.591826][ T6571] syzkaller0: entered allmulticast mode [ 143.959951][ T6597] loop5: detected capacity change from 0 to 7 [ 144.316226][ T6614] sctp: [Deprecated]: syz.4.1092 (pid 6614) Use of int in max_burst socket option deprecated. [ 144.316226][ T6614] Use struct sctp_assoc_value instead [ 144.638602][ T6617] loop1: detected capacity change from 0 to 512 [ 144.652632][ T6617] EXT4-fs: Ignoring removed mblk_io_submit option [ 144.686961][ T6617] EXT4-fs error (device loop1): ext4_iget_extra_inode:5210: inode #15: comm syz.1.1094: corrupted in-inode xattr: e_value size too large [ 144.687128][ T6617] loop1: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 144.687460][ T6617] EXT4-fs error (device loop1): ext4_orphan_get:1408: comm syz.1.1094: couldn't read orphan inode 15 (err -117) [ 144.687484][ T6617] loop1: lost filesystem error report for type 5 error -117 [ 144.688556][ T6617] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 144.812105][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 145.035288][ T6639] __nla_validate_parse: 4 callbacks suppressed [ 145.035306][ T6639] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1103'. [ 145.113548][ T6645] FAULT_INJECTION: forcing a failure. [ 145.113548][ T6645] name failslab, interval 1, probability 0, space 0, times 0 [ 145.113580][ T6645] CPU: 1 UID: 0 PID: 6645 Comm: syz.1.1105 Not tainted syzkaller #0 PREEMPT(lazy) [ 145.113610][ T6645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 145.113635][ T6645] Call Trace: [ 145.113642][ T6645] [ 145.113650][ T6645] __dump_stack+0x1d/0x30 [ 145.113675][ T6645] dump_stack_lvl+0x95/0xd0 [ 145.113702][ T6645] dump_stack+0x15/0x1b [ 145.113725][ T6645] should_fail_ex+0x262/0x280 [ 145.113827][ T6645] ? use_all_metadata+0xac/0x1d0 [ 145.113909][ T6645] should_failslab+0x8c/0xb0 [ 145.113942][ T6645] __kmalloc_cache_noprof+0x7a/0x400 [ 145.113976][ T6645] ? use_all_metadata+0xac/0x1d0 [ 145.114007][ T6645] use_all_metadata+0xac/0x1d0 [ 145.114101][ T6645] tcf_ife_init+0x6ff/0x8a0 [ 145.114127][ T6645] ? __pfx_tcf_ife_init+0x10/0x10 [ 145.114149][ T6645] tcf_action_init_1+0x395/0x4d0 [ 145.114268][ T6645] tcf_action_init+0x29d/0x700 [ 145.114370][ T6645] tc_ctl_action+0x29e/0x860 [ 145.114489][ T6645] ? __pfx_tc_ctl_action+0x10/0x10 [ 145.114521][ T6645] rtnetlink_rcv_msg+0x6a7/0x720 [ 145.114556][ T6645] netlink_rcv_skb+0x11e/0x220 [ 145.114660][ T6645] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 145.114747][ T6645] rtnetlink_rcv+0x1c/0x30 [ 145.114775][ T6645] netlink_unicast+0x5a9/0x680 [ 145.114862][ T6645] netlink_sendmsg+0x5be/0x6f0 [ 145.114894][ T6645] ? __pfx_netlink_sendmsg+0x10/0x10 [ 145.114926][ T6645] ____sys_sendmsg+0x532/0x580 [ 145.114976][ T6645] ___sys_sendmsg+0x195/0x1e0 [ 145.115013][ T6645] __x64_sys_sendmsg+0xd4/0x160 [ 145.115042][ T6645] x64_sys_call+0x22ab/0x2550 [ 145.115085][ T6645] do_syscall_64+0x112/0x360 [ 145.115183][ T6645] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 145.115206][ T6645] RIP: 0033:0x7fbd0351e159 [ 145.115271][ T6645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.115295][ T6645] RSP: 002b:00007fbd01f77028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 145.115320][ T6645] RAX: ffffffffffffffda RBX: 00007fbd037a5fa0 RCX: 00007fbd0351e159 [ 145.115337][ T6645] RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000004 [ 145.115353][ T6645] RBP: 00007fbd035b506b R08: 0000000000000000 R09: 0000000000000000 [ 145.115424][ T6645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 145.115439][ T6645] R13: 00007fbd037a6038 R14: 00007fbd037a5fa0 R15: 00007fff26466258 [ 145.115460][ T6645] [ 146.061644][ T29] kauditd_printk_skb: 15 callbacks suppressed [ 146.061660][ T29] audit: type=1326 audit(1790457688.478:511): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.073335][ T29] audit: type=1326 audit(1790457688.478:512): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.077829][ T29] audit: type=1326 audit(1790457688.499:513): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.078082][ T29] audit: type=1326 audit(1790457688.499:514): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=118 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.078359][ T29] audit: type=1326 audit(1790457688.499:515): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.078879][ T29] audit: type=1326 audit(1790457688.499:516): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.079570][ T29] audit: type=1326 audit(1790457688.499:517): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.080305][ T29] audit: type=1326 audit(1790457688.499:518): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.080531][ T29] audit: type=1326 audit(1790457688.499:519): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=6664 comm="syz.2.1113" exe="/root/ci2-upstream-kcsan-gce/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f1b5483e159 code=0x7ffc0000 [ 146.196180][ T6671] loop5: detected capacity change from 0 to 7 [ 146.358465][ T6676] FAULT_INJECTION: forcing a failure. [ 146.358465][ T6676] name fail_futex, interval 1, probability 0, space 0, times 0 [ 146.358511][ T6676] CPU: 1 UID: 0 PID: 6676 Comm: syz.3.1118 Not tainted syzkaller #0 PREEMPT(lazy) [ 146.358565][ T6676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 146.358580][ T6676] Call Trace: [ 146.358587][ T6676] [ 146.358596][ T6676] __dump_stack+0x1d/0x30 [ 146.358668][ T6676] dump_stack_lvl+0x95/0xd0 [ 146.358696][ T6676] dump_stack+0x15/0x1b [ 146.358755][ T6676] should_fail_ex+0x262/0x280 [ 146.358815][ T6676] should_fail+0xb/0x20 [ 146.358933][ T6676] get_futex_key+0x12d/0xb10 [ 146.358960][ T6676] futex_wake+0x89/0x400 [ 146.358985][ T6676] do_futex+0x3f8/0x460 [ 146.359019][ T6676] __se_sys_futex+0x2f6/0x370 [ 146.359137][ T6676] __x64_sys_futex+0x78/0x90 [ 146.359171][ T6676] x64_sys_call+0x22e2/0x2550 [ 146.359201][ T6676] do_syscall_64+0x112/0x360 [ 146.359238][ T6676] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 146.359269][ T6676] RIP: 0033:0x7f520329e159 [ 146.359293][ T6676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 146.359313][ T6676] RSP: 002b:00007f5201cf70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 146.359339][ T6676] RAX: ffffffffffffffda RBX: 00007f5203525fa8 RCX: 00007f520329e159 [ 146.359356][ T6676] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5203525fac [ 146.359410][ T6676] RBP: 00007f5203525fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 146.359424][ T6676] R10: 0000000000000060 R11: 0000000000000246 R12: 0000000000000000 [ 146.359443][ T6676] R13: 00007f5203526038 R14: 00007ffff2566e90 R15: 00007ffff2566f78 [ 146.359462][ T6676] [ 148.364235][ T6685] Set syz1 is full, maxelem 65536 reached [ 148.409770][ T6737] syzkaller0: entered promiscuous mode [ 148.409794][ T6737] syzkaller0: entered allmulticast mode [ 149.071083][ T29] audit: type=1400 audit(1790457691.574:520): avc: denied { read } for pid=6754 comm="syz.4.1147" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 149.135296][ T6762] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1150'. [ 149.258895][ T6781] syzkaller0: entered promiscuous mode [ 149.258920][ T6781] syzkaller0: entered allmulticast mode [ 149.263335][ T6781] tipc: Enabled bearer , priority 0 [ 149.265583][ T6781] tipc: Resetting bearer [ 149.301526][ T6780] tipc: Resetting bearer [ 149.306758][ T6780] tipc: Disabling bearer [ 149.360170][ T6789] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1159'. [ 149.394250][ T6793] ======================================================= [ 149.394250][ T6793] WARNING: The mand mount option has been deprecated and [ 149.394250][ T6793] and is ignored by this kernel. Remove the mand [ 149.394250][ T6793] option from the mount to silence this warning. [ 149.394250][ T6793] ======================================================= [ 149.395886][ T6792] loop2: detected capacity change from 0 to 512 [ 149.404295][ T6792] EXT4-fs: Ignoring removed mblk_io_submit option [ 149.445783][ T6792] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.1160: corrupted in-inode xattr: e_value size too large [ 149.445818][ T6792] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 149.462156][ T6792] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.1160: couldn't read orphan inode 15 (err -117) [ 149.462191][ T6792] loop2: lost filesystem error report for type 5 error -117 [ 149.462884][ T6792] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 149.529317][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 149.556433][ T6806] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1165'. [ 150.336603][ T6834] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1177'. [ 150.538939][ T6848] loop2: detected capacity change from 0 to 512 [ 150.542722][ T6848] EXT4-fs: dax option not supported [ 150.687989][ T6853] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1186'. [ 150.788174][ T6857] loop1: detected capacity change from 0 to 512 [ 150.794773][ T6857] EXT4-fs: Ignoring removed bh option [ 150.795810][ T6857] EXT4-fs: test_dummy_encryption option not supported [ 150.805392][ T6858] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1188'. [ 150.805455][ T6858] netlink: 'syz.3.1188': attribute type 1 has an invalid length. [ 150.805467][ T6858] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1188'. [ 151.269143][ T6872] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1194'. [ 151.327688][ T6881] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1198'. [ 151.418158][ T6887] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1200'. [ 151.418233][ T6887] netlink: 'syz.2.1200': attribute type 1 has an invalid length. [ 151.418247][ T6887] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1200'. [ 152.069952][ T6907] loop2: detected capacity change from 0 to 1024 [ 152.080381][ T6907] EXT4-fs (loop2): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 152.142601][ T6907] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 2: comm syz.2.1207: lblock 2 mapped to illegal pblock 2 (length 1) [ 152.142695][ T6907] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 152.143145][ T6907] __quota_error: 3 callbacks suppressed [ 152.143159][ T6907] Quota error (device loop2): qtree_write_dquot: dquota write failed [ 152.143238][ T6907] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 48: comm syz.2.1207: lblock 0 mapped to illegal pblock 48 (length 1) [ 152.143268][ T6907] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 152.143425][ T6907] Quota error (device loop2): v2_write_file_info: Can't write info structure [ 152.143490][ T6907] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.1207: Failed to acquire dquot type 0 [ 152.143599][ T6907] loop2: lost filesystem error report for type 5 error -117 [ 152.143906][ T6907] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 152.143936][ T6907] loop2: lost filesystem error report for type 5 error -117 [ 152.144189][ T6907] EXT4-fs error (device loop2): ext4_evict_inode:269: inode #11: comm syz.2.1207: mark_inode_dirty error [ 152.144314][ T6907] loop2: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 152.145093][ T6907] EXT4-fs warning (device loop2): ext4_evict_inode:272: couldn't mark inode dirty (err -117) [ 152.145122][ T6907] EXT4-fs (loop2): 1 orphan inode deleted [ 152.146137][ T6907] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 152.187217][ T313] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:5: lblock 1 mapped to illegal pblock 1 (length 1) [ 152.187406][ T313] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 152.187435][ T313] EXT4-fs error (device loop2): ext4_release_dquot:7105: comm kworker/u8:5: Failed to release dquot type 0 [ 152.188893][ T29] audit: type=1400 audit(1792030558.768:524): avc: denied { write } for pid=6905 comm="syz.2.1207" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 152.188957][ T29] audit: type=1400 audit(1792030558.768:525): avc: denied { create } for pid=6905 comm="syz.2.1207" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=chr_file permissive=1 [ 152.206645][ T6912] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1209'. [ 152.380512][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 152.380641][ T657] EXT4-fs error (device loop2): ext4_map_blocks:790: inode #3: block 1: comm kworker/u8:8: lblock 1 mapped to illegal pblock 1 (length 1) [ 152.380673][ T657] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 152.380931][ T657] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 152.380987][ T657] EXT4-fs error (device loop2): ext4_release_dquot:7105: comm kworker/u8:8: Failed to release dquot type 0 [ 152.381041][ T657] loop2: lost filesystem error report for type 5 error -117 [ 152.381347][ T3309] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 152.381418][ T3309] loop2: lost filesystem error report for type 5 error -117 [ 152.381474][ T3309] EXT4-fs error (device loop2) in ext4_reserve_inode_write:6522: Corrupt filesystem [ 152.381536][ T3309] loop2: lost filesystem error report for type 5 error -117 [ 152.381592][ T3309] EXT4-fs error (device loop2): ext4_quota_off:7353: inode #3: comm syz-executor: mark_inode_dirty error [ 152.381614][ T3309] loop2: lost file I/O error report for ino 3 type 5 pos 0x0 len 0x0 error -117 [ 152.381709][ T3309] EXT4-fs error (device loop2): __ext4_get_inode_loc:4916: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 152.381758][ T3309] loop2: lost filesystem error report for type 5 error -117 [ 152.467395][ T6924] FAULT_INJECTION: forcing a failure. [ 152.467395][ T6924] name fail_futex, interval 1, probability 0, space 0, times 0 [ 152.467502][ T6924] CPU: 0 UID: 0 PID: 6924 Comm: syz.2.1214 Not tainted syzkaller #0 PREEMPT(lazy) [ 152.467530][ T6924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 152.467542][ T6924] Call Trace: [ 152.467550][ T6924] [ 152.467559][ T6924] __dump_stack+0x1d/0x30 [ 152.467584][ T6924] dump_stack_lvl+0x95/0xd0 [ 152.467693][ T6924] dump_stack+0x15/0x1b [ 152.467713][ T6924] should_fail_ex+0x262/0x280 [ 152.467798][ T6924] should_fail+0xb/0x20 [ 152.467895][ T6924] get_futex_key+0x12d/0xb10 [ 152.467988][ T6924] ? _raw_spin_unlock_irqrestore+0x9/0x30 [ 152.468017][ T6924] futex_wait_setup+0x49/0x3e0 [ 152.468039][ T6924] __futex_wait+0xa9/0x260 [ 152.468080][ T6924] ? __pfx_futex_wake_mark+0x10/0x10 [ 152.468126][ T6924] futex_wait+0x98/0x1c0 [ 152.468147][ T6924] do_futex+0x391/0x460 [ 152.468248][ T6924] ? irqentry_exit+0x7d/0x610 [ 152.468280][ T6924] __se_sys_futex+0x2f6/0x370 [ 152.468324][ T6924] __x64_sys_futex+0x78/0x90 [ 152.468408][ T6924] x64_sys_call+0x22e2/0x2550 [ 152.468438][ T6924] do_syscall_64+0x112/0x360 [ 152.468549][ T6924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 152.468601][ T6924] RIP: 0033:0x7f1b5483e159 [ 152.468617][ T6924] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 152.468636][ T6924] RSP: 002b:00007f1b532970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 152.468661][ T6924] RAX: ffffffffffffffda RBX: 00007f1b54ac5fa8 RCX: 00007f1b5483e159 [ 152.468679][ T6924] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f1b54ac5fa8 [ 152.468740][ T6924] RBP: 00007f1b54ac5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 152.468753][ T6924] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 152.468765][ T6924] R13: 00007f1b54ac6038 R14: 00007ffdfc79b740 R15: 00007ffdfc79b828 [ 152.468784][ T6924] [ 152.855585][ T29] audit: type=1400 audit(1792030559.457:526): avc: denied { mount } for pid=6929 comm="syz.4.1218" name="/" dev="sysfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 152.873940][ T29] audit: type=1400 audit(1792030559.478:527): avc: denied { unmount } for pid=3302 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 152.916158][ T6938] loop4: detected capacity change from 0 to 512 [ 152.916644][ T6938] EXT4-fs: Ignoring removed mblk_io_submit option [ 152.928481][ T6938] EXT4-fs error (device loop4): ext4_iget_extra_inode:5210: inode #15: comm syz.4.1221: corrupted in-inode xattr: e_value size too large [ 152.928513][ T6938] loop4: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 152.929004][ T6938] EXT4-fs error (device loop4): ext4_orphan_get:1408: comm syz.4.1221: couldn't read orphan inode 15 (err -117) [ 152.929034][ T6938] loop4: lost filesystem error report for type 5 error -117 [ 152.931343][ T6938] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 152.986355][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 154.660976][ T7021] loop4: detected capacity change from 0 to 512 [ 154.661372][ T7021] EXT4-fs: dax option not supported [ 154.665752][ T29] audit: type=1400 audit(1792030561.316:528): avc: denied { create } for pid=7010 comm="syz.1.1246" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 154.826316][ T7029] loop5: detected capacity change from 0 to 7 [ 155.523904][ T7054] loop3: detected capacity change from 0 to 512 [ 155.655681][ T7063] loop3: detected capacity change from 0 to 2048 [ 155.687910][ T7063] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 155.689435][ T29] audit: type=1400 audit(1792030562.361:529): avc: denied { write } for pid=7061 comm="syz.3.1264" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 155.742079][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 155.850656][ T7082] FAULT_INJECTION: forcing a failure. [ 155.850656][ T7082] name failslab, interval 1, probability 0, space 0, times 0 [ 155.850690][ T7082] CPU: 0 UID: 0 PID: 7082 Comm: syz.1.1272 Not tainted syzkaller #0 PREEMPT(lazy) [ 155.850720][ T7082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 155.850736][ T7082] Call Trace: [ 155.850745][ T7082] [ 155.850791][ T7082] __dump_stack+0x1d/0x30 [ 155.850822][ T7082] dump_stack_lvl+0x95/0xd0 [ 155.850899][ T7082] dump_stack+0x15/0x1b [ 155.850971][ T7082] should_fail_ex+0x262/0x280 [ 155.851079][ T7082] ? sk_prot_alloc+0x3f/0x180 [ 155.851103][ T7082] should_failslab+0x8c/0xb0 [ 155.851131][ T7082] kmem_cache_alloc_noprof+0x7c/0x3f0 [ 155.851219][ T7082] ? sk_prot_alloc+0x3f/0x180 [ 155.851237][ T7082] ? security_inode_alloc+0x37/0x100 [ 155.851325][ T7082] sk_prot_alloc+0x3f/0x180 [ 155.851346][ T7082] sk_alloc+0x34/0x3e0 [ 155.851437][ T7082] smc_create+0xb7/0x480 [ 155.851458][ T7082] __sock_create+0x2e5/0x580 [ 155.851496][ T7082] __sys_socket+0xaf/0x180 [ 155.851530][ T7082] __x64_sys_socket+0x3f/0x50 [ 155.851558][ T7082] x64_sys_call+0x246e/0x2550 [ 155.851586][ T7082] do_syscall_64+0x112/0x360 [ 155.851624][ T7082] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.851645][ T7082] RIP: 0033:0x7fbd0351e159 [ 155.851729][ T7082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.851799][ T7082] RSP: 002b:00007fbd01f77028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 155.851825][ T7082] RAX: ffffffffffffffda RBX: 00007fbd037a5fa0 RCX: 00007fbd0351e159 [ 155.851842][ T7082] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000002b [ 155.851855][ T7082] RBP: 00007fbd035b506b R08: 0000000000000000 R09: 0000000000000000 [ 155.851871][ T7082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 155.851962][ T7082] R13: 00007fbd037a6038 R14: 00007fbd037a5fa0 R15: 00007fff26466258 [ 155.852015][ T7082] [ 155.974341][ T7089] FAULT_INJECTION: forcing a failure. [ 155.974341][ T7089] name fail_futex, interval 1, probability 0, space 0, times 0 [ 155.974385][ T7089] CPU: 0 UID: 0 PID: 7089 Comm: syz.1.1275 Not tainted syzkaller #0 PREEMPT(lazy) [ 155.974414][ T7089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 155.974427][ T7089] Call Trace: [ 155.974435][ T7089] [ 155.974444][ T7089] __dump_stack+0x1d/0x30 [ 155.974471][ T7089] dump_stack_lvl+0x95/0xd0 [ 155.974494][ T7089] dump_stack+0x15/0x1b [ 155.974549][ T7089] should_fail_ex+0x262/0x280 [ 155.974575][ T7089] should_fail+0xb/0x20 [ 155.974599][ T7089] get_futex_key+0x12d/0xb10 [ 155.974646][ T7089] ? _raw_spin_lock_bh+0x57/0xb0 [ 155.974672][ T7089] futex_wake+0x89/0x400 [ 155.974694][ T7089] do_futex+0x3f8/0x460 [ 155.974725][ T7089] __se_sys_futex+0x2f6/0x370 [ 155.974801][ T7089] __x64_sys_futex+0x78/0x90 [ 155.974830][ T7089] x64_sys_call+0x22e2/0x2550 [ 155.974899][ T7089] do_syscall_64+0x112/0x360 [ 155.974959][ T7089] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 155.974982][ T7089] RIP: 0033:0x7fbd0351e159 [ 155.975000][ T7089] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 155.975020][ T7089] RSP: 002b:00007fbd01f770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 155.975113][ T7089] RAX: ffffffffffffffda RBX: 00007fbd037a5fa8 RCX: 00007fbd0351e159 [ 155.975128][ T7089] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbd037a5fac [ 155.975211][ T7089] RBP: 00007fbd037a5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 155.975226][ T7089] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 155.975240][ T7089] R13: 00007fbd037a6038 R14: 00007fff26466170 R15: 00007fff26466258 [ 155.975260][ T7089] [ 156.093706][ T7101] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1281'. [ 156.100224][ T7101] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1281'. [ 156.263509][ T7115] ip_tables: iptables: counters copy to user failed while replacing table [ 156.353674][ T7126] FAULT_INJECTION: forcing a failure. [ 156.353674][ T7126] name fail_futex, interval 1, probability 0, space 0, times 0 [ 156.353704][ T7126] CPU: 1 UID: 0 PID: 7126 Comm: syz.2.1289 Not tainted syzkaller #0 PREEMPT(lazy) [ 156.353765][ T7126] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 156.353780][ T7126] Call Trace: [ 156.353789][ T7126] [ 156.353797][ T7126] __dump_stack+0x1d/0x30 [ 156.353829][ T7126] dump_stack_lvl+0x95/0xd0 [ 156.353897][ T7126] dump_stack+0x15/0x1b [ 156.353919][ T7126] should_fail_ex+0x262/0x280 [ 156.353949][ T7126] should_fail+0xb/0x20 [ 156.354049][ T7126] get_futex_key+0x12d/0xb10 [ 156.354080][ T7126] ? _raw_spin_lock_bh+0x57/0xb0 [ 156.354132][ T7126] futex_wake+0x89/0x400 [ 156.354155][ T7126] do_futex+0x3f8/0x460 [ 156.354224][ T7126] __se_sys_futex+0x2f6/0x370 [ 156.354255][ T7126] __x64_sys_futex+0x78/0x90 [ 156.354283][ T7126] x64_sys_call+0x22e2/0x2550 [ 156.354313][ T7126] do_syscall_64+0x112/0x360 [ 156.354422][ T7126] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.354450][ T7126] RIP: 0033:0x7f1b5483e159 [ 156.354485][ T7126] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.354598][ T7126] RSP: 002b:00007f1b532970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 156.354620][ T7126] RAX: ffffffffffffffda RBX: 00007f1b54ac5fa8 RCX: 00007f1b5483e159 [ 156.354636][ T7126] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1b54ac5fac [ 156.354653][ T7126] RBP: 00007f1b54ac5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 156.354729][ T7126] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 156.354746][ T7126] R13: 00007f1b54ac6038 R14: 00007ffdfc79b740 R15: 00007ffdfc79b828 [ 156.354769][ T7126] [ 156.428212][ T7134] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1293'. [ 156.428234][ T7134] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1293'. [ 156.910936][ T7167] FAULT_INJECTION: forcing a failure. [ 156.910936][ T7167] name fail_futex, interval 1, probability 0, space 0, times 0 [ 156.910966][ T7167] CPU: 0 UID: 0 PID: 7167 Comm: syz.1.1305 Not tainted syzkaller #0 PREEMPT(lazy) [ 156.910991][ T7167] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 156.911046][ T7167] Call Trace: [ 156.911053][ T7167] [ 156.911059][ T7167] __dump_stack+0x1d/0x30 [ 156.911119][ T7167] dump_stack_lvl+0x95/0xd0 [ 156.911135][ T7167] dump_stack+0x15/0x1b [ 156.911148][ T7167] should_fail_ex+0x262/0x280 [ 156.911165][ T7167] should_fail+0xb/0x20 [ 156.911179][ T7167] get_futex_key+0x12d/0xb10 [ 156.911276][ T7167] ? _raw_spin_lock_bh+0x57/0xb0 [ 156.911292][ T7167] futex_wake+0x89/0x400 [ 156.911306][ T7167] do_futex+0x3f8/0x460 [ 156.911325][ T7167] __se_sys_futex+0x2f6/0x370 [ 156.911410][ T7167] __x64_sys_futex+0x78/0x90 [ 156.911430][ T7167] x64_sys_call+0x22e2/0x2550 [ 156.911500][ T7167] do_syscall_64+0x112/0x360 [ 156.911589][ T7167] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 156.911605][ T7167] RIP: 0033:0x7fbd0351e159 [ 156.911617][ T7167] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 156.911629][ T7167] RSP: 002b:00007fbd01f770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 156.911670][ T7167] RAX: ffffffffffffffda RBX: 00007fbd037a5fa8 RCX: 00007fbd0351e159 [ 156.911711][ T7167] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbd037a5fac [ 156.911720][ T7167] RBP: 00007fbd037a5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 156.911730][ T7167] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 156.911739][ T7167] R13: 00007fbd037a6038 R14: 00007fff26466170 R15: 00007fff26466258 [ 156.911752][ T7167] [ 157.350885][ T7184] loop5: detected capacity change from 0 to 7 [ 157.410314][ T7189] loop4: detected capacity change from 0 to 512 [ 157.410677][ T7189] EXT4-fs: dax option not supported [ 157.526472][ T7193] FAULT_INJECTION: forcing a failure. [ 157.526472][ T7193] name fail_futex, interval 1, probability 0, space 0, times 0 [ 157.526553][ T7193] CPU: 1 UID: 0 PID: 7193 Comm: syz.2.1316 Not tainted syzkaller #0 PREEMPT(lazy) [ 157.526634][ T7193] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 157.526659][ T7193] Call Trace: [ 157.526667][ T7193] [ 157.526675][ T7193] __dump_stack+0x1d/0x30 [ 157.526783][ T7193] dump_stack_lvl+0x95/0xd0 [ 157.526808][ T7193] dump_stack+0x15/0x1b [ 157.526830][ T7193] should_fail_ex+0x262/0x280 [ 157.526857][ T7193] should_fail+0xb/0x20 [ 157.526959][ T7193] get_futex_key+0x12d/0xb10 [ 157.526991][ T7193] ? _raw_spin_lock_bh+0x57/0xb0 [ 157.527015][ T7193] futex_wake+0x89/0x400 [ 157.527035][ T7193] do_futex+0x3f8/0x460 [ 157.527137][ T7193] __se_sys_futex+0x2f6/0x370 [ 157.527169][ T7193] __x64_sys_futex+0x78/0x90 [ 157.527195][ T7193] x64_sys_call+0x22e2/0x2550 [ 157.527295][ T7193] do_syscall_64+0x112/0x360 [ 157.527328][ T7193] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 157.527350][ T7193] RIP: 0033:0x7f1b5483e159 [ 157.527366][ T7193] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 157.527400][ T7193] RSP: 002b:00007f1b532970e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 157.527462][ T7193] RAX: ffffffffffffffda RBX: 00007f1b54ac5fa8 RCX: 00007f1b5483e159 [ 157.527487][ T7193] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1b54ac5fac [ 157.527501][ T7193] RBP: 00007f1b54ac5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 157.527514][ T7193] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 157.527527][ T7193] R13: 00007f1b54ac6038 R14: 00007ffdfc79b740 R15: 00007ffdfc79b828 [ 157.527614][ T7193] [ 157.860280][ T7202] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1318'. [ 157.887897][ T7202] vlan2: entered promiscuous mode [ 157.887918][ T7202] bridge0: entered promiscuous mode [ 158.101394][ T7214] loop1: detected capacity change from 0 to 512 [ 158.198417][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 158.198435][ T29] audit: type=1400 audit(1792554852.931:532): avc: denied { write } for pid=7221 comm="syz.1.1327" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 158.373912][ T7241] loop2: detected capacity change from 0 to 512 [ 158.380316][ T7241] EXT4-fs (loop2): mounting ext2 file system using the ext4 subsystem [ 158.403553][ T7241] EXT4-fs (loop2): failed to open journal device unknown-block(0,0) -ENXIO [ 158.423823][ T7245] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1336'. [ 159.110358][ T7262] loop1: detected capacity change from 0 to 512 [ 159.118048][ T7262] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 159.187848][ T7264] FAULT_INJECTION: forcing a failure. [ 159.187848][ T7264] name fail_futex, interval 1, probability 0, space 0, times 0 [ 159.187926][ T7264] CPU: 0 UID: 0 PID: 7264 Comm: syz.3.1344 Not tainted syzkaller #0 PREEMPT(lazy) [ 159.187974][ T7264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 159.188064][ T7264] Call Trace: [ 159.188074][ T7264] [ 159.188084][ T7264] __dump_stack+0x1d/0x30 [ 159.188114][ T7264] dump_stack_lvl+0x95/0xd0 [ 159.188175][ T7264] dump_stack+0x15/0x1b [ 159.188208][ T7264] should_fail_ex+0x262/0x280 [ 159.188338][ T7264] should_fail+0xb/0x20 [ 159.188363][ T7264] get_futex_key+0x12d/0xb10 [ 159.188394][ T7264] futex_wake+0x89/0x400 [ 159.188491][ T7264] do_futex+0x3f8/0x460 [ 159.188544][ T7264] __se_sys_futex+0x2f6/0x370 [ 159.188581][ T7264] __x64_sys_futex+0x78/0x90 [ 159.188607][ T7264] x64_sys_call+0x22e2/0x2550 [ 159.188634][ T7264] do_syscall_64+0x112/0x360 [ 159.188723][ T7264] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 159.188750][ T7264] RIP: 0033:0x7f520329e159 [ 159.188813][ T7264] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 159.188865][ T7264] RSP: 002b:00007f5201cf70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 159.188895][ T7264] RAX: ffffffffffffffda RBX: 00007f5203525fa8 RCX: 00007f520329e159 [ 159.188910][ T7264] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5203525fac [ 159.188924][ T7264] RBP: 00007f5203525fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 159.188941][ T7264] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 159.188958][ T7264] R13: 00007f5203526038 R14: 00007ffff2566e90 R15: 00007ffff2566f78 [ 159.189036][ T7264] [ 159.192810][ T7262] EXT4-fs (loop1): 1 truncate cleaned up [ 159.193505][ T7262] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 159.721545][ T7275] loop2: detected capacity change from 0 to 512 [ 159.727329][ T7275] EXT4-fs: Ignoring removed mblk_io_submit option [ 159.736035][ T7275] EXT4-fs error (device loop2): ext4_iget_extra_inode:5210: inode #15: comm syz.2.1347: corrupted in-inode xattr: e_value size too large [ 159.736085][ T7275] loop2: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 159.737013][ T7275] EXT4-fs error (device loop2): ext4_orphan_get:1408: comm syz.2.1347: couldn't read orphan inode 15 (err -117) [ 159.737042][ T7275] loop2: lost filesystem error report for type 5 error -117 [ 159.742749][ C0] EXT4-fs (loop2): error count since last fsck: 2 [ 159.742784][ C0] EXT4-fs (loop2): initial error at time 1792554854: ext4_iget_extra_inode:5210: inode 15 [ 159.742815][ C0] EXT4-fs (loop2): last error at time 1792554854: ext4_orphan_get:1408 [ 159.753140][ T7275] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 159.776614][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 159.917844][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 160.912018][ T7341] loop1: detected capacity change from 0 to 512 [ 160.936574][ T7341] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 160.936710][ T7341] ext4 filesystem being mounted at /256/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 160.940863][ T29] audit: type=1400 audit(1793079143.751:533): avc: denied { write } for pid=7340 comm="syz.1.1370" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 160.966178][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 161.078588][ T29] audit: type=1400 audit(1793079143.895:534): avc: denied { read } for pid=7358 comm="syz.4.1375" name="error_log" dev="tracefs" ino=2122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 161.078672][ T29] audit: type=1400 audit(1793079143.895:535): avc: denied { open } for pid=7358 comm="syz.4.1375" path="/264/trace/error_log" dev="tracefs" ino=2122 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=file permissive=1 [ 161.671706][ T7384] loop3: detected capacity change from 0 to 512 [ 161.707464][ T7384] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 161.707586][ T7384] ext4 filesystem being mounted at /316/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 161.713052][ T29] audit: type=1400 audit(1793079144.544:536): avc: denied { write } for pid=7383 comm="syz.3.1381" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 161.733780][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 162.008185][ T7409] lo speed is unknown, defaulting to 1000 [ 162.015146][ T7411] loop5: detected capacity change from 0 to 7 [ 162.033933][ T7413] loop3: detected capacity change from 0 to 512 [ 162.034419][ T7413] EXT4-fs: Ignoring removed mblk_io_submit option [ 162.035951][ T7413] EXT4-fs error (device loop3): ext4_iget_extra_inode:5210: inode #15: comm syz.3.1393: corrupted in-inode xattr: e_value size too large [ 162.035981][ T7413] loop3: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 162.036144][ T7413] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.1393: couldn't read orphan inode 15 (err -117) [ 162.036171][ T7413] loop3: lost filesystem error report for type 5 error -117 [ 162.036642][ T7413] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 162.038343][ T7413] netlink: 596 bytes leftover after parsing attributes in process `syz.3.1393'. [ 162.073284][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 162.222361][ T29] audit: type=1400 audit(1793079145.069:537): avc: denied { create } for pid=7416 comm="syz.3.1394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 162.302404][ T29] audit: type=1400 audit(1793079145.100:538): avc: denied { shutdown } for pid=7420 comm="syz.4.1396" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 162.798316][ T7443] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1403'. [ 162.800293][ T7443] netlink: 'syz.4.1403': attribute type 1 has an invalid length. [ 162.800318][ T7443] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1403'. [ 162.874749][ T7445] loop5: detected capacity change from 0 to 7 [ 162.950410][ T7449] ieee802154 phy0 wpan0: encryption failed: -90 [ 163.011876][ T7461] FAULT_INJECTION: forcing a failure. [ 163.011876][ T7461] name failslab, interval 1, probability 0, space 0, times 0 [ 163.011908][ T7461] CPU: 0 UID: 0 PID: 7461 Comm: syz.3.1411 Not tainted syzkaller #0 PREEMPT(lazy) [ 163.011934][ T7461] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 163.012006][ T7461] Call Trace: [ 163.012015][ T7461] [ 163.012023][ T7461] __dump_stack+0x1d/0x30 [ 163.012051][ T7461] dump_stack_lvl+0x95/0xd0 [ 163.012077][ T7461] dump_stack+0x15/0x1b [ 163.012098][ T7461] should_fail_ex+0x262/0x280 [ 163.012181][ T7461] ? security_sk_alloc+0x52/0x120 [ 163.012218][ T7461] should_failslab+0x8c/0xb0 [ 163.012253][ T7461] __kmalloc_noprof+0xd0/0x4d0 [ 163.012386][ T7461] ? security_sk_alloc+0x52/0x120 [ 163.012412][ T7461] ? kmem_cache_alloc_noprof+0x1f5/0x3f0 [ 163.012441][ T7461] security_sk_alloc+0x52/0x120 [ 163.012501][ T7461] sk_prot_alloc+0xc2/0x180 [ 163.012524][ T7461] sk_alloc+0x34/0x3e0 [ 163.012544][ T7461] smc_create+0xb7/0x480 [ 163.012634][ T7461] __sock_create+0x2e5/0x580 [ 163.012669][ T7461] __sys_socket+0xaf/0x180 [ 163.012702][ T7461] __x64_sys_socket+0x3f/0x50 [ 163.012771][ T7461] x64_sys_call+0x246e/0x2550 [ 163.012801][ T7461] do_syscall_64+0x112/0x360 [ 163.012884][ T7461] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 163.012958][ T7461] RIP: 0033:0x7f520329e159 [ 163.012977][ T7461] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 163.012998][ T7461] RSP: 002b:00007f5201cf7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 163.013064][ T7461] RAX: ffffffffffffffda RBX: 00007f5203525fa0 RCX: 00007f520329e159 [ 163.013082][ T7461] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000002b [ 163.013175][ T7461] RBP: 00007f520333506b R08: 0000000000000000 R09: 0000000000000000 [ 163.013191][ T7461] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.013208][ T7461] R13: 00007f5203526038 R14: 00007f5203525fa0 R15: 00007ffff2566f78 [ 163.013231][ T7461] [ 163.173676][ T7471] loop5: detected capacity change from 0 to 7 [ 163.850443][ T7492] loop4: detected capacity change from 0 to 256 [ 163.857110][ T7492] FAT-fs (loop4): data area starts beyond volume (274 > 64) [ 163.857132][ T7492] FAT-fs (loop4): Can't find a valid FAT filesystem [ 164.347266][ T7505] loop5: detected capacity change from 0 to 7 [ 164.485228][ T7512] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1429'. [ 165.520641][ T29] audit: type=1400 audit(1794127724.433:539): avc: denied { getopt } for pid=7525 comm="syz.3.1437" lport=46112 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 165.727036][ T7536] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1441'. [ 165.898513][ T7546] loop5: detected capacity change from 0 to 7 [ 166.245256][ T7570] loop1: detected capacity change from 0 to 512 [ 166.273939][ T7570] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 166.274027][ T7570] ext4 filesystem being mounted at /278/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 166.356982][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 166.914855][ T7607] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1471'. [ 166.920198][ T7605] loop1: detected capacity change from 0 to 512 [ 167.116291][ T7620] syzkaller0: entered promiscuous mode [ 167.116323][ T7620] syzkaller0: entered allmulticast mode [ 167.130350][ T7605] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 167.130410][ T7605] ext4 filesystem being mounted at /284/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 167.207817][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 167.475971][ T7646] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1482'. [ 167.535802][ T7653] loop4: detected capacity change from 0 to 512 [ 167.536299][ T7653] EXT4-fs: dax option not supported [ 167.679352][ T7667] netlink: 56 bytes leftover after parsing attributes in process `syz.3.1490'. [ 168.778441][ T7727] loop3: detected capacity change from 0 to 512 [ 168.778938][ T7727] EXT4-fs: dax option not supported [ 168.853886][ T3380] hid-generic 0000:0000:0000.0003: unknown main item tag 0x0 [ 168.854205][ T3380] hid-generic 0000:0000:0000.0003: hidraw0: HID v0.00 Device [syz1] on syz0 [ 168.892409][ T7734] fido_id[7734]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 169.479721][ T7751] loop1: detected capacity change from 0 to 512 [ 169.513671][ T7751] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 169.514930][ T7751] ext4 filesystem being mounted at /293/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 169.554158][ T29] audit: type=1400 audit(1794652016.558:540): avc: denied { write } for pid=7750 comm="syz.1.1520" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 169.905587][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 169.909707][ T3485] hid-generic 0000:0000:0000.0004: unknown main item tag 0x0 [ 169.915492][ T3485] hid-generic 0000:0000:0000.0004: hidraw0: HID v0.00 Device [syz1] on syz0 [ 170.047623][ T7765] fido_id[7765]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 170.081150][ T7773] 9p: Bad value for 'rfdno' [ 170.163847][ T7786] loop5: detected capacity change from 0 to 7 [ 170.231501][ T1053] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 170.232154][ T1053] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 170.319764][ T7804] FAULT_INJECTION: forcing a failure. [ 170.319764][ T7804] name fail_futex, interval 1, probability 0, space 0, times 0 [ 170.319799][ T7804] CPU: 1 UID: 0 PID: 7804 Comm: syz.1.1540 Not tainted syzkaller #0 PREEMPT(lazy) [ 170.319903][ T7804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 170.319919][ T7804] Call Trace: [ 170.319933][ T7804] [ 170.319942][ T7804] __dump_stack+0x1d/0x30 [ 170.320048][ T7804] dump_stack_lvl+0x95/0xd0 [ 170.320075][ T7804] dump_stack+0x15/0x1b [ 170.320117][ T7804] should_fail_ex+0x262/0x280 [ 170.320142][ T7804] should_fail+0xb/0x20 [ 170.320271][ T7804] get_futex_key+0x12d/0xb10 [ 170.320301][ T7804] ? kernelmode_fixup_or_oops+0x59/0xb0 [ 170.320374][ T7804] futex_wake+0x89/0x400 [ 170.320398][ T7804] do_futex+0x3f8/0x460 [ 170.320443][ T7804] __se_sys_futex+0x2f6/0x370 [ 170.320480][ T7804] __x64_sys_futex+0x78/0x90 [ 170.320511][ T7804] x64_sys_call+0x22e2/0x2550 [ 170.320589][ T7804] do_syscall_64+0x112/0x360 [ 170.320629][ T7804] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 170.320655][ T7804] RIP: 0033:0x7fbd0351e159 [ 170.320730][ T7804] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 170.320754][ T7804] RSP: 002b:00007fbd01f770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 170.320779][ T7804] RAX: ffffffffffffffda RBX: 00007fbd037a5fa8 RCX: 00007fbd0351e159 [ 170.320811][ T7804] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fbd037a5fac [ 170.320828][ T7804] RBP: 00007fbd037a5fa0 R08: 3fffffffffffffff R09: 0000000000000000 [ 170.320843][ T7804] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 170.320935][ T7804] R13: 00007fbd037a6038 R14: 00007fff26466170 R15: 00007fff26466258 [ 170.320958][ T7804] [ 171.275366][ T29] audit: type=1400 audit(1794652018.337:541): avc: denied { ioctl } for pid=7809 comm="syz.2.1542" path="socket:[17094]" dev="sockfs" ino=17094 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 171.653832][ T7830] loop3: detected capacity change from 0 to 512 [ 171.670993][ T7830] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 171.692973][ T7830] EXT4-fs (loop3): 1 truncate cleaned up [ 171.698722][ T7830] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 171.754322][ T29] audit: type=1400 audit(1794652018.819:542): avc: denied { write } for pid=7828 comm="syz.3.1548" name="/" dev="loop3" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 171.755260][ T29] audit: type=1400 audit(1794652018.819:543): avc: denied { write } for pid=7828 comm="syz.3.1548" path="/354/bus/memory.events.local" dev="loop3" ino=18 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=file permissive=1 [ 171.755736][ T7830] EXT4-fs warning (device loop3): ext4_expand_extra_isize_ea:2863: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 171.793975][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 171.913894][ T7848] 9p: Bad value for 'wfdno' [ 172.030733][ T7864] 9pnet_fd: p9_fd_create_tcp (7864): problem connecting socket to 127.0.0.1 [ 172.184762][ T29] audit: type=1400 audit(1794652019.260:544): avc: denied { setattr } for pid=7862 comm="syz.0.1561" name="PACKET" dev="sockfs" ino=17442 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 172.934957][ T7892] 9p: Bad value for 'wfdno' [ 173.488434][ T29] audit: type=1400 audit(1794652020.602:545): avc: denied { execute } for pid=7893 comm="syz.0.1572" path="/325/file1" dev="tmpfs" ino=1734 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 173.772560][ T7914] loop5: detected capacity change from 0 to 7 [ 173.870915][ T7925] loop2: detected capacity change from 0 to 512 [ 173.871302][ T7925] EXT4-fs: dax option not supported [ 173.875597][ T29] audit: type=1400 audit(1794652020.991:546): avc: denied { create } for pid=7920 comm="syz.4.1583" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 173.886655][ T29] audit: type=1400 audit(1794652021.011:547): avc: denied { write } for pid=7920 comm="syz.4.1583" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 173.886694][ T7921] siw: device registration error -23 [ 174.068455][ T29] audit: type=1400 audit(1794652021.195:548): avc: denied { connect } for pid=7931 comm="syz.4.1587" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 174.745109][ T7949] loop2: detected capacity change from 0 to 512 [ 174.771757][ T7949] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 174.771899][ T7949] ext4 filesystem being mounted at /283/file7 supports timestamps until 2038-01-19 (0x7fffffff) [ 174.805387][ T29] audit: type=1400 audit(1794652021.951:549): avc: denied { write } for pid=7948 comm="syz.2.1595" name="/" dev="loop2" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 174.884179][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 174.899555][ T7959] tipc: Started in network mode [ 174.899604][ T7959] tipc: Node identity 7f000001, cluster identity 4711 [ 174.899862][ T7959] tipc: Enabled bearer , priority 10 [ 175.017859][ T7970] loop2: detected capacity change from 0 to 512 [ 175.020167][ T7970] EXT4-fs: dax option not supported [ 175.140777][ T7971] loop3: detected capacity change from 0 to 512 [ 175.156932][ T7971] EXT4-fs (loop3): #blocks per group too big: 83894272 [ 176.124517][ T3485] tipc: Node number set to 2130706433 [ 176.243196][ T29] audit: type=1400 audit(1794652023.380:550): avc: denied { kexec_image_load } for pid=7982 comm="syz.4.1610" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=system permissive=1 [ 177.892581][ T8058] loop1: detected capacity change from 0 to 512 [ 177.914367][ T8058] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 177.921415][ T8058] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 177.921591][ T8058] ext4 filesystem being mounted at /319/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 177.952922][ T29] audit: type=1400 audit(1794652025.152:551): avc: denied { setattr } for pid=8038 comm="syz.1.1617" name="file1" dev="loop1" ino=15 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 178.023526][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 178.134271][ T29] audit: type=1400 audit(1794652025.346:552): avc: denied { bind } for pid=8074 comm="syz.0.1622" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 178.134306][ T29] audit: type=1400 audit(1794652025.346:553): avc: denied { name_bind } for pid=8074 comm="syz.0.1622" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:port_t tclass=icmp_socket permissive=1 [ 178.134334][ T29] audit: type=1400 audit(1794652025.346:554): avc: denied { node_bind } for pid=8074 comm="syz.0.1622" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=icmp_socket permissive=1 [ 178.262384][ T8089] loop4: detected capacity change from 0 to 1024 [ 178.274055][ T8089] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 178.317479][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 178.362820][ T8103] capability: warning: `syz.0.1629' uses deprecated v2 capabilities in a way that may be insecure [ 179.628390][ T8141] loop5: detected capacity change from 0 to 7 [ 180.347097][ T8160] loop1: detected capacity change from 0 to 1024 [ 180.374805][ T8160] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 180.409403][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 180.510543][ T8174] loop5: detected capacity change from 0 to 7 [ 182.250229][ T29] audit: type=1400 audit(1794652029.508:555): avc: denied { create } for pid=8221 comm="syz.4.1679" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 182.253000][ T29] audit: type=1400 audit(1794652029.518:556): avc: denied { ioctl } for pid=8221 comm="syz.4.1679" path="socket:[18741]" dev="sockfs" ino=18741 ioctlcmd=0x6180 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 182.571385][ T8236] netlink: 'syz.2.1684': attribute type 3 has an invalid length. [ 182.571406][ T8236] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1684'. [ 182.905922][ T8244] loop4: detected capacity change from 0 to 512 [ 182.924979][ T8244] EXT4-fs: Mount option(s) incompatible with ext2 [ 183.043135][ T8235] loop1: detected capacity change from 0 to 4096 [ 183.045427][ T8235] EXT4-fs: dax option not supported [ 183.170534][ T8246] syzkaller0: entered promiscuous mode [ 183.170578][ T8246] syzkaller0: entered allmulticast mode [ 183.440751][ T8247] loop3: detected capacity change from 0 to 2048 [ 183.488432][ T8247] loop3: p1 p2 p3 < > p4 < p5 p6 > [ 183.488445][ T8247] loop3: partition table partially beyond EOD, truncated [ 183.488535][ T8247] loop3: p1 start 3405774849 is beyond EOD, truncated [ 183.488632][ T8247] loop3: p2 start 53543428 is beyond EOD, truncated [ 183.488648][ T8247] loop3: p3 start 4284289 is beyond EOD, truncated [ 183.513913][ T8247] loop3: p5 start 3405774849 is beyond EOD, truncated [ 183.513936][ T8247] loop3: p6 start 53543428 is beyond EOD, truncated [ 183.621036][ T8252] tipc: Started in network mode [ 183.621070][ T8252] tipc: Node identity 0629dc970ad9, cluster identity 4711 [ 183.621116][ T8252] tipc: Enabled bearer , priority 0 [ 183.644213][ T8252] tipc: Resetting bearer [ 183.646320][ T8251] tipc: Disabling bearer [ 183.668218][ T8254] loop4: detected capacity change from 0 to 512 [ 183.668607][ T8254] EXT4-fs: Ignoring removed i_version option [ 183.668673][ T8254] EXT4-fs: Ignoring removed oldalloc option [ 183.707362][ T8254] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 183.990983][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 183.993782][ T8268] netlink: 'syz.2.1695': attribute type 3 has an invalid length. [ 183.993801][ T8268] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1695'. [ 184.468592][ T8275] loop5: detected capacity change from 0 to 7 [ 184.471720][ T29] audit: type=1400 audit(1794652031.675:557): avc: denied { write } for pid=8269 comm="syz.2.1697" name="usbmon8" dev="devtmpfs" ino=166 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 184.768316][ T8283] FAULT_INJECTION: forcing a failure. [ 184.768316][ T8283] name failslab, interval 1, probability 0, space 0, times 0 [ 184.768424][ T8283] CPU: 1 UID: 0 PID: 8283 Comm: syz.1.1700 Not tainted syzkaller #0 PREEMPT(lazy) [ 184.768475][ T8283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 184.768487][ T8283] Call Trace: [ 184.768495][ T8283] [ 184.768504][ T8283] __dump_stack+0x1d/0x30 [ 184.768535][ T8283] dump_stack_lvl+0x95/0xd0 [ 184.768558][ T8283] dump_stack+0x15/0x1b [ 184.768577][ T8283] should_fail_ex+0x262/0x280 [ 184.768622][ T8283] ? __send_signal_locked+0x14d/0x750 [ 184.768655][ T8283] should_failslab+0x8c/0xb0 [ 184.768770][ T8283] kmem_cache_alloc_noprof+0x7c/0x3f0 [ 184.768804][ T8283] ? __send_signal_locked+0x14d/0x750 [ 184.768833][ T8283] __send_signal_locked+0x14d/0x750 [ 184.768863][ T8283] ? __rcu_read_unlock+0x33/0x70 [ 184.768930][ T8283] do_notify_parent+0x55f/0x600 [ 184.768966][ T8283] release_task+0x9bf/0xb90 [ 184.769072][ T8283] do_exit+0xd79/0x1510 [ 184.769107][ T8283] do_group_exit+0xfe/0x140 [ 184.769150][ T8283] ? get_signal+0xe00/0xf10 [ 184.769258][ T8283] get_signal+0xe07/0xf10 [ 184.769299][ T8283] arch_do_signal_or_restart+0x96/0x480 [ 184.769386][ T8283] exit_to_user_mode_loop+0x15d/0x8c0 [ 184.769445][ T8283] do_syscall_64+0x212/0x360 [ 184.769503][ T8283] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 184.769524][ T8283] RIP: 0033:0x7fbd0351e159 [ 184.769540][ T8283] Code: Unable to access opcode bytes at 0x7fbd0351e12f. [ 184.769550][ T8283] RSP: 002b:00007fbd01f770e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 184.769640][ T8283] RAX: fffffffffffffe00 RBX: 00007fbd037a5fa8 RCX: 00007fbd0351e159 [ 184.769655][ T8283] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fbd037a5fa8 [ 184.769669][ T8283] RBP: 00007fbd037a5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 184.769683][ T8283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 184.769695][ T8283] R13: 00007fbd037a6038 R14: 00007fff26466170 R15: 00007fff26466258 [ 184.769745][ T8283] [ 185.037560][ T8302] netlink: 'syz.2.1707': attribute type 3 has an invalid length. [ 185.037579][ T8302] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1707'. [ 185.055050][ T29] audit: type=1400 audit(1794652032.353:558): avc: denied { ioctl } for pid=8293 comm="syz.3.1704" path="socket:[17871]" dev="sockfs" ino=17871 ioctlcmd=0x8983 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 185.129517][ T8309] loop2: detected capacity change from 0 to 512 [ 185.143949][ T8309] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 185.162659][ T8309] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 185.162884][ T8309] ext4 filesystem being mounted at /311/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 185.209944][ T29] audit: type=1400 audit(1794652032.515:559): avc: denied { open } for pid=8315 comm="syz.0.1712" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 185.209977][ T29] audit: type=1400 audit(1794652032.515:560): avc: denied { kernel } for pid=8315 comm="syz.0.1712" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 185.244919][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 185.292529][ T29] audit: type=1400 audit(1794652032.595:561): avc: denied { tracepoint } for pid=8319 comm="syz.4.1714" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 185.303018][ T8322] syzkaller0: entered promiscuous mode [ 185.303038][ T8322] syzkaller0: entered allmulticast mode [ 185.307299][ T29] audit: type=1400 audit(1794652032.616:562): avc: denied { write } for pid=8319 comm="syz.4.1714" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 185.345434][ T8316] netlink: 288 bytes leftover after parsing attributes in process `syz.0.1712'. [ 185.365102][ T8316] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=8316 comm=syz.0.1712 [ 185.366185][ T8316] netlink: 'syz.0.1712': attribute type 27 has an invalid length. [ 185.366205][ T8316] netlink: 164 bytes leftover after parsing attributes in process `syz.0.1712'. [ 185.448870][ T8339] netlink: 'syz.1.1722': attribute type 10 has an invalid length. [ 185.468314][ T8337] netlink: 'syz.2.1720': attribute type 3 has an invalid length. [ 185.468336][ T8337] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1720'. [ 185.642374][ T8364] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1731'. [ 185.706814][ T8371] loop2: detected capacity change from 0 to 512 [ 185.709779][ T8371] EXT4-fs: Ignoring removed i_version option [ 185.710077][ T8371] EXT4-fs: Ignoring removed oldalloc option [ 186.479330][ T8391] netlink: 'syz.0.1743': attribute type 1 has an invalid length. [ 186.479378][ T8391] netlink: 'syz.0.1743': attribute type 2 has an invalid length. [ 186.502069][ T8391] netlink: 'syz.0.1743': attribute type 13 has an invalid length. [ 186.504770][ T8371] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 186.564113][ T29] audit: type=1400 audit(1794652033.879:563): avc: denied { cpu } for pid=8393 comm="syz.1.1744" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 186.589717][ T8394] IPv6: NLM_F_CREATE should be specified when creating new route [ 186.603891][ T8396] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1745'. [ 186.696897][ T8399] netlink: 'syz.4.1736': attribute type 3 has an invalid length. [ 186.696914][ T8399] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1736'. [ 186.739061][ T8404] tipc: Started in network mode [ 186.739102][ T8404] tipc: Node identity f28c8d23390a, cluster identity 4711 [ 186.739199][ T8404] tipc: Enabled bearer , priority 0 [ 186.740759][ T8404] tipc: Resetting bearer [ 186.810015][ T8409] loop4: detected capacity change from 0 to 512 [ 186.819506][ T8403] tipc: Disabling bearer [ 186.825739][ T8409] EXT4-fs: dax option not supported [ 186.835873][ T3309] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 187.104363][ T8418] netlink: 288 bytes leftover after parsing attributes in process `syz.1.1752'. [ 187.109509][ T8418] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2304 sclass=netlink_route_socket pid=8418 comm=syz.1.1752 [ 187.539360][ T8457] __nla_validate_parse: 2 callbacks suppressed [ 187.539452][ T8457] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1767'. [ 187.605385][ T8463] validate_nla: 1 callbacks suppressed [ 187.605401][ T8463] netlink: 'syz.1.1771': attribute type 3 has an invalid length. [ 187.605412][ T8463] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1771'. [ 187.804026][ T8469] loop1: detected capacity change from 0 to 2048 [ 187.804965][ T8470] tipc: Enabled bearer , priority 0 [ 187.807645][ T8470] tipc: Resetting bearer [ 187.832168][ T8468] tipc: Disabling bearer [ 187.845405][ T8469] loop1: p1 p2 p3 < > p4 < p5 p6 > [ 187.845479][ T8469] loop1: partition table partially beyond EOD, truncated [ 187.845550][ T8469] loop1: p1 start 3405774849 is beyond EOD, truncated [ 187.845570][ T8469] loop1: p2 start 53543428 is beyond EOD, truncated [ 187.845605][ T8469] loop1: p3 start 4284289 is beyond EOD, truncated [ 187.846889][ T8469] loop1: p5 start 3405774849 is beyond EOD, truncated [ 187.846971][ T8469] loop1: p6 start 53543428 is beyond EOD, truncated [ 188.847969][ T8485] netlink: 'syz.4.1779': attribute type 27 has an invalid length. [ 188.847993][ T8485] netlink: 164 bytes leftover after parsing attributes in process `syz.4.1779'. [ 189.160716][ T8493] loop2: detected capacity change from 0 to 512 [ 189.172744][ T8493] EXT4-fs: dax option not supported [ 189.329972][ T29] audit: type=1400 audit(1794652036.675:564): avc: denied { read } for pid=8496 comm="syz.4.1785" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 189.431837][ T8500] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1785'. [ 189.600650][ T29] audit: type=1400 audit(1794652036.958:565): avc: denied { setopt } for pid=8522 comm="syz.3.1795" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 189.705845][ T8531] loop3: detected capacity change from 0 to 512 [ 189.706167][ T8531] EXT4-fs: Ignoring removed i_version option [ 189.706213][ T8531] EXT4-fs: Ignoring removed oldalloc option [ 189.722027][ T8531] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 189.745038][ T3308] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 189.792268][ T8542] loop1: detected capacity change from 0 to 512 [ 189.793080][ T8542] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 189.800399][ T8542] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 189.800888][ T8542] ext4 filesystem being mounted at /361/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 189.823708][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 190.485364][ T8559] FAULT_INJECTION: forcing a failure. [ 190.485364][ T8559] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 190.485443][ T8559] CPU: 1 UID: 0 PID: 8559 Comm: syz.2.1807 Not tainted syzkaller #0 PREEMPT(lazy) [ 190.485473][ T8559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 190.485487][ T8559] Call Trace: [ 190.485495][ T8559] [ 190.485504][ T8559] __dump_stack+0x1d/0x30 [ 190.485532][ T8559] dump_stack_lvl+0x95/0xd0 [ 190.485567][ T8559] dump_stack+0x15/0x1b [ 190.485594][ T8559] should_fail_ex+0x262/0x280 [ 190.485622][ T8559] should_fail+0xb/0x20 [ 190.485645][ T8559] should_fail_usercopy+0x1a/0x20 [ 190.485737][ T8559] _copy_from_user+0x1c/0xb0 [ 190.485764][ T8559] __sys_bpf+0x1e2/0xc30 [ 190.485794][ T8559] ? do_futex+0x380/0x460 [ 190.485838][ T8559] __x64_sys_bpf+0x69/0x80 [ 190.485925][ T8559] x64_sys_call+0xf26/0x2550 [ 190.486005][ T8559] do_syscall_64+0x112/0x360 [ 190.486061][ T8559] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 190.486086][ T8559] RIP: 0033:0x7f1b5483e159 [ 190.486153][ T8559] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 190.486186][ T8559] RSP: 002b:00007f1b53297028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 190.486272][ T8559] RAX: ffffffffffffffda RBX: 00007f1b54ac5fa0 RCX: 00007f1b5483e159 [ 190.486288][ T8559] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012 [ 190.486303][ T8559] RBP: 00007f1b548d506b R08: 0000000000000000 R09: 0000000000000000 [ 190.486318][ T8559] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 190.486332][ T8559] R13: 00007f1b54ac6038 R14: 00007f1b54ac5fa0 R15: 00007ffdfc79b828 [ 190.486354][ T8559] [ 190.889520][ T8576] tc_dump_action: action bad kind [ 191.266870][ T8591] loop4: detected capacity change from 0 to 2048 [ 191.319245][ T8591] loop4: p1 p2 p3 < > p4 < p5 p6 > [ 191.319291][ T8591] loop4: partition table partially beyond EOD, truncated [ 191.319346][ T8591] loop4: p1 start 3405774849 is beyond EOD, truncated [ 191.319366][ T8591] loop4: p2 start 53543428 is beyond EOD, truncated [ 191.319383][ T8591] loop4: p3 start 4284289 is beyond EOD, truncated [ 191.320272][ T8591] loop4: p5 start 3405774849 is beyond EOD, truncated [ 191.320295][ T8591] loop4: p6 start 53543428 is beyond EOD, truncated [ 191.361060][ T3656] udevd[3656]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 191.478273][ T8596] loop5: detected capacity change from 0 to 7 [ 192.156846][ T8618] loop2: detected capacity change from 0 to 2048 [ 192.181485][ T8618] loop2: p1 p2 p3 < > p4 < p5 p6 > [ 192.181601][ T8618] loop2: partition table partially beyond EOD, truncated [ 192.182452][ T8618] loop2: p1 start 3405774849 is beyond EOD, truncated [ 192.182471][ T8618] loop2: p2 start 53543428 is beyond EOD, truncated [ 192.182486][ T8618] loop2: p3 start 4284289 is beyond EOD, truncated [ 192.345767][ T8618] loop2: p5 start 3405774849 is beyond EOD, truncated [ 192.354298][ T8618] loop2: p6 start 53543428 is beyond EOD, truncated [ 192.577204][ T8626] loop5: detected capacity change from 0 to 7 [ 192.742897][ T8535] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 195.584712][ T8744] syzkaller0: entered promiscuous mode [ 195.584794][ T8744] syzkaller0: entered allmulticast mode [ 196.274874][ T8664] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 196.274949][ T8680] netlink: 'syz.2.1855': attribute type 1 has an invalid length. [ 196.275378][ T8716] netlink: 'syz.0.1871': attribute type 1 has an invalid length. [ 196.275396][ T8716] netlink: 'syz.0.1871': attribute type 2 has an invalid length. [ 196.381146][ T8769] syzkaller0: entered promiscuous mode [ 196.381180][ T8769] syzkaller0: entered allmulticast mode [ 196.711280][ T8787] netlink: 'syz.3.1900': attribute type 2 has an invalid length. [ 196.711374][ T8787] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1900'. [ 196.741426][ T8787] netlink: 'syz.3.1900': attribute type 2 has an invalid length. [ 196.741503][ T8787] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1900'. [ 196.789624][ T8791] netlink: 88 bytes leftover after parsing attributes in process `syz.2.1902'. [ 197.617584][ T8825] 9pnet_fd: p9_fd_create_tcp (8825): problem connecting socket to 127.0.0.1 [ 197.689896][ T8831] loop1: detected capacity change from 0 to 512 [ 197.690236][ T8831] EXT4-fs: Ignoring removed i_version option [ 197.690323][ T8831] EXT4-fs: Ignoring removed oldalloc option [ 197.695186][ T8831] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 197.708221][ T29] audit: type=1400 audit(1794652045.112:566): avc: denied { write } for pid=8830 comm="syz.1.1916" name="/" dev="loop1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 197.728840][ T3303] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.344765][ T8862] loop4: detected capacity change from 0 to 512 [ 198.345100][ T8862] EXT4-fs: Ignoring removed i_version option [ 198.345194][ T8862] EXT4-fs: Ignoring removed oldalloc option [ 198.376367][ T8862] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 198.395070][ T3302] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 198.467512][ T8868] 9pnet_fd: p9_fd_create_tcp (8868): problem connecting socket to 127.0.0.1 [ 199.138155][ T8925] netlink: 44 bytes leftover after parsing attributes in process `syz.0.1951'. [ 199.712488][ T8949] hsr0: entered allmulticast mode [ 199.712511][ T8949] hsr_slave_0: entered allmulticast mode [ 199.712531][ T8949] hsr_slave_1: entered allmulticast mode [ 199.819958][ T8793] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 199.862067][ T8961] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1965'. [ 199.954125][ T29] audit: type=1400 audit(1794652047.363:567): avc: denied { setopt } for pid=8966 comm="syz.2.1968" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 200.133084][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.133149][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.133526][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.156334][ T8974] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 200.157800][ T8974] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 200.187293][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.190097][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.191140][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.192224][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.193177][ T8974] gretap0 speed is unknown, defaulting to 1000 [ 200.408074][ T8986] netlink: 84 bytes leftover after parsing attributes in process `syz.2.1976'. [ 200.423751][ T8987] 9pnet_fd: p9_fd_create_tcp (8987): problem connecting socket to 127.0.0.1 [ 200.670875][ T9012] netlink: 192 bytes leftover after parsing attributes in process `syz.3.1989'. [ 200.973241][ T9040] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1998'. [ 201.482286][ T9051] 9pnet_fd: p9_fd_create_tcp (9051): problem connecting socket to 127.0.0.1 [ 202.096624][ T9066] netlink: 288 bytes leftover after parsing attributes in process `syz.0.2010'. [ 202.666352][ T9087] 9pnet_fd: p9_fd_create_tcp (9087): problem connecting socket to 127.0.0.1 [ 203.320957][ T9104] raw_sendmsg: syz.3.2024 forgot to set AF_INET. Fix it! [ 203.853345][ T9027] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 203.854698][ T9034] netlink: 'syz.1.1998': attribute type 1 has an invalid length. [ 203.854721][ T9034] netlink: 'syz.1.1998': attribute type 2 has an invalid length. [ 203.970598][ T9112] 9pnet_fd: p9_fd_create_tcp (9112): problem connecting socket to 127.0.0.1 [ 204.160759][ T9126] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2034'. [ 204.160782][ T9126] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2034'. [ 204.352411][ T9150] loop2: detected capacity change from 0 to 512 [ 204.354957][ T9150] EXT4-fs: dax option not supported [ 204.827939][ T9163] netlink: 830 bytes leftover after parsing attributes in process `syz.3.2047'. [ 204.975979][ T9181] loop4: detected capacity change from 0 to 512 [ 204.978470][ T9181] EXT4-fs: dax option not supported [ 205.128941][ T9143] 9pnet_fd: p9_fd_create_tcp (9143): problem connecting socket to 127.0.0.1 [ 205.968402][ T9221] netlink: 'syz.3.2071': attribute type 29 has an invalid length. [ 206.217458][ T9238] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2078'. [ 206.346616][ T9213] 9pnet_fd: p9_fd_create_tcp (9213): problem connecting socket to 127.0.0.1 [ 206.692876][ T29] audit: type=1400 audit(1794652054.129:568): avc: denied { read } for pid=9259 comm="syz.0.2088" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 206.917354][ T9282] netlink: 'syz.3.2099': attribute type 39 has an invalid length. [ 206.917451][ T9282] hsr_slave_0: left promiscuous mode [ 206.918471][ T9282] hsr_slave_1: left promiscuous mode [ 207.249388][ T9136] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 207.490314][ T9311] netlink: 'syz.2.2112': attribute type 8 has an invalid length. [ 207.490333][ T9311] netlink: 'syz.2.2112': attribute type 3 has an invalid length. [ 207.490348][ T9311] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2112'. [ 207.600183][ T9317] netlink: 'syz.3.2116': attribute type 29 has an invalid length. [ 207.958557][ T9360] netlink: 'syz.2.2135': attribute type 2 has an invalid length. [ 207.958576][ T9360] netlink: 164 bytes leftover after parsing attributes in process `syz.2.2135'. [ 208.124512][ T29] audit: type=1400 audit(1794652055.433:569): avc: denied { read } for pid=9336 comm="syz.4.2126" name="snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 208.124584][ T29] audit: type=1400 audit(1794652055.433:570): avc: denied { open } for pid=9336 comm="syz.4.2126" path="/dev/snapshot" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 209.511460][ T9432] loop2: detected capacity change from 0 to 512 [ 209.513950][ T9432] EXT4-fs: dax option not supported [ 209.655538][ T9438] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 209.655538][ T9438] Please contact the netfilter-devel mailing list or update your nftables rules. [ 210.647474][ T29] audit: type=1400 audit(1794652058.091:571): avc: denied { nlmsg_write } for pid=9526 comm="syz.0.2210" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 210.728422][ T29] audit: type=1400 audit(1794652058.171:572): avc: denied { remount } for pid=9541 comm="syz.1.2214" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=filesystem permissive=1 [ 210.885478][ T29] audit: type=1400 audit(1794652058.331:573): avc: denied { ioctl } for pid=9558 comm="syz.0.2221" path="socket:[22882]" dev="sockfs" ino=22882 ioctlcmd=0x8902 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 211.030460][ T9566] lo speed is unknown, defaulting to 1000 [ 211.071918][ T9566] gretap0 speed is unknown, defaulting to 1000 [ 213.838353][ T9552] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 214.088725][ T9660] tipc: Enabling of bearer rejected, failed to enable media [ 215.812935][ T9723] syzkaller0: entered promiscuous mode [ 215.812960][ T9723] syzkaller0: entered allmulticast mode [ 218.492857][ T9708] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 220.112483][ T9830] syzkaller0: entered promiscuous mode [ 220.112504][ T9830] syzkaller0: entered allmulticast mode [ 221.533183][ T9902] syzkaller0: entered promiscuous mode [ 221.533218][ T9902] syzkaller0: entered allmulticast mode [ 222.519003][ T9921] 9pnet_fd: p9_fd_create_tcp (9921): problem connecting socket to 127.0.0.1 [ 223.208088][ T9937] loop4: detected capacity change from 0 to 512 [ 223.209375][ T9937] EXT4-fs: dax option not supported [ 225.242665][ T9950] 9pnet_fd: p9_fd_create_tcp (9950): problem connecting socket to 127.0.0.1 [ 226.296127][ T9991] syzkaller0: entered promiscuous mode [ 226.296152][ T9991] syzkaller0: entered allmulticast mode [ 226.300532][ T9991] tipc: Enabled bearer , priority 0 [ 226.302356][ T9991] tipc: Resetting bearer [ 226.303044][ T9990] tipc: Resetting bearer [ 226.304326][ T9990] tipc: Disabling bearer [ 226.376589][ T823] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.423664][ T823] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.495700][ T823] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.533478][ T823] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 226.607173][ T29] audit: type=1400 audit(1794652074.069:574): avc: denied { read } for pid=3028 comm="dhcpcd" name="n25" dev="tmpfs" ino=9259 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.607207][ T29] audit: type=1400 audit(1794652074.069:575): avc: denied { open } for pid=3028 comm="dhcpcd" path="/run/udev/data/n25" dev="tmpfs" ino=9259 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.607235][ T29] audit: type=1400 audit(1794652074.069:576): avc: denied { getattr } for pid=3028 comm="dhcpcd" path="/run/udev/data/n25" dev="tmpfs" ino=9259 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 226.678187][ T823] erspan0: left allmulticast mode [ 226.678276][ T823] erspan0: left promiscuous mode [ 226.678413][ T823] bridge0: port 3(erspan0) entered disabled state [ 226.684120][ T823] bridge_slave_1: left allmulticast mode [ 226.684141][ T823] bridge_slave_1: left promiscuous mode [ 226.684406][ T823] bridge0: port 2(bridge_slave_1) entered disabled state [ 226.691530][ T823] bridge_slave_0: left allmulticast mode [ 226.691553][ T823] bridge_slave_0: left promiscuous mode [ 226.691687][ T823] bridge0: port 1(bridge_slave_0) entered disabled state [ 226.804053][ T823] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 226.804079][ T823] bridge1 (unregistering): left promiscuous mode [ 226.804099][ T823] bridge1 (unregistering): left allmulticast mode [ 226.807796][ T823] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 226.818088][ T823] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 226.851686][ T823] bond0 (unregistering): Released all slaves [ 226.854027][ T823] bond1 (unregistering): Released all slaves [ 226.904461][ T823] tipc: Left network mode [ 227.064043][ T823] hsr_slave_0: left promiscuous mode [ 227.065916][ T823] hsr_slave_1: left promiscuous mode [ 227.066404][ T823] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 227.066420][ T823] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 227.072709][ T823] veth1_macvtap: left promiscuous mode [ 227.072750][ T823] veth0_macvtap: left promiscuous mode [ 227.072830][ T823] veth1_vlan: left promiscuous mode [ 227.072865][ T823] veth0_vlan: left promiscuous mode [ 227.173904][ T29] audit: type=1400 audit(1794652074.650:577): avc: denied { write } for pid=10013 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 227.173966][ T29] audit: type=1400 audit(1794652074.650:578): avc: denied { create } for pid=10013 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 227.174163][ T29] audit: type=1400 audit(1794652074.650:579): avc: denied { write } for pid=10013 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf.eth1.link" dev="tmpfs" ino=9282 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 227.174411][ T29] audit: type=1400 audit(1794652074.650:580): avc: denied { append } for pid=10013 comm="dhcpcd-run-hook" name="resolv.conf.eth1.link" dev="tmpfs" ino=9282 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 227.293701][ T29] audit: type=1400 audit(1794652074.770:581): avc: denied { write } for pid=10036 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 227.293731][ T29] audit: type=1400 audit(1794652074.770:582): avc: denied { unlink } for pid=10036 comm="rm" name="resolv.conf.eth1.link" dev="tmpfs" ino=9282 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 227.424008][ T823] team0 (unregistering): Port device team_slave_1 removed [ 227.439290][ T823] team0 (unregistering): Port device team_slave_0 removed [ 227.629484][ T9995] lo speed is unknown, defaulting to 1000 [ 227.631204][ T3028] 8021q: adding VLAN 0 to HW filter on device eth1 [ 227.750007][ T9995] gretap0 speed is unknown, defaulting to 1000 [ 227.791114][T10052] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2372'. [ 227.806031][ T29] audit: type=1400 audit(1794652075.281:583): avc: denied { read } for pid=10050 comm="syz.2.2372" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 227.977645][ T3028] 8021q: adding VLAN 0 to HW filter on device eth2 [ 228.121831][ T3028] 8021q: adding VLAN 0 to HW filter on device eth3 [ 228.250374][ T3028] 8021q: adding VLAN 0 to HW filter on device eth4 [ 228.494276][ T9995] bridge0: port 1(bridge_slave_0) entered blocking state [ 228.494314][ T9995] bridge0: port 1(bridge_slave_0) entered disabled state [ 228.494364][ T9995] bridge_slave_0: entered allmulticast mode [ 228.494816][ T9995] bridge_slave_0: entered promiscuous mode [ 228.526499][ T9995] bridge0: port 2(bridge_slave_1) entered blocking state [ 228.526590][ T9995] bridge0: port 2(bridge_slave_1) entered disabled state [ 228.526666][ T9995] bridge_slave_1: entered allmulticast mode [ 228.527138][ T9995] bridge_slave_1: entered promiscuous mode [ 228.583372][ T9995] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 228.584633][ T9995] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 228.676081][ T9995] team0: Port device team_slave_0 added [ 228.678254][ T9995] team0: Port device team_slave_1 added [ 228.698877][ T9995] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 228.698894][ T9995] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 228.698921][ T9995] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 228.700111][ T9995] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 228.700125][ T9995] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 228.700157][ T9995] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 228.820612][ T9995] hsr_slave_0: entered promiscuous mode [ 228.820992][ T9995] hsr_slave_1: entered promiscuous mode [ 228.821233][ T9995] debugfs: 'hsr0' already exists in 'hsr' [ 228.821247][ T9995] Cannot create hsr debugfs directory [ 228.946903][ T9995] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 229.042152][ T9995] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 229.043109][ T9995] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 229.045065][ T9995] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 229.045720][ T9995] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 229.057578][ T9995] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 229.058598][T10129] netlink: 71 bytes leftover after parsing attributes in process `syz.3.2382'. [ 229.075186][ T9995] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 229.083191][ T9995] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 229.118962][ T9995] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.118999][ T9995] bridge0: port 2(bridge_slave_1) entered forwarding state [ 229.119077][ T9995] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.119106][ T9995] bridge0: port 1(bridge_slave_0) entered forwarding state [ 229.145254][ T8022] bridge0: port 1(bridge_slave_0) entered disabled state [ 229.151530][ T8022] bridge0: port 2(bridge_slave_1) entered disabled state [ 229.212242][T10137] netlink: 65051 bytes leftover after parsing attributes in process `syz.3.2383'. [ 229.220938][ T9995] 8021q: adding VLAN 0 to HW filter on device bond0 [ 229.232469][ T9995] 8021q: adding VLAN 0 to HW filter on device team0 [ 229.244916][ T8009] bridge0: port 1(bridge_slave_0) entered blocking state [ 229.244955][ T8009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 229.251971][ T8022] bridge0: port 2(bridge_slave_1) entered blocking state [ 229.252008][ T8022] bridge0: port 2(bridge_slave_1) entered forwarding state [ 229.271074][T10139] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2384'. [ 229.708768][T10170] netlink: 65051 bytes leftover after parsing attributes in process `syz.4.2393'. [ 229.794243][ T9995] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 229.951748][T10191] netlink: 766 bytes leftover after parsing attributes in process `syz.2.2396'. [ 229.999129][T10196] syzkaller0: entered promiscuous mode [ 229.999153][T10196] syzkaller0: entered allmulticast mode [ 230.025516][ T9995] veth0_vlan: entered promiscuous mode [ 230.027961][ T9995] veth1_vlan: entered promiscuous mode [ 230.036080][ T9995] veth0_macvtap: entered promiscuous mode [ 230.037678][ T9995] veth1_macvtap: entered promiscuous mode [ 230.060915][ T9995] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 230.062722][ T9995] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 230.085100][ T8009] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.085300][ T8009] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.085445][ T8009] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.085656][ T8009] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 230.788503][T10238] loop4: detected capacity change from 0 to 512 [ 230.809121][T10238] EXT4-fs: dax option not supported [ 231.159375][T10249] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2417'. [ 231.588211][T10273] netlink: 56 bytes leftover after parsing attributes in process `syz.2.2427'. [ 232.766884][T10299] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.2438'. [ 233.424604][T10334] netlink: 65051 bytes leftover after parsing attributes in process `syz.5.2452'. [ 233.593797][T10338] syzkaller0: entered promiscuous mode [ 233.593817][T10338] syzkaller0: entered allmulticast mode [ 233.801184][T10362] netlink: 65051 bytes leftover after parsing attributes in process `syz.2.2464'. [ 233.875739][T10375] netlink: 'syz.5.2463': attribute type 10 has an invalid length. [ 234.017176][T10388] syzkaller0: entered promiscuous mode [ 234.017196][T10388] syzkaller0: entered allmulticast mode [ 234.668540][T10418] netlink: 312 bytes leftover after parsing attributes in process `syz.4.2483'. [ 234.668612][T10418] netlink: 220 bytes leftover after parsing attributes in process `syz.4.2483'. [ 234.878472][T10440] netlink: 76 bytes leftover after parsing attributes in process `syz.5.2493'. [ 234.988421][T10456] netlink: 'syz.2.2501': attribute type 10 has an invalid length. [ 234.988444][T10456] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2501'. [ 234.988513][T10456] batadv0: entered promiscuous mode [ 234.988530][T10456] batadv0: entered allmulticast mode [ 234.989552][T10456] bridge0: port 3(batadv0) entered blocking state [ 234.989584][T10456] bridge0: port 3(batadv0) entered disabled state [ 234.992908][T10456] bridge0: port 3(batadv0) entered blocking state [ 234.992943][T10456] bridge0: port 3(batadv0) entered forwarding state [ 235.068985][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 235.069055][ T29] audit: type=1400 audit(1794652082.548:593): avc: denied { nlmsg_read } for pid=10457 comm="syz.5.2502" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 235.086368][ T29] audit: type=1400 audit(1794652082.568:594): avc: denied { read } for pid=10459 comm="syz.3.2503" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 235.087121][T10462] syzkaller0: entered promiscuous mode [ 235.087139][T10462] syzkaller0: entered allmulticast mode [ 235.349728][ T12] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 235.349753][ T12] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 235.859969][T10499] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2519'. [ 236.130377][T10511] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2524'. [ 236.130402][T10511] openvswitch: netlink: Flow key attr not present in new flow. [ 236.730789][T10528] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2533'. [ 236.845769][T10537] lo speed is unknown, defaulting to 1000 [ 236.881338][T10537] gretap0 speed is unknown, defaulting to 1000 [ 236.905736][T10542] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5133 sclass=netlink_route_socket pid=10542 comm=syz.5.2538 [ 236.960779][T10546] syzkaller0: entered promiscuous mode [ 236.960877][T10546] syzkaller0: entered allmulticast mode [ 237.026352][T10553] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2543'. [ 238.316357][T10634] lo speed is unknown, defaulting to 1000 [ 238.377760][T10634] gretap0 speed is unknown, defaulting to 1000 [ 238.647686][ T29] audit: type=1400 audit(1794652086.141:595): avc: denied { ioctl } for pid=10644 comm="syz.3.2580" path="/dev/snapshot" dev="devtmpfs" ino=90 ioctlcmd=0x3313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 238.849908][ T29] audit: type=1400 audit(1794652086.341:596): avc: denied { write } for pid=10658 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 238.870943][ T29] audit: type=1400 audit(1794652086.351:597): avc: denied { write } for pid=10679 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 239.618358][T10688] __nla_validate_parse: 8 callbacks suppressed [ 239.618376][T10688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2589'. [ 239.647264][T10688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2589'. [ 239.694923][T10688] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2589'. [ 239.713263][ T29] audit: type=1400 audit(1794652087.202:598): avc: denied { write } for pid=10686 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 239.780223][ T29] audit: type=1400 audit(1794652087.272:599): avc: denied { write } for pid=10711 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 239.862327][T10727] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2598'. [ 239.924468][ T29] audit: type=1400 audit(1794652087.412:600): avc: denied { write } for pid=10720 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 239.960661][ T29] audit: type=1400 audit(1794652087.452:601): avc: denied { write } for pid=10743 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 240.028479][T10555] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 240.047331][T10752] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10752 comm=syz.2.2603 [ 240.277264][ T29] audit: type=1400 audit(1794652087.773:602): avc: denied { write } for pid=10757 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 240.306552][ T29] audit: type=1400 audit(1794652087.803:603): avc: denied { write } for pid=10777 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 240.470071][T10788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10788 comm=syz.3.2614 [ 240.590347][T10801] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2620'. [ 240.747401][T10814] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10814 comm=syz.4.2626 [ 240.816845][T10826] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2632'. [ 240.869826][T10834] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2635'. [ 240.900207][T10839] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10839 comm=syz.4.2637 [ 241.106037][T10861] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2647'. [ 241.141717][T10865] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10865 comm=syz.0.2649 [ 241.404734][T10894] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10894 comm=syz.2.2661 [ 241.474866][T10902] netlink: 'syz.2.2664': attribute type 1 has an invalid length. [ 241.617069][T10919] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10919 comm=syz.3.2672 [ 241.859426][T10943] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10943 comm=syz.2.2683 [ 241.962382][T10957] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2690'. [ 242.047367][T10967] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2694'. [ 242.538022][T11024] netlink: 'syz.5.2720': attribute type 4 has an invalid length. [ 242.538043][T11024] netlink: 'syz.5.2720': attribute type 33 has an invalid length. [ 242.563585][T11024] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 242.909297][ T29] audit: type=1400 audit(1794652090.405:604): avc: denied { nlmsg_read } for pid=11064 comm="syz.2.2739" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 243.006116][T11061] lo speed is unknown, defaulting to 1000 [ 243.059741][ T12] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.074684][T11061] gretap0 speed is unknown, defaulting to 1000 [ 243.115269][ T12] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.146539][ T12] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.185391][ T12] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 243.210151][T11061] bridge0: port 1(bridge_slave_0) entered blocking state [ 243.210224][T11061] bridge0: port 1(bridge_slave_0) entered disabled state [ 243.210322][T11061] bridge_slave_0: entered allmulticast mode [ 243.211720][T11061] bridge_slave_0: entered promiscuous mode [ 243.213317][T11061] bridge0: port 2(bridge_slave_1) entered blocking state [ 243.213348][T11061] bridge0: port 2(bridge_slave_1) entered disabled state [ 243.214096][T11061] bridge_slave_1: entered allmulticast mode [ 243.214586][T11061] bridge_slave_1: entered promiscuous mode [ 243.226644][T11061] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 243.227691][T11061] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 243.260686][T11061] team0: Port device team_slave_0 added [ 243.261925][T11061] team0: Port device team_slave_1 added [ 243.273040][T11061] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 243.273136][T11061] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 243.273163][T11061] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 243.273854][T11061] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 243.273931][T11061] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 243.273958][T11061] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 243.325954][T11061] hsr_slave_0: entered promiscuous mode [ 243.326387][T11061] hsr_slave_1: entered promiscuous mode [ 243.326574][T11061] debugfs: 'hsr0' already exists in 'hsr' [ 243.326590][T11061] Cannot create hsr debugfs directory [ 243.502247][ T12] pimreg: left allmulticast mode [ 243.552704][ T12] bond0 (unregistering): Released all slaves [ 243.555274][ T12] bond1 (unregistering): Released all slaves [ 243.587555][ T12] tipc: Left network mode [ 243.674608][ T12] veth1_macvtap: left promiscuous mode [ 243.674639][ T12] veth0_macvtap: left promiscuous mode [ 243.674716][ T12] veth1_vlan: left promiscuous mode [ 243.674761][ T12] veth0_vlan: left promiscuous mode [ 243.767748][ T29] audit: type=1400 audit(1794652091.265:605): avc: denied { write } for pid=11120 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 243.825060][ T29] audit: type=1400 audit(1794652091.325:606): avc: denied { write } for pid=11147 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 243.870865][ T3028] 8021q: adding VLAN 0 to HW filter on device eth5 [ 244.003819][ T29] audit: type=1400 audit(1794652091.505:607): avc: denied { write } for pid=11158 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 244.040297][ T29] audit: type=1400 audit(1794652091.536:608): avc: denied { write } for pid=11170 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 245.022881][T11184] __nla_validate_parse: 6 callbacks suppressed [ 245.022903][T11184] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2770'. [ 245.074166][T11188] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2772'. [ 246.640230][T11122] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 246.650520][T11061] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 246.658640][T11217] netlink: 'syz.0.2784': attribute type 1 has an invalid length. [ 246.658740][T11217] netlink: 'syz.0.2784': attribute type 2 has an invalid length. [ 246.662782][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 246.663497][T11061] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 246.689510][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 246.690076][T11061] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 246.710145][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 246.712514][T11061] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 246.779856][T11061] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 246.829365][T11061] 8021q: adding VLAN 0 to HW filter on device bond0 [ 246.843082][T11061] 8021q: adding VLAN 0 to HW filter on device team0 [ 246.846801][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 246.846836][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 246.853603][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 246.853638][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 246.872140][T11241] syzkaller0: entered promiscuous mode [ 246.872163][T11241] syzkaller0: entered allmulticast mode [ 246.959683][T11246] syzkaller0: entered promiscuous mode [ 246.959708][T11246] syzkaller0: entered allmulticast mode [ 247.226869][T11276] netlink: 68 bytes leftover after parsing attributes in process `syz.5.2806'. [ 247.309626][T11061] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 247.508264][T11061] veth0_vlan: entered promiscuous mode [ 247.519235][T11061] veth1_vlan: entered promiscuous mode [ 247.546401][T11061] veth0_macvtap: entered promiscuous mode [ 247.555587][T11061] veth1_macvtap: entered promiscuous mode [ 247.569299][T11061] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 247.582696][T11061] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 247.630960][ T8042] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.632776][ T687] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.632848][ T687] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 247.632879][ T687] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 248.679386][T11324] syzkaller0: entered promiscuous mode [ 248.679450][T11324] syzkaller0: entered allmulticast mode [ 248.996743][T11335] siw: device registration error -23 [ 249.138467][T11370] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2830'. [ 249.167972][T11343] lo speed is unknown, defaulting to 1000 [ 249.192026][ T687] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.206447][T11373] syzkaller0: entered promiscuous mode [ 249.206468][T11373] syzkaller0: entered allmulticast mode [ 249.231193][T11343] gretap0 speed is unknown, defaulting to 1000 [ 249.251288][ T687] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.254283][T11377] siw: device registration error -23 [ 249.298666][ T687] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.350506][ T687] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 249.367024][T11343] bridge0: port 1(bridge_slave_0) entered blocking state [ 249.367059][T11343] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.367113][T11343] bridge_slave_0: entered allmulticast mode [ 249.367619][T11343] bridge_slave_0: entered promiscuous mode [ 249.370414][T11343] bridge0: port 2(bridge_slave_1) entered blocking state [ 249.370450][T11343] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.370504][T11343] bridge_slave_1: entered allmulticast mode [ 249.370997][T11343] bridge_slave_1: entered promiscuous mode [ 249.383973][T11343] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 249.385093][T11343] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 249.406332][T11343] team0: Port device team_slave_0 added [ 249.408461][T11343] team0: Port device team_slave_1 added [ 249.440056][T11343] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 249.440072][T11343] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 249.440101][T11343] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 249.456722][T11343] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 249.456738][T11343] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 249.456831][T11343] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 249.529809][ T687] bridge_slave_1: left allmulticast mode [ 249.529835][ T687] bridge_slave_1: left promiscuous mode [ 249.530004][ T687] bridge0: port 2(bridge_slave_1) entered disabled state [ 249.546537][ T687] bridge_slave_0: left allmulticast mode [ 249.546559][ T687] bridge_slave_0: left promiscuous mode [ 249.546714][ T687] bridge0: port 1(bridge_slave_0) entered disabled state [ 249.629431][T11402] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2841'. [ 249.651744][ T687] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 249.668169][ T687] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 249.681661][ T687] bond0 (unregistering): Released all slaves [ 249.689172][T11343] hsr_slave_0: entered promiscuous mode [ 249.689516][T11343] hsr_slave_1: entered promiscuous mode [ 249.689835][T11343] debugfs: 'hsr0' already exists in 'hsr' [ 249.689850][T11343] Cannot create hsr debugfs directory [ 249.694784][ T9] infiniband syz0: ib_query_port failed (-19) [ 249.752176][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.752235][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.752705][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.756831][T11406] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 249.795171][ T687] tipc: Disabling bearer [ 249.795229][ T687] tipc: Left network mode [ 249.805580][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.806564][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.813379][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.814225][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.815793][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.816701][T11406] gretap0 speed is unknown, defaulting to 1000 [ 249.867564][ T687] hsr_slave_0: left promiscuous mode [ 249.867904][ T687] hsr_slave_1: left promiscuous mode [ 249.880869][ T687] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 249.880888][ T687] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 249.884712][ T687] veth1_macvtap: left promiscuous mode [ 249.884742][ T687] veth0_macvtap: left promiscuous mode [ 249.884837][ T687] veth1_vlan: left promiscuous mode [ 249.884891][ T687] veth0_vlan: left promiscuous mode [ 249.971807][ T687] team0 (unregistering): Port device team_slave_1 removed [ 249.974035][ T687] team0 (unregistering): Port device team_slave_0 removed [ 249.999734][ T8017] smc: removing ib device syz2 [ 250.012004][ T9363] infiniband syz2: ib_query_port failed (-19) [ 251.003665][T11432] netlink: 72 bytes leftover after parsing attributes in process `syz.3.2852'. [ 251.140633][T11448] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2860'. [ 251.195836][T11449] ================================================================== [ 251.195872][T11449] BUG: KCSAN: data-race in bpf_obj_memcpy / bpf_obj_memcpy [ 251.195903][T11449] [ 251.195911][T11449] write to 0xffff88811727e018 of 4866 bytes by task 11448 on cpu 0: [ 251.195931][T11449] bpf_obj_memcpy+0x16a/0x190 [ 251.195957][T11449] rhtab_map_update_elem+0xec/0xf40 [ 251.195991][T11449] bpf_map_update_value+0x4ee/0x570 [ 251.196028][T11449] generic_map_update_batch+0x4eb/0x710 [ 251.196058][T11449] bpf_map_do_batch+0x25b/0x380 [ 251.196082][T11449] __sys_bpf+0xa8e/0xc30 [ 251.196104][T11449] __x64_sys_bpf+0x69/0x80 [ 251.196127][T11449] x64_sys_call+0xf26/0x2550 [ 251.196157][T11449] do_syscall_64+0x112/0x360 [ 251.196193][T11449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 251.196217][T11449] [ 251.196223][T11449] write to 0xffff88811727e018 of 4866 bytes by task 11449 on cpu 1: [ 251.196239][T11449] bpf_obj_memcpy+0x16a/0x190 [ 251.196258][T11449] rhtab_map_update_elem+0xec/0xf40 [ 251.196286][T11449] bpf_map_update_value+0x4ee/0x570 [ 251.196323][T11449] generic_map_update_batch+0x4eb/0x710 [ 251.196360][T11449] bpf_map_do_batch+0x25b/0x380 [ 251.196391][T11449] __sys_bpf+0xa8e/0xc30 [ 251.196415][T11449] __x64_sys_bpf+0x69/0x80 [ 251.196437][T11449] x64_sys_call+0xf26/0x2550 [ 251.196459][T11449] do_syscall_64+0x112/0x360 [ 251.196489][T11449] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 251.196511][T11449] [ 251.196517][T11449] Reported by Kernel Concurrency Sanitizer on: [ 251.196530][T11449] CPU: 1 UID: 0 PID: 11449 Comm: syz.3.2860 Not tainted syzkaller #0 PREEMPT(lazy) [ 251.196559][T11449] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 251.196583][T11449] ================================================================== [ 252.025890][T11346] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 252.036667][T11343] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 252.050721][T11343] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 252.051243][T11343] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 252.064801][T11343] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 252.066233][T11343] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 252.072839][T11343] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 252.093698][T11343] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 252.095719][T11343] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 252.124249][T11343] 8021q: adding VLAN 0 to HW filter on device bond0 [ 252.137244][T11343] 8021q: adding VLAN 0 to HW filter on device team0 [ 252.140962][ T687] bridge0: port 1(bridge_slave_0) entered blocking state [ 252.140997][ T687] bridge0: port 1(bridge_slave_0) entered forwarding state [ 252.144401][ T687] bridge0: port 2(bridge_slave_1) entered blocking state [ 252.144436][ T687] bridge0: port 2(bridge_slave_1) entered forwarding state [ 252.211045][ T29] audit: type=1400 audit(1794652099.711:609): avc: denied { write } for pid=11451 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 252.234351][ T29] audit: type=1400 audit(1794652099.721:610): avc: denied { write } for pid=11473 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 252.315168][T11343] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 252.335935][ T29] audit: type=1400 audit(1794652099.831:611): avc: denied { write } for pid=11475 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 252.381715][ T29] audit: type=1400 audit(1794652099.881:612): avc: denied { write } for pid=11497 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 252.387859][T11343] veth0_vlan: entered promiscuous mode [ 252.390331][T11343] veth1_vlan: entered promiscuous mode [ 252.400568][T11343] veth0_macvtap: entered promiscuous mode [ 252.402010][T11343] veth1_macvtap: entered promiscuous mode [ 252.406582][T11343] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 252.410863][T11343] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 252.413711][ T8017] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.413845][ T8017] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.413963][ T8017] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 252.414075][ T8017] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0