last executing test programs: 29.363129172s ago: executing program 2 (id=4865): r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x800454dd, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) close(0x3) r1 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r3, @ANYRES8=r5], 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000000000000000000004000008510000006000000180a0000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup, 0x5, 0x0, 0x3, &(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) 27.969431165s ago: executing program 2 (id=4872): socket$kcm(0x2, 0x3, 0x106) bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x3, 0x8, 0x2, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x109a42, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r4, &(0x7f00000000c0)={0x0, 0x3f00, &(0x7f0000000000)=[{&(0x7f0000000040)="0209000302000000e4a17c45c8d260c9", 0x10}], 0x1}, 0x0) recvmsg$unix(r2, &(0x7f0000003040)={&(0x7f0000002d40), 0x6e, 0x0}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x10, &(0x7f0000000040), 0x4) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000800) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x20, &(0x7f0000000680)=[{&(0x7f0000000340)="d80000001c0081044e81f782db44b904021d0802010000000500f0a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x20004800) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) close(r0) 27.118090339s ago: executing program 2 (id=4876): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x3, 0x0, 0x0, 0x4, 0x1, 0x5}]}}, &(0x7f0000000580)=""/252, 0x26, 0xfc, 0x1, 0xfff}, 0x28) 26.994057586s ago: executing program 2 (id=4879): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x90ff}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x2, 0x3, 0x84) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x891c, &(0x7f0000000100)) 26.596471786s ago: executing program 2 (id=4882): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000200)="1c0000001e0081054e81f782db020000071d080006007c09e8fe08a104000e000a00142603600e1208000fc01e000406a80016c008000e400400027c035c0461c1967f6f94007134cff6d26efb8000a0ffa290457f01895416277ce06bba0000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d25ccca", 0x7d}], 0x1}, 0x804) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x100f40, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x8, [@enum64={0x5, 0x0, 0x0, 0x13, 0x1, 0x2}]}, {0x0, [0x5f, 0x2e, 0x0, 0x30, 0x61, 0x3e]}}, 0x0, 0x2c, 0x0, 0x1, 0x9}, 0x28) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0x1}, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000180)={0x1, 0x58, &(0x7f0000000100)}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000001c0), 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x48) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8003}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x8, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20403, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x9}, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4}, 0x0, 0x10, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x60, &(0x7f0000000000)=[{&(0x7f0000000300)="2000000011008188040f80ec59acbc0413a181000d0000000001000000000000", 0x20}], 0x1}, 0x40000) r3 = socket$kcm(0x2, 0x6, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe0e41b0000900ac00060411000000040012000a0005000248035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db7259826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d00"/216, 0xd8}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0x21, &(0x7f0000000240), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x9, 0x4, &(0x7f0000000780)=ANY=[@ANYRESOCT=r1], &(0x7f0000000c40)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x59, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xf, 0x0, &(0x7f0000000740)='syzkaller\x00', 0x9, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) sendmsg$inet(r3, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4004, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10, 0x0}, 0x28008840) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.events\x00', 0x275a, 0x0) setsockopt$sock_attach_bpf(r6, 0x1, 0x41, &(0x7f0000000100)=r7, 0x8) setsockopt$sock_attach_bpf(r6, 0x1, 0x41, &(0x7f0000000100)=r5, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x45, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46, 0x8, 0x0, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 25.652410235s ago: executing program 2 (id=4887): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct={0x3, 0x0, 0x0, 0x4, 0x1, 0x5}]}}, &(0x7f0000000580)=""/252, 0x26, 0xfc, 0x1, 0xfff}, 0x28) 19.02318277s ago: executing program 0 (id=4915): r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4, 0x0, 0x2, 0x8, 0x0, 0x3ff, 0x1000, 0x3, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x2, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000000c0), 0x13}, 0x4c20, 0xf851, 0x7, 0x4, 0x6, 0x8, 0x2, 0x0, 0xffffff80, 0x0, 0x8}, 0xffffffffffffffff, 0x4, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000180)={0x1, 0x80, 0x4, 0xd, 0x4, 0x7, 0x0, 0x400, 0x40000, 0xd, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0xff, 0x2, @perf_config_ext={0x1, 0x7}, 0x38c7, 0xd, 0x3ff, 0x6, 0x7, 0x6, 0x4, 0x0, 0x800, 0x0, 0x7fffffffffffffff}) socket$kcm(0xa, 0x922000000002, 0x11) r1 = syz_clone(0x0, 0x0, 0x1c, 0x0, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000002b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x0, 0x4, 0x98, 0x4, 0x4e53, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x3, 0x0, 0x1, 0x81, '\x00', 0x0, 0xffffffffffffffff, 0x5}, 0x50) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000080)={r3, r4}, 0xc) 18.630268631s ago: executing program 0 (id=4918): bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x8}, 0xfffffffffffffc5c) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000e9ffffff00000000000000000000000000000000a36f602b64e2b3fb0d88d5240830741c0000"], 0x48) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0xb, 0x0, &(0x7f0000000340)) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000008a0000007d000000000000189500000000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffdfd}, 0x48) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) close(0x3) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58}, 0x10) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x10040, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x2, 0x20000}, 0x102065, 0x0, 0x0, 0x3, 0x7, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x18000000000002a0, 0x19, 0x0, &(0x7f0000000100)="b9ff0b078059268cb89e14f088a82de0ffff20000000000200", 0x0, 0x10004, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) 18.487853578s ago: executing program 1 (id=4920): bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x8}, 0xfffffffffffffc5c) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000e9ffffff00000000000000000000000000000000a36f602b64e2b3fb0d88d5240830741c0000"], 0x48) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0xb, 0x0, &(0x7f0000000340)) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000008a0000007d000000000000189500000000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffdfd}, 0x48) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0x3) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58}, 0x10) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x10040, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x2, 0x20000}, 0x102065, 0x0, 0x0, 0x3, 0x7, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x18000000000002a0, 0x19, 0x0, &(0x7f0000000100)="b9ff0b078059268cb89e14f088a82de0ffff20000000000200", 0x0, 0x10004, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) 18.177674204s ago: executing program 1 (id=4921): r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, 0x0, 0x0) 17.806607993s ago: executing program 1 (id=4922): perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x10020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8cffffffffffffff}, 0x3b3d, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffe, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) perf_event_open(&(0x7f0000000580)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x64099, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x147b81, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x9, 0x9, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x20, 0x0, 0xf0c7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000300), 0x45) socket$kcm(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000740)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00', 0x1, 0x0, 0x0, 0x40f00}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000400"], 0x48) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="180000000200000000000000fcffffff18110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7020000140000c0b7030000000000008500000083000000bf090000000000005509010000000000950000000000000085000000a0000000bf91000000000000b7"], &(0x7f0000000000)='GPL\x00', 0xa, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x3}, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0xa, 0x2}, @printk={@i, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000000)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f0000000100)={'a', ' *:* ', 'rm\x00'}, 0x9) 17.805080173s ago: executing program 3 (id=4923): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) close(0x3) r0 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) 17.659132751s ago: executing program 0 (id=4924): r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x800454dd, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) close(0x3) r1 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r3, @ANYRES8=r5], 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000000000000000000004000008510000006000000180a0000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup, 0x5, 0x0, 0x3, &(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) 17.499132459s ago: executing program 3 (id=4925): r0 = socket$kcm(0x2, 0x3, 0x106) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x4000032, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000007110410000000000950000070000f5de0000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) (async) r4 = getpid() sendmsg$unix(r3, &(0x7f0000002400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000023c0)=[@cred={{0x1c, 0x1, 0x2, {r4, 0xee01}}}], 0x20, 0x4050}, 0x4000001) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r5) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100e64, 0xc78}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0xa, 0x7, 0x73) close(r6) (async) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.sectors\x00', 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r7, 0x89e1, &(0x7f0000000100)={r0}) (async) setsockopt$sock_attach_bpf(r1, 0x107, 0x2, 0x0, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r8, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/23, 0x17}, 0x10020) (async) setsockopt$sock_attach_bpf(r8, 0x1, 0x10, &(0x7f0000001280), 0x4) (async) sendmsg$inet(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000480)='}@', 0x2}], 0x1}, 0x8001) r10 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070011000523a608463a3f", @ANYRES16=r10], 0xfe33) (async) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000700)="fbd2", 0x2}, {&(0x7f0000000680)="660f829e3add48b05d82", 0xa}, {&(0x7f0000000800)="adb34727cc508abe1092fb01d95f9d", 0xf}], 0x3}, 0x0) 17.146676398s ago: executing program 1 (id=4926): r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x800454dd, 0x0) close(0x3) r1 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="5c00000015006b03000000d86e6c1d000a117ea6", 0x14}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000200)=ANY=[@ANYRES8=r2, @ANYRES8=r3], 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000000000000000000004000008510000006000000180a0000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) 16.985000676s ago: executing program 3 (id=4927): bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x8}, 0xfffffffffffffc5c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000e9ffffff00000000000000000000000000000000a36f602b64e2b3fb0d88d5240830741c0000"], 0x48) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0xb, 0x0, &(0x7f0000000340)) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x10040, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x2, 0x20000}, 0x102065, 0x0, 0x0, 0x3, 0x7, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) 16.52590846s ago: executing program 0 (id=4928): bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x8}, 0xfffffffffffffc5c) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000e9ffffff00000000000000000000000000000000a36f602b64e2b3fb0d88d5240830741c0000"], 0x48) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0xf1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$tipc(0x1e, 0xb, 0x0, &(0x7f0000000340)) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000008a0000007d000000000000189500000000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffdfd}, 0x48) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0x3) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x58}, 0x10) perf_event_open(&(0x7f0000000840)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x10040, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_config_ext={0x2, 0x20000}, 0x102065, 0x0, 0x0, 0x3, 0x7, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x18000000000002a0, 0x19, 0x0, &(0x7f0000000100)="b9ff0b078059268cb89e14f088a82de0ffff20000000000200", 0x0, 0x10004, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0xe, &(0x7f0000000900)=ANY=[@ANYBLOB="b7020000f7ffffffbfa70000000000002402000020fe29817a0af0fff8ffffff69a4f0ff00000000b70600000018d1fe2d6405000000000075040000000000400704000000000000b7040000100000206a0700fe000000008500000005000000b70000000a00000095000000000000000000c2c62f6004ad13aa957e2af5e49a53c2868f0399d909a63796c113a80c19aab9d607000000b6c9483be3f0d3253730e714c46cc4f79fd2b316da4f0de8163f6242fa7323f1740637c48468766af540439fce41f144631ac262dcae18c3d1a1fbe96dc86035b44174f7c0620254ab6d285e6b343185089a0f119e31975e551558050800000000000000125d67857f290870093f38153608561a2128a79cce912d1f05de330800a9f5422bee8ca49166f6a587f2f593775afcd071efc5a972f757521b7b38ec273c2ad3e406f8c124f7dc1c4553229a69df4b2780e6da4420d71489fe383e0b5ce08b750502f2b8add8d2dddde19ac050537e973782b4053150580035fb2c579e1b2100000033d1ee8cab6d236f05b1f7b9f78fd5abfe033eb79f7a0b498366f5edfe311258016fbf47d9c85bf5325bf61419372be377022433e20900a262b20bb8b36de7b0e6c5ebfc5baec1ebe58d4af587d33e2935ad68da6e0fea5c21301f5d002b51a5b60fc741cb2c5d4cd5e896774f9293a6435558795043404ac6eafc8310fbcacca7f971b260fd06d4590ded8429fcd1c9a8dbbdedb32675388df363c0bc536e00448208b72405ebf27ddb402e5a2d675aaad92e183cef1eadc1661140fb567b55c72907a1aca75277a5f0022b1e957ba737f10f1161c5ae6e2cc64072ff3b4e76084922242e63d4b7806e30f786cff147e4bc819060678319a0e5534f5a0db52526c30000000000000000000000a63705b1a60525620acca06d57c055059df7651768310c9085c5f86be6ab819506961ad51f18b35fdc3fd4d0a0dbbdcd494ef168931f27748787bee95d739fef7ee67dd21c34647de82707e41d7db6d981a4fcf0bbd3d38ebb7a2489e28c6b28c0f70092ffb016b7766399555f3e6b538c2c862d17e53eaeb2036f9f0ab6e95e71bda4b5bbf53344264ad93bac1207b31d6e9c78181c7fe204c0b7582d1c762857f2a2e0c60f4a4855591a4f70f94df9629e470701103c40c8f6d3a3068091d62b58999e0a046f9509cb8ddc2a9ad4e0f1f85e5f076218b4b931acdff0c34fc5bdbad17ec481f1c9b17727c14e053e315d0d8d03c24ddaba65c5ce5b1aa04d1f767e25662b155d49460ec720d54044ac2856c11407835f341e2614bcae270000000001000000df7f736aab5d713240b2f40ec7be8251eba969686b2670ddc1a84df6ab12ab3e0cf8747837062233935704ebbd943ef0c5fef29513c7c1d6d2611796dccb45bdfd9e6533ad3574be5b9ea70e0c3b41a32067c03f5f8ed147cd0655c90d656f66eaed18a3c284c4f19417b5d91431759356db5d45ea40c9866957105b6252b0c028c672049ce163126f143f5758faf2a43f4c4f45a69b4e9113f85ae531085c11c75edbdee5af454757cdaff396c15ab9b210c202ffaea96d1bac60c6d6c56a4babc659858789bd479334e13e1c7876f95429431e61400815788c1397b260600d78e7513c58d9ac9474d392cc06f789753e1e7ebf5f1b55e2a64b9150c6580bf48e7bff763034801cccf403108d127b959ffc425a563ea2b90fbe779fd7d2ebfe94"], &(0x7f0000000280)='GPL\x00'}, 0x48) 16.380148568s ago: executing program 1 (id=4929): r0 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, 0x0, 0x0) 16.246081065s ago: executing program 3 (id=4930): syz_clone(0x9040000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0x181100, &(0x7f0000000540), 0x0, 0x0, 0x0, 0x0) 16.157477929s ago: executing program 1 (id=4931): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000040000013"], 0x0, 0x26, 0x0, 0x8}, 0x28) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x26, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x26, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 16.051456264s ago: executing program 0 (id=4932): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) close(0x3) r0 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup, 0x5, 0x0, 0x3, 0x0, 0x0, 0x0, &(0x7f0000000140), &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) 15.964894539s ago: executing program 3 (id=4933): r0 = socket$kcm(0x23, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r0, 0x541b, &(0x7f0000000640)) 15.866303805s ago: executing program 3 (id=4934): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0xc0189436, &(0x7f0000000480)={'wlan1\x00', @random='\\\x00\x00 \x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="2e00000029008188e6b62aa73772cc9f1ba1f848430000005e140602000006020e00280010000700028000001294", 0x2e}], 0x1}, 0x0) 15.815169727s ago: executing program 0 (id=4935): r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x800454dd, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) close(0x3) r1 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r3, @ANYRES8=r5], 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000000000000000000004000008510000006000000180a0000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup, 0x5, 0x0, 0x3, &(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) 1.050329635s ago: executing program 32 (id=4931): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000040000013"], 0x0, 0x26, 0x0, 0x8}, 0x28) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x26, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x26, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) 44.457458ms ago: executing program 33 (id=4935): r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x800454dd, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) close(0x3) r1 = socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r3, @ANYRES8=r5], 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="180800000000000000000000004000008510000006000000180a0000", @ANYRES32, @ANYBLOB="00000000000000006600000000000000180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2}, 0x94) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016004163d25a80648c2594f91724fc60", 0x14}], 0x1}, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup, 0x5, 0x0, 0x3, &(0x7f0000000040)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000140)=[0x0, 0x0, 0x0], &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000001c0)=[0x0]}, 0x40) 0s ago: executing program 34 (id=4934): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0xc0189436, &(0x7f0000000480)={'wlan1\x00', @random='\\\x00\x00 \x00'}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000040000000c"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000000)="2e00000029008188e6b62aa73772cc9f1ba1f848430000005e140602000006020e00280010000700028000001294", 0x2e}], 0x1}, 0x0) kernel console output (not intermixed with test programs): 0 [ 979.350177][T19325] wiphy_register+0x1dad/0x2ae0 [ 979.355094][T19325] ? cfg80211_event_work+0x40/0x40 [ 979.360244][T19325] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 979.366464][T19325] ieee80211_register_hw+0x3464/0x4250 [ 979.371995][T19325] ? ieee80211_tasklet_handler+0x20/0x20 [ 979.377689][T19325] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 979.383634][T19325] ? __debug_object_init+0xec/0x450 [ 979.388891][T19325] ? __asan_memset+0x22/0x40 [ 979.393529][T19325] ? __hrtimer_init+0x186/0x270 [ 979.398422][T19325] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 979.404216][T19325] ? mac80211_hwsim_free+0x220/0x220 [ 979.409545][T19325] ? hwsim_new_radio_nl+0xdb9/0x1a90 [ 979.414873][T19325] hwsim_new_radio_nl+0xdc9/0x1a90 [ 979.420037][T19325] ? __nla_validate+0x50/0x50 [ 979.424765][T19325] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 979.431148][T19325] ? __nla_parse+0x40/0x50 [ 979.435616][T19325] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 979.441991][T19325] genl_family_rcv_msg_doit+0x211/0x310 [ 979.447759][T19325] ? end_current_label_crit_section+0x170/0x170 [ 979.454222][T19325] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 979.460195][T19325] ? bpf_lsm_capable+0x9/0x10 [ 979.464920][T19325] ? security_capable+0x89/0xb0 [ 979.469909][T19325] genl_rcv_msg+0x619/0x7a0 [ 979.474554][T19325] ? genl_bind+0x360/0x360 [ 979.479064][T19325] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 979.485497][T19325] ? netlink_rcv_skb+0xa0/0x4d0 [ 979.490403][T19325] netlink_rcv_skb+0x241/0x4d0 [ 979.495218][T19325] ? genl_bind+0x360/0x360 [ 979.499688][T19325] ? netlink_ack+0x1180/0x1180 [ 979.504690][T19325] ? __lock_acquire+0x7d40/0x7d40 [ 979.509766][T19325] ? down_read+0x1ac/0x2e0 [ 979.514311][T19325] genl_rcv+0x28/0x40 [ 979.518344][T19325] netlink_unicast+0x751/0x8d0 [ 979.523184][T19325] netlink_sendmsg+0x8d0/0xbf0 [ 979.528028][T19325] ? netlink_getsockopt+0x590/0x590 [ 979.533304][T19325] ? aa_sock_msg_perm+0x94/0x150 [ 979.538293][T19325] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 979.543621][T19325] ? security_socket_sendmsg+0x80/0xa0 [ 979.549125][T19325] ? netlink_getsockopt+0x590/0x590 [ 979.554378][T19325] ____sys_sendmsg+0x5ba/0x960 [ 979.559192][T19325] ? __asan_memset+0x22/0x40 [ 979.563829][T19325] ? __sys_sendmsg_sock+0x30/0x30 [ 979.568979][T19325] ? __import_iovec+0x5f2/0x850 [ 979.573914][T19325] ? import_iovec+0x73/0xa0 [ 979.578472][T19325] ___sys_sendmsg+0x2a6/0x360 [ 979.583201][T19325] ? __sys_sendmsg+0x2a0/0x2a0 [ 979.588077][T19325] __se_sys_sendmsg+0x1c2/0x2b0 [ 979.592996][T19325] ? __x64_sys_sendmsg+0x80/0x80 [ 979.598006][T19325] ? lockdep_hardirqs_on+0x98/0x150 [ 979.603260][T19325] do_syscall_64+0x55/0xa0 [ 979.607714][T19325] ? clear_bhb_loop+0x40/0x90 [ 979.612435][T19325] ? clear_bhb_loop+0x40/0x90 [ 979.617152][T19325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 979.623080][T19325] RIP: 0033:0x7f03c719c819 [ 979.627529][T19325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 979.647178][T19325] RSP: 002b:00007f03c812c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 979.655637][T19325] RAX: ffffffffffffffda RBX: 00007f03c7415fa0 RCX: 00007f03c719c819 [ 979.663644][T19325] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 979.671689][T19325] RBP: 00007f03c7232c91 R08: 0000000000000000 R09: 0000000000000000 [ 979.679895][T19325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 979.687991][T19325] R13: 00007f03c7416038 R14: 00007f03c7415fa0 R15: 00007ffe9f6834d8 [ 979.696028][T19325] [ 979.717693][T14924] Bluetooth: hci0: command 0x0406 tx timeout [ 980.677740][T14924] Bluetooth: hci4: unexpected event 0x04 length: 151 > 10 [ 980.720855][T19346] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4595'. [ 980.966372][T19350] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4596'. [ 981.074055][T19346] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 981.087163][T19346] CPU: 0 PID: 19346 Comm: syz.2.4595 Not tainted syzkaller #0 [ 981.094966][T19346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 981.105224][T19346] Call Trace: [ 981.108541][T19346] [ 981.111521][T19346] dump_stack_lvl+0x18c/0x250 [ 981.116260][T19346] ? show_regs_print_info+0x20/0x20 [ 981.121499][T19346] ? load_image+0x420/0x420 [ 981.126031][T19346] ? kasan_save_alloc_info+0xb/0x30 [ 981.131269][T19346] sysfs_warn_dup+0x8e/0xa0 [ 981.135796][T19346] sysfs_do_create_link_sd+0xc0/0x110 [ 981.141201][T19346] device_add_class_symlinks+0x1cf/0x240 [ 981.146968][T19346] device_add+0x507/0xc20 [ 981.151333][T19346] wiphy_register+0x1dad/0x2ae0 [ 981.156222][T19346] ? cfg80211_event_work+0x40/0x40 [ 981.161348][T19346] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 981.167565][T19346] ieee80211_register_hw+0x3464/0x4250 [ 981.173074][T19346] ? ieee80211_tasklet_handler+0x20/0x20 [ 981.178788][T19346] ? __hrtimer_init+0x186/0x270 [ 981.183683][T19346] ? __sanitizer_cov_trace_pc+0x8/0x60 [ 981.189174][T19346] ? __hrtimer_init+0x186/0x270 [ 981.194050][T19346] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 981.199808][T19346] ? mac80211_hwsim_free+0x220/0x220 [ 981.205160][T19346] ? rcu_is_watching+0x15/0xb0 [ 981.209946][T19346] ? kstrndup+0xbd/0x140 [ 981.214226][T19346] hwsim_new_radio_nl+0xdc9/0x1a90 [ 981.219370][T19346] ? __nla_validate+0x50/0x50 [ 981.224075][T19346] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 981.230439][T19346] ? __nla_parse+0x40/0x50 [ 981.234889][T19346] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 981.241245][T19346] genl_family_rcv_msg_doit+0x211/0x310 [ 981.246824][T19346] ? end_current_label_crit_section+0x170/0x170 [ 981.253116][T19346] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 981.259036][T19346] ? bpf_lsm_capable+0x9/0x10 [ 981.263736][T19346] ? security_capable+0x89/0xb0 [ 981.268624][T19346] genl_rcv_msg+0x619/0x7a0 [ 981.273159][T19346] ? genl_bind+0x360/0x360 [ 981.277590][T19346] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 981.283951][T19346] netlink_rcv_skb+0x241/0x4d0 [ 981.288743][T19346] ? genl_bind+0x360/0x360 [ 981.293266][T19346] ? netlink_ack+0x1180/0x1180 [ 981.298072][T19346] ? down_read+0x61/0x2e0 [ 981.302529][T19346] ? down_read+0x1ac/0x2e0 [ 981.306965][T19346] genl_rcv+0x28/0x40 [ 981.311050][T19346] netlink_unicast+0x751/0x8d0 [ 981.315940][T19346] netlink_sendmsg+0x8d0/0xbf0 [ 981.320727][T19346] ? lockdep_hardirqs_on+0x98/0x150 [ 981.325951][T19346] ? netlink_getsockopt+0x590/0x590 [ 981.331190][T19346] ? bpf_lsm_socket_accept+0x10/0x10 [ 981.336503][T19346] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 981.341806][T19346] ? security_socket_sendmsg+0x80/0xa0 [ 981.347306][T19346] ? netlink_getsockopt+0x590/0x590 [ 981.352546][T19346] ____sys_sendmsg+0x5ba/0x960 [ 981.357339][T19346] ? __asan_memset+0x22/0x40 [ 981.361950][T19346] ? __sys_sendmsg_sock+0x30/0x30 [ 981.366995][T19346] ? __import_iovec+0x5f2/0x850 [ 981.371879][T19346] ? import_iovec+0x73/0xa0 [ 981.376400][T19346] ___sys_sendmsg+0x2a6/0x360 [ 981.381099][T19346] ? __sys_sendmsg+0x2a0/0x2a0 [ 981.385924][T19346] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 981.391946][T19346] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 981.398223][T19346] ? __fdget+0x173/0x210 [ 981.402497][T19346] __se_sys_sendmsg+0x1c2/0x2b0 [ 981.407419][T19346] ? __x64_sys_sendmsg+0x80/0x80 [ 981.412408][T19346] do_syscall_64+0x55/0xa0 [ 981.416907][T19346] ? clear_bhb_loop+0x40/0x90 [ 981.421598][T19346] ? clear_bhb_loop+0x40/0x90 [ 981.426294][T19346] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 981.432302][T19346] RIP: 0033:0x7f637679c819 [ 981.436769][T19346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 981.456587][T19346] RSP: 002b:00007f6377735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 981.465044][T19346] RAX: ffffffffffffffda RBX: 00007f6376a15fa0 RCX: 00007f637679c819 [ 981.473039][T19346] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 981.481031][T19346] RBP: 00007f6376832c91 R08: 0000000000000000 R09: 0000000000000000 [ 981.489021][T19346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 981.497009][T19346] R13: 00007f6376a16038 R14: 00007f6376a15fa0 R15: 00007ffd21a41f78 [ 981.505026][T19346] [ 981.767512][T14924] Bluetooth: hci0: command 0x0406 tx timeout [ 982.428287][T14924] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 982.472525][T19363] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4602'. [ 982.568214][T14924] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 982.727861][T14924] Bluetooth: hci4: command 0x0406 tx timeout [ 982.793897][T19363] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 982.883168][T19363] CPU: 0 PID: 19363 Comm: syz.1.4602 Not tainted syzkaller #0 [ 982.890834][T19363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 982.901209][T19363] Call Trace: [ 982.904556][T19363] [ 982.907536][T19363] dump_stack_lvl+0x18c/0x250 [ 982.912311][T19363] ? show_regs_print_info+0x20/0x20 [ 982.917684][T19363] ? load_image+0x420/0x420 [ 982.922325][T19363] sysfs_warn_dup+0x8e/0xa0 [ 982.926900][T19363] sysfs_do_create_link_sd+0xc0/0x110 [ 982.932434][T19363] device_add_class_symlinks+0x1cf/0x240 [ 982.938138][T19363] device_add+0x507/0xc20 [ 982.942528][T19363] wiphy_register+0x1dad/0x2ae0 [ 982.947514][T19363] ? cfg80211_event_work+0x40/0x40 [ 982.952653][T19363] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 982.959032][T19363] ieee80211_register_hw+0x3464/0x4250 [ 982.964649][T19363] ? ieee80211_tasklet_handler+0x20/0x20 [ 982.970356][T19363] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 982.976292][T19363] ? __debug_object_init+0xec/0x450 [ 982.981532][T19363] ? __asan_memset+0x22/0x40 [ 982.986150][T19363] ? __hrtimer_init+0x186/0x270 [ 982.991033][T19363] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 982.996973][T19363] ? mac80211_hwsim_free+0x220/0x220 [ 983.002292][T19363] ? rcu_is_watching+0x15/0xb0 [ 983.007138][T19363] ? kstrndup+0xbd/0x140 [ 983.011413][T19363] hwsim_new_radio_nl+0xdc9/0x1a90 [ 983.016641][T19363] ? __nla_validate+0x50/0x50 [ 983.021449][T19363] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 983.027895][T19363] ? __nla_parse+0x40/0x50 [ 983.032422][T19363] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 983.038774][T19363] genl_family_rcv_msg_doit+0x211/0x310 [ 983.044514][T19363] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 983.050775][T19363] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 983.056699][T19363] ? __sanitizer_cov_trace_const_cmp4+0x4/0x90 [ 983.062968][T19363] genl_rcv_msg+0x619/0x7a0 [ 983.067506][T19363] ? genl_bind+0x360/0x360 [ 983.071956][T19363] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 983.078310][T19363] ? kasan_check_range+0xdd/0x290 [ 983.083378][T19363] netlink_rcv_skb+0x241/0x4d0 [ 983.088186][T19363] ? genl_bind+0x360/0x360 [ 983.092622][T19363] ? netlink_ack+0x1180/0x1180 [ 983.097508][T19363] ? down_read+0x61/0x2e0 [ 983.101881][T19363] ? down_read+0x1ac/0x2e0 [ 983.106327][T19363] genl_rcv+0x28/0x40 [ 983.110432][T19363] netlink_unicast+0x751/0x8d0 [ 983.115265][T19363] netlink_sendmsg+0x8d0/0xbf0 [ 983.120074][T19363] ? lockdep_hardirqs_on+0x98/0x150 [ 983.125343][T19363] ? netlink_getsockopt+0x590/0x590 [ 983.130666][T19363] ? security_socket_sendmsg+0x5a/0xa0 [ 983.136159][T19363] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 983.141479][T19363] ? security_socket_sendmsg+0x80/0xa0 [ 983.146977][T19363] ? netlink_getsockopt+0x590/0x590 [ 983.152211][T19363] ____sys_sendmsg+0x5ba/0x960 [ 983.157000][T19363] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 983.163186][T19363] ? __asan_memset+0x22/0x40 [ 983.167800][T19363] ? __sys_sendmsg_sock+0x30/0x30 [ 983.172839][T19363] ? __import_iovec+0x5f2/0x850 [ 983.177749][T19363] ? import_iovec+0x73/0xa0 [ 983.182271][T19363] ___sys_sendmsg+0x2a6/0x360 [ 983.186965][T19363] ? lock_acquire+0xb7/0x420 [ 983.191587][T19363] ? __sys_sendmsg+0x2a0/0x2a0 [ 983.196601][T19363] __se_sys_sendmsg+0x1c2/0x2b0 [ 983.201473][T19363] ? __x64_sys_sendmsg+0x80/0x80 [ 983.206442][T19363] ? syscall_enter_from_user_mode+0x2e/0x80 [ 983.212362][T19363] do_syscall_64+0x55/0xa0 [ 983.216806][T19363] ? clear_bhb_loop+0x40/0x90 [ 983.221501][T19363] ? clear_bhb_loop+0x40/0x90 [ 983.226198][T19363] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 983.232107][T19363] RIP: 0033:0x7f526239c819 [ 983.236732][T19363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 983.256545][T19363] RSP: 002b:00007f52632ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 983.265085][T19363] RAX: ffffffffffffffda RBX: 00007f5262615fa0 RCX: 00007f526239c819 [ 983.273071][T19363] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 983.281056][T19363] RBP: 00007f5262432c91 R08: 0000000000000000 R09: 0000000000000000 [ 983.289254][T19363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 983.297337][T19363] R13: 00007f5262616038 R14: 00007f5262615fa0 R15: 00007ffe1b7ef888 [ 983.305433][T19363] [ 983.333998][ T5085] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 983.350199][ T5085] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 983.362310][ T5085] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 983.387686][ T5085] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 983.396250][ T5085] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 983.402346][T19368] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4604'. [ 983.414068][ T5085] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 983.540486][T19368] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 983.555305][T19368] CPU: 1 PID: 19368 Comm: syz.0.4604 Not tainted syzkaller #0 [ 983.562853][T19368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 983.572960][T19368] Call Trace: [ 983.576329][T19368] [ 983.579288][T19368] dump_stack_lvl+0x18c/0x250 [ 983.584017][T19368] ? show_regs_print_info+0x20/0x20 [ 983.589278][T19368] ? load_image+0x420/0x420 [ 983.593826][T19368] sysfs_warn_dup+0x8e/0xa0 [ 983.598345][T19368] sysfs_do_create_link_sd+0xc0/0x110 [ 983.603731][T19368] device_add_class_symlinks+0x1cf/0x240 [ 983.609423][T19368] device_add+0x507/0xc20 [ 983.613782][T19368] wiphy_register+0x1dad/0x2ae0 [ 983.618674][T19368] ? cfg80211_event_work+0x40/0x40 [ 983.623887][T19368] ? minstrel_ht_alloc+0x88a/0x990 [ 983.629115][T19368] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 983.635204][T19368] ieee80211_register_hw+0x3464/0x4250 [ 983.640700][T19368] ? ieee80211_tasklet_handler+0x20/0x20 [ 983.646348][T19368] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 983.652267][T19368] ? __debug_object_init+0xec/0x450 [ 983.657516][T19368] ? __asan_memset+0x22/0x40 [ 983.662145][T19368] ? __hrtimer_init+0x186/0x270 [ 983.667023][T19368] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 983.672846][T19368] ? mac80211_hwsim_free+0x220/0x220 [ 983.678161][T19368] ? rcu_is_watching+0x15/0xb0 [ 983.683007][T19368] ? kstrndup+0xbd/0x140 [ 983.687288][T19368] hwsim_new_radio_nl+0xdc9/0x1a90 [ 983.692425][T19368] ? __nla_validate+0x50/0x50 [ 983.697304][T19368] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 983.703664][T19368] ? __nla_parse+0x40/0x50 [ 983.708105][T19368] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 983.714548][T19368] genl_family_rcv_msg_doit+0x211/0x310 [ 983.720112][T19368] ? end_current_label_crit_section+0x170/0x170 [ 983.726473][T19368] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 983.732392][T19368] ? bpf_lsm_capable+0x9/0x10 [ 983.737091][T19368] ? security_capable+0x89/0xb0 [ 983.742020][T19368] genl_rcv_msg+0x619/0x7a0 [ 983.746559][T19368] ? genl_bind+0x360/0x360 [ 983.751004][T19368] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 983.757465][T19368] netlink_rcv_skb+0x241/0x4d0 [ 983.762253][T19368] ? genl_bind+0x360/0x360 [ 983.766719][T19368] ? netlink_ack+0x1180/0x1180 [ 983.771555][T19368] ? __lock_acquire+0x7d40/0x7d40 [ 983.776678][T19368] ? down_read+0x1ac/0x2e0 [ 983.781132][T19368] genl_rcv+0x28/0x40 [ 983.785143][T19368] netlink_unicast+0x751/0x8d0 [ 983.789951][T19368] netlink_sendmsg+0x8d0/0xbf0 [ 983.794914][T19368] ? netlink_getsockopt+0x590/0x590 [ 983.800256][T19368] ? __sanitizer_cov_trace_pc+0x10/0x60 [ 983.806013][T19368] ? aa_sock_msg_perm+0x94/0x150 [ 983.811066][T19368] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 983.816382][T19368] ? security_socket_sendmsg+0x80/0xa0 [ 983.821864][T19368] ? netlink_getsockopt+0x590/0x590 [ 983.827094][T19368] ____sys_sendmsg+0x5ba/0x960 [ 983.831892][T19368] ? __asan_memset+0x22/0x40 [ 983.836514][T19368] ? __sys_sendmsg_sock+0x30/0x30 [ 983.841550][T19368] ? __import_iovec+0x5f2/0x850 [ 983.846507][T19368] ? import_iovec+0x73/0xa0 [ 983.851044][T19368] ___sys_sendmsg+0x2a6/0x360 [ 983.855743][T19368] ? __sys_sendmsg+0x2a0/0x2a0 [ 983.860571][T19368] __se_sys_sendmsg+0x1c2/0x2b0 [ 983.865438][T19368] ? __x64_sys_sendmsg+0x80/0x80 [ 983.870407][T19368] ? syscall_enter_from_user_mode+0x2e/0x80 [ 983.876320][T19368] do_syscall_64+0x55/0xa0 [ 983.880834][T19368] ? clear_bhb_loop+0x40/0x90 [ 983.885530][T19368] ? clear_bhb_loop+0x40/0x90 [ 983.890231][T19368] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 983.896142][T19368] RIP: 0033:0x7f4a5c39c819 [ 983.900577][T19368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 983.920202][T19368] RSP: 002b:00007f4a5d1d8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 983.928632][T19368] RAX: ffffffffffffffda RBX: 00007f4a5c615fa0 RCX: 00007f4a5c39c819 [ 983.937009][T19368] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 983.945347][T19368] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 983.953344][T19368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 983.961354][T19368] R13: 00007f4a5c616038 R14: 00007f4a5c615fa0 R15: 00007ffd71537948 [ 983.969453][T19368] [ 984.089007][T19380] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4607'. [ 984.163690][T19381] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 984.348005][T16573] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.475211][T16573] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.501582][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 984.510154][T19395] FAULT_INJECTION: forcing a failure. [ 984.510154][T19395] name failslab, interval 1, probability 0, space 0, times 0 [ 984.523240][T19395] CPU: 0 PID: 19395 Comm: syz.1.4613 Not tainted syzkaller #0 [ 984.530708][T19395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 984.540895][T19395] Call Trace: [ 984.544185][T19395] [ 984.547118][T19395] dump_stack_lvl+0x18c/0x250 [ 984.551808][T19395] ? show_regs_print_info+0x20/0x20 [ 984.557046][T19395] ? load_image+0x420/0x420 [ 984.561588][T19395] should_fail_ex+0x39d/0x4d0 [ 984.566290][T19395] should_failslab+0x9/0x20 [ 984.570804][T19395] slab_pre_alloc_hook+0x59/0x310 [ 984.575849][T19395] kmem_cache_alloc_node+0x60/0x320 [ 984.581059][T19395] ? __alloc_skb+0x103/0x2c0 [ 984.585739][T19395] __alloc_skb+0x103/0x2c0 [ 984.590267][T19395] arp_create+0x19f/0x9f0 [ 984.594783][T19395] ? arp_send_dst+0x230/0x230 [ 984.599568][T19395] ? arp_solicit+0x12c/0xe40 [ 984.604194][T19395] arp_send_dst+0xa7/0x230 [ 984.608662][T19395] arp_solicit+0xc05/0xe40 [ 984.613124][T19395] ? arp_solicit+0x12c/0xe40 [ 984.617752][T19395] ? arp_ifdown+0x20/0x20 [ 984.622116][T19395] ? __lock_acquire+0x7d40/0x7d40 [ 984.627168][T19395] ? __skb_clone+0x480/0x790 [ 984.631834][T19395] ? arp_ifdown+0x20/0x20 [ 984.636263][T19395] __neigh_event_send+0xed1/0x1440 [ 984.641436][T19395] neigh_resolve_output+0x19b/0x730 [ 984.646762][T19395] ? ip_finish_output2+0x11e0/0x11e0 [ 984.652077][T19395] ? nf_nat_ipv4_out+0x2f4/0x4d0 [ 984.657395][T19395] ? ip_finish_output2+0x457/0x11e0 [ 984.662619][T19395] ip_finish_output2+0xd3a/0x11e0 [ 984.667752][T19395] ? ip_finish_output2+0x457/0x11e0 [ 984.672966][T19395] ? nf_hook+0xa2/0x390 [ 984.677133][T19395] ? __ip_local_out+0x5f0/0x5f0 [ 984.682258][T19395] ? nf_hook+0xa2/0x390 [ 984.686464][T19395] ? ip_fragment+0x210/0x210 [ 984.691080][T19395] ? ip_mc_finish_output+0x250/0x250 [ 984.696377][T19395] ? ip_skb_dst_mtu+0x58a/0x9c0 [ 984.701329][T19395] ? ip_finish_output+0x3ef/0x4c0 [ 984.706380][T19395] ip_output+0x2a1/0x3b0 [ 984.710730][T19395] ? ip_output+0x60/0x3b0 [ 984.715085][T19395] ip_send_skb+0x12f/0x1d0 [ 984.719552][T19395] raw_sendmsg+0x163e/0x1c00 [ 984.724191][T19395] ? compat_raw_ioctl+0x70/0x70 [ 984.729187][T19395] ? __lock_acquire+0x1273/0x7d40 [ 984.734438][T19395] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 984.740983][T19395] ? sock_rps_record_flow+0x19/0x3f0 [ 984.746405][T19395] ? inet_sendmsg+0x7c/0x2f0 [ 984.751078][T19395] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 984.756488][T19395] ? security_socket_sendmsg+0x80/0xa0 [ 984.762172][T19395] ? inet_send_prepare+0x260/0x260 [ 984.767311][T19395] ____sys_sendmsg+0x5ba/0x960 [ 984.772095][T19395] ? __lock_acquire+0x7d40/0x7d40 [ 984.777140][T19395] ? __asan_memset+0x22/0x40 [ 984.781754][T19395] ? __sys_sendmsg_sock+0x30/0x30 [ 984.786806][T19395] ? __import_iovec+0x5f2/0x850 [ 984.791807][T19395] ? import_iovec+0x73/0xa0 [ 984.796357][T19395] ___sys_sendmsg+0x2a6/0x360 [ 984.801063][T19395] ? get_pid_task+0x20/0x1e0 [ 984.805701][T19395] ? __sys_sendmsg+0x2a0/0x2a0 [ 984.810589][T19395] ? __lock_acquire+0x7d40/0x7d40 [ 984.815753][T19395] __se_sys_sendmsg+0x1c2/0x2b0 [ 984.820889][T19395] ? __x64_sys_sendmsg+0x80/0x80 [ 984.825861][T19395] ? lockdep_hardirqs_on+0x98/0x150 [ 984.831185][T19395] do_syscall_64+0x55/0xa0 [ 984.835832][T19395] ? clear_bhb_loop+0x40/0x90 [ 984.840531][T19395] ? clear_bhb_loop+0x40/0x90 [ 984.845223][T19395] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 984.851228][T19395] RIP: 0033:0x7f526239c819 [ 984.855747][T19395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 984.876146][T19395] RSP: 002b:00007f52632ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 984.884859][T19395] RAX: ffffffffffffffda RBX: 00007f5262615fa0 RCX: 00007f526239c819 [ 984.893231][T19395] RDX: 0000000020040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 984.901253][T19395] RBP: 00007f52632ed090 R08: 0000000000000000 R09: 0000000000000000 [ 984.909435][T19395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 984.917513][T19395] R13: 00007f5262616038 R14: 00007f5262615fa0 R15: 00007ffe1b7ef888 [ 984.925765][T19395] [ 984.943329][ T5085] Bluetooth: hci1: command 0x0406 tx timeout [ 985.033382][T19401] netlink: 'syz.2.4612': attribute type 1 has an invalid length. [ 985.104972][T16573] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.173725][T19403] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4614'. [ 985.190696][ T5085] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 985.450210][ T5085] Bluetooth: hci3: command tx timeout [ 985.880898][T16573] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 985.910634][T19373] chnl_net:caif_netlink_parms(): no params data found [ 985.925343][T19403] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 985.947640][T19403] CPU: 1 PID: 19403 Comm: syz.1.4614 Not tainted syzkaller #0 [ 985.955304][T19403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 985.965592][T19403] Call Trace: [ 985.969008][T19403] [ 985.972154][T19403] dump_stack_lvl+0x18c/0x250 [ 985.976921][T19403] ? show_regs_print_info+0x20/0x20 [ 985.982218][T19403] ? load_image+0x420/0x420 [ 985.986837][T19403] sysfs_warn_dup+0x8e/0xa0 [ 985.991413][T19403] sysfs_do_create_link_sd+0xc0/0x110 [ 985.996859][T19403] device_add_class_symlinks+0x1cf/0x240 [ 986.002955][T19403] device_add+0x507/0xc20 [ 986.007449][T19403] wiphy_register+0x1dad/0x2ae0 [ 986.012384][T19403] ? cfg80211_event_work+0x40/0x40 [ 986.017550][T19403] ? minstrel_ht_alloc+0x88a/0x990 [ 986.022728][T19403] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 986.028932][T19403] ieee80211_register_hw+0x3464/0x4250 [ 986.034456][T19403] ? ieee80211_tasklet_handler+0x20/0x20 [ 986.040136][T19403] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 986.046285][T19403] ? __debug_object_init+0xec/0x450 [ 986.051749][T19403] ? __asan_memset+0x22/0x40 [ 986.056393][T19403] ? __hrtimer_init+0x186/0x270 [ 986.061663][T19403] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 986.067566][T19403] ? mac80211_hwsim_free+0x220/0x220 [ 986.072993][T19403] ? hwsim_new_radio_nl+0xdb9/0x1a90 [ 986.078511][T19403] hwsim_new_radio_nl+0xdc9/0x1a90 [ 986.083667][T19403] ? __nla_validate+0x50/0x50 [ 986.088399][T19403] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 986.094880][T19403] ? __nla_parse+0x40/0x50 [ 986.099422][T19403] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 986.105884][T19403] genl_family_rcv_msg_doit+0x211/0x310 [ 986.111478][T19403] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 986.117435][T19403] genl_rcv_msg+0x619/0x7a0 [ 986.121992][T19403] ? genl_bind+0x360/0x360 [ 986.126617][T19403] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 986.133084][T19403] netlink_rcv_skb+0x241/0x4d0 [ 986.137891][T19403] ? genl_bind+0x360/0x360 [ 986.142352][T19403] ? netlink_ack+0x1180/0x1180 [ 986.147173][T19403] ? __lock_acquire+0x7d40/0x7d40 [ 986.152331][T19403] ? down_read+0x1ac/0x2e0 [ 986.156869][T19403] genl_rcv+0x28/0x40 [ 986.161055][T19403] netlink_unicast+0x751/0x8d0 [ 986.165871][T19403] netlink_sendmsg+0x8d0/0xbf0 [ 986.170691][T19403] ? lockdep_hardirqs_on+0x98/0x150 [ 986.176008][T19403] ? netlink_getsockopt+0x590/0x590 [ 986.181294][T19403] ? netlink_getsockopt+0x590/0x590 [ 986.186557][T19403] ____sys_sendmsg+0x5ba/0x960 [ 986.191558][T19403] ? __asan_memset+0x22/0x40 [ 986.196183][T19403] ? __sys_sendmsg_sock+0x30/0x30 [ 986.201236][T19403] ? __import_iovec+0x5f2/0x850 [ 986.206136][T19403] ? import_iovec+0x73/0xa0 [ 986.210689][T19403] ___sys_sendmsg+0x2a6/0x360 [ 986.215594][T19403] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 986.221528][T19403] ? __sys_sendmsg+0x2a0/0x2a0 [ 986.226367][T19403] ? lockdep_hardirqs_on+0x98/0x150 [ 986.231895][T19403] __se_sys_sendmsg+0x1c2/0x2b0 [ 986.237219][T19403] ? __x64_sys_sendmsg+0x80/0x80 [ 986.242211][T19403] ? syscall_enter_from_user_mode+0x2e/0x80 [ 986.248149][T19403] do_syscall_64+0x55/0xa0 [ 986.252680][T19403] ? clear_bhb_loop+0x40/0x90 [ 986.257482][T19403] ? clear_bhb_loop+0x40/0x90 [ 986.262201][T19403] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 986.268127][T19403] RIP: 0033:0x7f526239c819 [ 986.272584][T19403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 986.292229][T19403] RSP: 002b:00007f52632ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 986.300855][T19403] RAX: ffffffffffffffda RBX: 00007f5262615fa0 RCX: 00007f526239c819 [ 986.308857][T19403] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 986.316854][T19403] RBP: 00007f5262432c91 R08: 0000000000000000 R09: 0000000000000000 [ 986.324852][T19403] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 986.332948][T19403] R13: 00007f5262616038 R14: 00007f5262615fa0 R15: 00007ffe1b7ef888 [ 986.340987][T19403] [ 986.649724][T19373] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.657231][T19373] bridge0: port 1(bridge_slave_0) entered disabled state [ 986.664913][T19373] bridge_slave_0: entered allmulticast mode [ 986.686508][T19373] bridge_slave_0: entered promiscuous mode [ 986.699137][ T5085] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 986.717333][T19408] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4615'. [ 986.726114][T19373] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.750659][T19373] bridge0: port 2(bridge_slave_1) entered disabled state [ 986.764716][T19373] bridge_slave_1: entered allmulticast mode [ 986.773422][T19373] bridge_slave_1: entered promiscuous mode [ 986.782134][T19411] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4616'. [ 986.862475][T19408] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 986.877972][T19408] CPU: 1 PID: 19408 Comm: syz.0.4615 Not tainted syzkaller #0 [ 986.885524][T19408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 986.895778][T19408] Call Trace: [ 986.899361][T19408] [ 986.902358][T19408] dump_stack_lvl+0x18c/0x250 [ 986.907116][T19408] ? show_regs_print_info+0x20/0x20 [ 986.912459][T19408] ? load_image+0x420/0x420 [ 986.917047][T19408] sysfs_warn_dup+0x8e/0xa0 [ 986.921604][T19408] sysfs_do_create_link_sd+0xc0/0x110 [ 986.927024][T19408] device_add_class_symlinks+0x1cf/0x240 [ 986.932726][T19408] device_add+0x507/0xc20 [ 986.937126][T19408] wiphy_register+0x1dad/0x2ae0 [ 986.942060][T19408] ? cfg80211_event_work+0x40/0x40 [ 986.947228][T19408] ? minstrel_ht_alloc+0x88a/0x990 [ 986.952420][T19408] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 986.958565][T19408] ieee80211_register_hw+0x3464/0x4250 [ 986.964296][T19408] ? ieee80211_tasklet_handler+0x20/0x20 [ 986.970077][T19408] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 986.976112][T19408] ? __debug_object_init+0xec/0x450 [ 986.981413][T19408] ? __asan_memset+0x22/0x40 [ 986.986269][T19408] ? __hrtimer_init+0x186/0x270 [ 986.991259][T19408] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 986.997181][T19408] ? mac80211_hwsim_free+0x220/0x220 [ 987.002606][T19408] ? rcu_is_watching+0x15/0xb0 [ 987.007429][T19408] ? kstrndup+0xbd/0x140 [ 987.011740][T19408] hwsim_new_radio_nl+0xdc9/0x1a90 [ 987.016882][T19408] ? __nla_validate+0x50/0x50 [ 987.021587][T19408] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 987.027949][T19408] ? __nla_parse+0x40/0x50 [ 987.032392][T19408] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 987.038904][T19408] genl_family_rcv_msg_doit+0x211/0x310 [ 987.044472][T19408] ? end_current_label_crit_section+0x170/0x170 [ 987.050745][T19408] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 987.056780][T19408] ? bpf_lsm_capable+0x9/0x10 [ 987.061502][T19408] ? security_capable+0x89/0xb0 [ 987.066402][T19408] genl_rcv_msg+0x619/0x7a0 [ 987.070956][T19408] ? genl_bind+0x360/0x360 [ 987.075565][T19408] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 987.081930][T19408] netlink_rcv_skb+0x241/0x4d0 [ 987.086720][T19408] ? genl_bind+0x360/0x360 [ 987.091160][T19408] ? netlink_ack+0x1180/0x1180 [ 987.095984][T19408] ? netlink_rcv_skb+0xc/0x4d0 [ 987.100877][T19408] genl_rcv+0x28/0x40 [ 987.105066][T19408] netlink_unicast+0x751/0x8d0 [ 987.110047][T19408] netlink_sendmsg+0x8d0/0xbf0 [ 987.114922][T19408] ? lockdep_hardirqs_on+0x98/0x150 [ 987.120164][T19408] ? netlink_getsockopt+0x590/0x590 [ 987.125411][T19408] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 987.130717][T19408] ? security_socket_sendmsg+0x80/0xa0 [ 987.136196][T19408] ? netlink_getsockopt+0x590/0x590 [ 987.141441][T19408] ____sys_sendmsg+0x5ba/0x960 [ 987.146244][T19408] ? __asan_memset+0x22/0x40 [ 987.150856][T19408] ? __sys_sendmsg_sock+0x30/0x30 [ 987.155905][T19408] ? __import_iovec+0x5f2/0x850 [ 987.160883][T19408] ? import_iovec+0x73/0xa0 [ 987.165603][T19408] ___sys_sendmsg+0x2a6/0x360 [ 987.170306][T19408] ? __sys_sendmsg+0x2a0/0x2a0 [ 987.175233][T19408] __se_sys_sendmsg+0x1c2/0x2b0 [ 987.180107][T19408] ? __x64_sys_sendmsg+0x80/0x80 [ 987.185089][T19408] ? syscall_enter_from_user_mode+0x2e/0x80 [ 987.191032][T19408] do_syscall_64+0x55/0xa0 [ 987.195472][T19408] ? clear_bhb_loop+0x40/0x90 [ 987.200178][T19408] ? clear_bhb_loop+0x40/0x90 [ 987.204972][T19408] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 987.211142][T19408] RIP: 0033:0x7f4a5c39c819 [ 987.215581][T19408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 987.235580][T19408] RSP: 002b:00007f4a5d1d8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 987.244050][T19408] RAX: ffffffffffffffda RBX: 00007f4a5c615fa0 RCX: 00007f4a5c39c819 [ 987.252063][T19408] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 987.260056][T19408] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 987.268135][T19408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 987.276150][T19408] R13: 00007f4a5c616038 R14: 00007f4a5c615fa0 R15: 00007ffd71537948 [ 987.284369][T19408] [ 987.291706][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 987.391673][T19424] netlink: 'syz.2.4619': attribute type 10 has an invalid length. [ 987.433060][T19420] netlink: 'syz.1.4618': attribute type 2 has an invalid length. [ 987.441595][T19420] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4618'. [ 987.494762][T19373] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 987.543040][ T5085] Bluetooth: hci3: command tx timeout [ 987.666866][T19373] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 987.693861][T16573] tipc: Left network mode [ 987.791597][T19373] team0: Port device team_slave_0 added [ 988.364229][T19373] team0: Port device team_slave_1 added [ 988.591650][ T5085] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 988.740836][ T5085] Bluetooth: hci1: command 0x0406 tx timeout [ 988.786717][T19442] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4624'. [ 989.121699][T19373] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 989.133530][T19373] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 989.160842][T19373] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 989.175262][T19442] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 989.197665][T19442] CPU: 0 PID: 19442 Comm: syz.1.4624 Not tainted syzkaller #0 [ 989.205213][T19442] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 989.215283][T19442] Call Trace: [ 989.218594][T19442] [ 989.221746][T19442] dump_stack_lvl+0x18c/0x250 [ 989.226497][T19442] ? show_regs_print_info+0x20/0x20 [ 989.231843][T19442] ? load_image+0x420/0x420 [ 989.236517][T19442] sysfs_warn_dup+0x8e/0xa0 [ 989.241076][T19442] sysfs_do_create_link_sd+0xc0/0x110 [ 989.246594][T19442] device_add_class_symlinks+0x1cf/0x240 [ 989.252414][T19442] device_add+0x507/0xc20 [ 989.256787][T19442] wiphy_register+0x1dad/0x2ae0 [ 989.261680][T19442] ? cfg80211_event_work+0x40/0x40 [ 989.267175][T19442] ? minstrel_ht_alloc+0x88a/0x990 [ 989.272394][T19442] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 989.278850][T19442] ieee80211_register_hw+0x3464/0x4250 [ 989.284501][T19442] ? ieee80211_tasklet_handler+0x20/0x20 [ 989.290171][T19442] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 989.296604][T19442] ? __debug_object_init+0xec/0x450 [ 989.301927][T19442] ? __asan_memset+0x22/0x40 [ 989.306676][T19442] ? __hrtimer_init+0x186/0x270 [ 989.311696][T19442] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 989.317601][T19442] ? mac80211_hwsim_free+0x220/0x220 [ 989.322928][T19442] ? rcu_is_watching+0x15/0xb0 [ 989.327730][T19442] ? kstrndup+0xbd/0x140 [ 989.332029][T19442] hwsim_new_radio_nl+0xdc9/0x1a90 [ 989.337153][T19442] ? __nla_validate+0x50/0x50 [ 989.341859][T19442] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 989.348226][T19442] ? kasan_save_alloc_info+0xb/0x30 [ 989.353571][T19442] ? __nla_parse+0x40/0x50 [ 989.358008][T19442] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 989.364480][T19442] genl_family_rcv_msg_doit+0x211/0x310 [ 989.370261][T19442] ? end_current_label_crit_section+0x170/0x170 [ 989.376756][T19442] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 989.382820][T19442] ? bpf_lsm_capable+0x9/0x10 [ 989.387532][T19442] ? security_capable+0x89/0xb0 [ 989.392441][T19442] genl_rcv_msg+0x619/0x7a0 [ 989.397092][T19442] ? genl_bind+0x360/0x360 [ 989.401694][T19442] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 989.408064][T19442] ? kasan_check_range+0xa8/0x290 [ 989.413155][T19442] netlink_rcv_skb+0x241/0x4d0 [ 989.418039][T19442] ? genl_bind+0x360/0x360 [ 989.422593][T19442] ? netlink_ack+0x1180/0x1180 [ 989.427393][T19442] ? __lock_acquire+0x7d40/0x7d40 [ 989.432478][T19442] ? down_read+0x1ac/0x2e0 [ 989.436901][T19442] genl_rcv+0x28/0x40 [ 989.440898][T19442] netlink_unicast+0x751/0x8d0 [ 989.445896][T19442] netlink_sendmsg+0x8d0/0xbf0 [ 989.450820][T19442] ? netlink_getsockopt+0x590/0x590 [ 989.456059][T19442] ? __sanitizer_cov_trace_pc+0x3b/0x60 [ 989.461733][T19442] ? aa_sock_msg_perm+0x94/0x150 [ 989.466703][T19442] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 989.472001][T19442] ? security_socket_sendmsg+0x80/0xa0 [ 989.477489][T19442] ? netlink_getsockopt+0x590/0x590 [ 989.482786][T19442] ____sys_sendmsg+0x5ba/0x960 [ 989.487777][T19442] ? __asan_memset+0x22/0x40 [ 989.492411][T19442] ? __sys_sendmsg_sock+0x30/0x30 [ 989.497469][T19442] ? __import_iovec+0x5f2/0x850 [ 989.502466][T19442] ? import_iovec+0x73/0xa0 [ 989.506992][T19442] ___sys_sendmsg+0x2a6/0x360 [ 989.511690][T19442] ? __sys_sendmsg+0x2a0/0x2a0 [ 989.516480][T19442] ? perf_trace_preemptirq_template+0xac/0x330 [ 989.522701][T19442] __se_sys_sendmsg+0x1c2/0x2b0 [ 989.527619][T19442] ? __x64_sys_sendmsg+0x80/0x80 [ 989.532703][T19442] do_syscall_64+0x55/0xa0 [ 989.537131][T19442] ? clear_bhb_loop+0x40/0x90 [ 989.541819][T19442] ? clear_bhb_loop+0x40/0x90 [ 989.546624][T19442] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 989.552538][T19442] RIP: 0033:0x7f526239c819 [ 989.556961][T19442] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 989.576750][T19442] RSP: 002b:00007f52632ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 989.585183][T19442] RAX: ffffffffffffffda RBX: 00007f5262615fa0 RCX: 00007f526239c819 [ 989.593168][T19442] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 989.601158][T19442] RBP: 00007f5262432c91 R08: 0000000000000000 R09: 0000000000000000 [ 989.607709][ T5085] Bluetooth: hci3: command tx timeout [ 989.609144][T19442] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 989.622576][T19442] R13: 00007f5262616038 R14: 00007f5262615fa0 R15: 00007ffe1b7ef888 [ 989.630601][T19442] [ 989.663902][T19373] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 989.671380][T19373] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 989.697988][T19373] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 989.736413][T19459] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4626'. [ 989.802406][T19373] hsr_slave_0: entered promiscuous mode [ 989.815290][T19373] hsr_slave_1: entered promiscuous mode [ 990.144921][ T5085] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 990.213707][ T5085] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 990.647806][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 991.555883][ T5085] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 991.688870][ T5085] Bluetooth: hci3: command tx timeout [ 991.737256][T19507] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4639'. [ 992.060411][T19505] netlink: 'syz.0.4637': attribute type 1 has an invalid length. [ 992.171016][ T5085] Bluetooth: hci1: command 0x0406 tx timeout [ 992.254497][T19507] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 992.263234][T19507] CPU: 0 PID: 19507 Comm: syz.1.4639 Not tainted syzkaller #0 [ 992.271021][T19507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 992.282329][T19507] Call Trace: [ 992.285635][T19507] [ 992.288600][T19507] dump_stack_lvl+0x18c/0x250 [ 992.293401][T19507] ? show_regs_print_info+0x20/0x20 [ 992.298627][T19507] ? load_image+0x420/0x420 [ 992.303254][T19507] sysfs_warn_dup+0x8e/0xa0 [ 992.307787][T19507] sysfs_do_create_link_sd+0xc0/0x110 [ 992.313182][T19507] device_add_class_symlinks+0x1cf/0x240 [ 992.319041][T19507] device_add+0x507/0xc20 [ 992.323442][T19507] wiphy_register+0x1dad/0x2ae0 [ 992.328432][T19507] ? cfg80211_event_work+0x40/0x40 [ 992.333564][T19507] ? minstrel_ht_alloc+0x88a/0x990 [ 992.338718][T19507] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 992.344895][T19507] ieee80211_register_hw+0x3464/0x4250 [ 992.350483][T19507] ? ieee80211_tasklet_handler+0x20/0x20 [ 992.356161][T19507] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 992.362108][T19507] ? __debug_object_init+0xec/0x450 [ 992.367496][T19507] ? __asan_memset+0x22/0x40 [ 992.372121][T19507] ? __hrtimer_init+0x186/0x270 [ 992.377191][T19507] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 992.383048][T19507] ? mac80211_hwsim_free+0x220/0x220 [ 992.388359][T19507] ? hwsim_new_radio_nl+0xdb9/0x1a90 [ 992.393670][T19507] hwsim_new_radio_nl+0xdc9/0x1a90 [ 992.398814][T19507] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 992.404686][T19507] ? mark_lock+0x94/0x320 [ 992.409049][T19507] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 992.415593][T19507] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 992.421774][T19507] ? lockdep_hardirqs_on+0x98/0x150 [ 992.426998][T19507] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 992.433193][T19507] genl_family_rcv_msg_doit+0x211/0x310 [ 992.438766][T19507] ? end_current_label_crit_section+0x170/0x170 [ 992.445069][T19507] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 992.451023][T19507] ? bpf_lsm_capable+0x9/0x10 [ 992.455732][T19507] ? security_capable+0x89/0xb0 [ 992.460738][T19507] genl_rcv_msg+0x619/0x7a0 [ 992.465461][T19507] ? genl_bind+0x360/0x360 [ 992.469945][T19507] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 992.476395][T19507] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 992.482242][T19507] netlink_rcv_skb+0x241/0x4d0 [ 992.487124][T19507] ? genl_bind+0x360/0x360 [ 992.491564][T19507] ? netlink_ack+0x1180/0x1180 [ 992.496364][T19507] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 992.502549][T19507] ? down_read+0x1ac/0x2e0 [ 992.506992][T19507] genl_rcv+0x28/0x40 [ 992.511447][T19507] netlink_unicast+0x751/0x8d0 [ 992.516420][T19507] netlink_sendmsg+0x8d0/0xbf0 [ 992.521396][T19507] ? lockdep_hardirqs_on+0x98/0x150 [ 992.526628][T19507] ? netlink_getsockopt+0x590/0x590 [ 992.532047][T19507] ? netlink_getsockopt+0x590/0x590 [ 992.537301][T19507] ____sys_sendmsg+0x5ba/0x960 [ 992.542133][T19507] ? __asan_memset+0x22/0x40 [ 992.546775][T19507] ? __sys_sendmsg_sock+0x30/0x30 [ 992.551928][T19507] ? __import_iovec+0x5f2/0x850 [ 992.556857][T19507] ? import_iovec+0x73/0xa0 [ 992.561398][T19507] ___sys_sendmsg+0x2a6/0x360 [ 992.566287][T19507] ? __sys_sendmsg+0x2a0/0x2a0 [ 992.571077][T19507] ? perf_trace_preemptirq_template+0xac/0x330 [ 992.577316][T19507] __se_sys_sendmsg+0x1c2/0x2b0 [ 992.582290][T19507] ? __x64_sys_sendmsg+0x80/0x80 [ 992.587275][T19507] ? lockdep_hardirqs_on+0x98/0x150 [ 992.592496][T19507] do_syscall_64+0x55/0xa0 [ 992.597015][T19507] ? clear_bhb_loop+0x40/0x90 [ 992.601717][T19507] ? clear_bhb_loop+0x40/0x90 [ 992.606504][T19507] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 992.612420][T19507] RIP: 0033:0x7f526239c819 [ 992.616856][T19507] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 992.636574][T19507] RSP: 002b:00007f52632ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 992.645365][T19507] RAX: ffffffffffffffda RBX: 00007f5262615fa0 RCX: 00007f526239c819 [ 992.653533][T19507] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 992.661627][T19507] RBP: 00007f5262432c91 R08: 0000000000000000 R09: 0000000000000000 [ 992.669619][T19507] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 992.678058][T19507] R13: 00007f5262616038 R14: 00007f5262615fa0 R15: 00007ffe1b7ef888 [ 992.686182][T19507] [ 992.726145][T16573] hsr_slave_0: left promiscuous mode [ 992.733681][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 992.740661][T16573] hsr_slave_1: left promiscuous mode [ 992.746985][T16573] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 992.757175][T16573] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 992.765102][T16573] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 992.772580][T16573] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 992.788640][T16573] veth1_macvtap: left promiscuous mode [ 992.898984][T16573] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 993.235344][T16573] team0 (unregistering): Port device team_slave_1 removed [ 993.332231][T16573] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 993.378313][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 993.384729][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.796161][T16573] bond0 (unregistering): Released all slaves [ 993.891001][T19517] netlink: 201660 bytes leftover after parsing attributes in process `syz.2.4641'. [ 993.921179][T19517] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 994.175990][T19373] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 994.223044][T19373] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 994.285770][T19373] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 994.310330][T19373] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 994.618151][T19373] 8021q: adding VLAN 0 to HW filter on device bond0 [ 994.704158][T19373] 8021q: adding VLAN 0 to HW filter on device team0 [ 994.745426][T16578] bridge0: port 1(bridge_slave_0) entered blocking state [ 994.753437][T16578] bridge0: port 1(bridge_slave_0) entered forwarding state [ 994.820561][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 994.866275][T19541] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4650'. [ 994.889587][T16578] bridge0: port 2(bridge_slave_1) entered blocking state [ 994.897086][T16578] bridge0: port 2(bridge_slave_1) entered forwarding state [ 994.940498][ T5085] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 995.019887][T19373] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 995.082386][T19373] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 995.314754][T19541] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 995.326944][T19541] CPU: 1 PID: 19541 Comm: syz.1.4650 Not tainted syzkaller #0 [ 995.335055][T19541] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 995.345245][T19541] Call Trace: [ 995.348801][T19541] [ 995.351960][T19541] dump_stack_lvl+0x18c/0x250 [ 995.356802][T19541] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 995.363103][T19541] ? show_regs_print_info+0x20/0x20 [ 995.368648][T19541] ? load_image+0x420/0x420 [ 995.373228][T19541] sysfs_warn_dup+0x8e/0xa0 [ 995.377941][T19541] sysfs_do_create_link_sd+0xc0/0x110 [ 995.383352][T19541] device_add_class_symlinks+0x1cf/0x240 [ 995.389385][T19541] device_add+0x507/0xc20 [ 995.393804][T19541] wiphy_register+0x1dad/0x2ae0 [ 995.398690][T19541] ? cfg80211_event_work+0x40/0x40 [ 995.403823][T19541] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 995.409905][T19541] ieee80211_register_hw+0x3464/0x4250 [ 995.415435][T19541] ? ieee80211_tasklet_handler+0x20/0x20 [ 995.421339][T19541] ? debug_init+0x2d/0x1d0 [ 995.426002][T19541] ? __asan_memset+0x22/0x40 [ 995.430641][T19541] ? __hrtimer_init+0x186/0x270 [ 995.435568][T19541] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 995.441635][T19541] ? mac80211_hwsim_free+0x220/0x220 [ 995.447047][T19541] ? rcu_is_watching+0x15/0xb0 [ 995.452013][T19541] ? kstrndup+0xbd/0x140 [ 995.456399][T19541] hwsim_new_radio_nl+0xdc9/0x1a90 [ 995.461588][T19541] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 995.468919][T19541] ? mark_lock+0x94/0x320 [ 995.473310][T19541] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 995.479667][T19541] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 995.486122][T19541] ? lockdep_hardirqs_on+0x98/0x150 [ 995.491438][T19541] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 995.497743][T19541] genl_family_rcv_msg_doit+0x211/0x310 [ 995.503515][T19541] ? end_current_label_crit_section+0x170/0x170 [ 995.509789][T19541] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 995.515745][T19541] ? bpf_lsm_capable+0x9/0x10 [ 995.520487][T19541] ? security_capable+0x89/0xb0 [ 995.525384][T19541] genl_rcv_msg+0x619/0x7a0 [ 995.530704][T19541] ? genl_bind+0x360/0x360 [ 995.535164][T19541] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 995.541542][T19541] ? perf_trace_preemptirq_template+0x269/0x330 [ 995.548021][T19541] netlink_rcv_skb+0x241/0x4d0 [ 995.552934][T19541] ? genl_bind+0x360/0x360 [ 995.557382][T19541] ? netlink_ack+0x1180/0x1180 [ 995.562199][T19541] ? genl_rcv+0xd/0x40 [ 995.566473][T19541] ? down_read+0x1ac/0x2e0 [ 995.571087][T19541] genl_rcv+0x28/0x40 [ 995.575157][T19541] netlink_unicast+0x751/0x8d0 [ 995.579959][T19541] netlink_sendmsg+0x8d0/0xbf0 [ 995.584852][T19541] ? netlink_getsockopt+0x590/0x590 [ 995.590081][T19541] ? aa_sock_msg_perm+0x94/0x150 [ 995.595040][T19541] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 995.600361][T19541] ? security_socket_sendmsg+0x80/0xa0 [ 995.605949][T19541] ? netlink_getsockopt+0x590/0x590 [ 995.611176][T19541] ____sys_sendmsg+0x5ba/0x960 [ 995.615968][T19541] ? __asan_memset+0x22/0x40 [ 995.620588][T19541] ? __sys_sendmsg_sock+0x30/0x30 [ 995.625628][T19541] ? __import_iovec+0x5f2/0x850 [ 995.630513][T19541] ? import_iovec+0x73/0xa0 [ 995.635038][T19541] ___sys_sendmsg+0x2a6/0x360 [ 995.639807][T19541] ? __sys_sendmsg+0x2a0/0x2a0 [ 995.644607][T19541] ? trace_call_bpf+0xc3/0x6c0 [ 995.649408][T19541] ? seqcount_lockdep_reader_access+0x17b/0x1d0 [ 995.655699][T19541] __se_sys_sendmsg+0x1c2/0x2b0 [ 995.660660][T19541] ? __x64_sys_sendmsg+0x80/0x80 [ 995.665633][T19541] ? lockdep_hardirqs_on+0x98/0x150 [ 995.670946][T19541] do_syscall_64+0x55/0xa0 [ 995.678114][T19541] ? clear_bhb_loop+0x40/0x90 [ 995.682819][T19541] ? clear_bhb_loop+0x40/0x90 [ 995.687551][T19541] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 995.693481][T19541] RIP: 0033:0x7f526239c819 [ 995.697923][T19541] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 995.717632][T19541] RSP: 002b:00007f52632ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 995.726163][T19541] RAX: ffffffffffffffda RBX: 00007f5262615fa0 RCX: 00007f526239c819 [ 995.734342][T19541] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 995.742449][T19541] RBP: 00007f5262432c91 R08: 0000000000000000 R09: 0000000000000000 [ 995.751246][T19541] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 995.759414][T19541] R13: 00007f5262616038 R14: 00007f5262615fa0 R15: 00007ffe1b7ef888 [ 995.767555][T19541] [ 996.630407][T19373] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 996.894390][T19373] veth0_vlan: entered promiscuous mode [ 996.956961][T19373] veth1_vlan: entered promiscuous mode [ 996.967935][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 997.033024][T19373] veth0_macvtap: entered promiscuous mode [ 997.084504][T19373] veth1_macvtap: entered promiscuous mode [ 997.166219][T19373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 997.218883][T19373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.257674][T19373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 997.269567][T19373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.283613][T19373] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 997.304785][T19373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.331552][T19373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.351980][T19373] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 997.374484][T19373] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 997.415709][T19373] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 997.462297][T19373] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 997.490844][T19373] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 997.501968][T19373] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 997.513491][T19373] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 997.620290][T19584] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4656'. [ 997.748452][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 997.756805][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 997.984139][T16578] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 998.108490][T16578] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 998.131896][ T5085] Bluetooth: hci4: unexpected event 0x04 length: 151 > 10 [ 998.574092][T19590] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4659'. [ 998.600115][T19590] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 998.609448][T19590] CPU: 0 PID: 19590 Comm: syz.2.4659 Not tainted syzkaller #0 [ 998.617099][T19590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 998.627295][T19590] Call Trace: [ 998.630599][T19590] [ 998.633755][T19590] dump_stack_lvl+0x18c/0x250 [ 998.638498][T19590] ? show_regs_print_info+0x20/0x20 [ 998.643933][T19590] ? load_image+0x420/0x420 [ 998.648497][T19590] sysfs_warn_dup+0x8e/0xa0 [ 998.653035][T19590] sysfs_do_create_link_sd+0xc0/0x110 [ 998.658779][T19590] device_add_class_symlinks+0x1cf/0x240 [ 998.664550][T19590] device_add+0x507/0xc20 [ 998.668937][T19590] wiphy_register+0x1dad/0x2ae0 [ 998.673923][T19590] ? cfg80211_event_work+0x40/0x40 [ 998.679054][T19590] ? minstrel_ht_alloc+0x88a/0x990 [ 998.684303][T19590] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 998.690584][T19590] ieee80211_register_hw+0x3464/0x4250 [ 998.696099][T19590] ? ieee80211_tasklet_handler+0x20/0x20 [ 998.701752][T19590] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 998.707796][T19590] ? __debug_object_init+0xec/0x450 [ 998.713110][T19590] ? __asan_memset+0x22/0x40 [ 998.717723][T19590] ? __hrtimer_init+0x186/0x270 [ 998.722599][T19590] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 998.728370][T19590] ? mac80211_hwsim_free+0x220/0x220 [ 998.733685][T19590] ? rcu_is_watching+0x15/0xb0 [ 998.738560][T19590] ? kstrndup+0xbd/0x140 [ 998.742946][T19590] hwsim_new_radio_nl+0xdc9/0x1a90 [ 998.748108][T19590] ? __nla_validate+0x50/0x50 [ 998.753185][T19590] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 998.759665][T19590] ? __nla_parse+0x40/0x50 [ 998.764195][T19590] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 998.770722][T19590] genl_family_rcv_msg_doit+0x211/0x310 [ 998.776288][T19590] ? end_current_label_crit_section+0x170/0x170 [ 998.783027][T19590] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 998.789240][T19590] ? bpf_lsm_capable+0x9/0x10 [ 998.793957][T19590] ? security_capable+0x89/0xb0 [ 998.798959][T19590] genl_rcv_msg+0x619/0x7a0 [ 998.803507][T19590] ? genl_bind+0x360/0x360 [ 998.808033][T19590] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 998.814472][T19590] ? perf_trace_lock+0xfc/0x3b0 [ 998.819846][T19590] netlink_rcv_skb+0x241/0x4d0 [ 998.824903][T19590] ? genl_bind+0x360/0x360 [ 998.829454][T19590] ? netlink_ack+0x1180/0x1180 [ 998.834305][T19590] ? __lock_acquire+0x7d40/0x7d40 [ 998.845727][T19590] ? down_read+0x1ac/0x2e0 [ 998.850175][T19590] genl_rcv+0x28/0x40 [ 998.854264][T19590] netlink_unicast+0x751/0x8d0 [ 998.859172][T19590] netlink_sendmsg+0x8d0/0xbf0 [ 998.865002][T19590] ? netlink_getsockopt+0x590/0x590 [ 998.870265][T19590] ? aa_sock_msg_perm+0x94/0x150 [ 998.875236][T19590] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 998.880813][T19590] ? security_socket_sendmsg+0x80/0xa0 [ 998.886376][T19590] ? netlink_getsockopt+0x590/0x590 [ 998.891710][T19590] ____sys_sendmsg+0x5ba/0x960 [ 998.896502][T19590] ? __asan_memset+0x22/0x40 [ 998.901180][T19590] ? __sys_sendmsg_sock+0x30/0x30 [ 998.906224][T19590] ? __import_iovec+0x5f2/0x850 [ 998.911186][T19590] ? import_iovec+0x73/0xa0 [ 998.915824][T19590] ___sys_sendmsg+0x2a6/0x360 [ 998.920577][T19590] ? __sys_sendmsg+0x2a0/0x2a0 [ 998.926109][T19590] ? preempt_schedule_irq+0xea/0x150 [ 998.931738][T19590] __se_sys_sendmsg+0x1c2/0x2b0 [ 998.936716][T19590] ? __x64_sys_sendmsg+0x80/0x80 [ 998.942056][T19590] ? syscall_enter_from_user_mode+0x2e/0x80 [ 998.948118][T19590] do_syscall_64+0x55/0xa0 [ 998.953046][T19590] ? clear_bhb_loop+0x40/0x90 [ 998.958144][T19590] ? clear_bhb_loop+0x40/0x90 [ 998.962879][T19590] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 998.969079][T19590] RIP: 0033:0x7f637679c819 [ 998.974162][T19590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 998.994180][T19590] RSP: 002b:00007f6377735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 999.002630][T19590] RAX: ffffffffffffffda RBX: 00007f6376a15fa0 RCX: 00007f637679c819 [ 999.010668][T19590] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 999.018837][T19590] RBP: 00007f6376832c91 R08: 0000000000000000 R09: 0000000000000000 [ 999.026923][T19590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 999.035210][T19590] R13: 00007f6376a16038 R14: 00007f6376a15fa0 R15: 00007ffd21a41f78 [ 999.043245][T19590] [ 999.210039][T19610] netlink: 10 bytes leftover after parsing attributes in process `syz.3.4600'. [ 1000.168925][ T5085] Bluetooth: hci4: command 0x0406 tx timeout [ 1000.207929][T19629] bridge_slave_1: left allmulticast mode [ 1000.242794][T19629] bridge_slave_1: left promiscuous mode [ 1000.289060][T19629] bridge0: port 2(bridge_slave_1) entered disabled state [ 1000.324135][T19629] bridge_slave_0: left allmulticast mode [ 1000.354572][T19629] bridge_slave_0: left promiscuous mode [ 1000.379170][T19629] bridge0: port 1(bridge_slave_0) entered disabled state [ 1000.599043][T14924] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1000.611160][T14924] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1000.629673][T14924] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1000.641550][T14924] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1000.656128][T14924] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1000.667209][T14924] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1000.717219][T19645] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4672'. [ 1000.762520][T19633] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4669'. [ 1000.804378][T14924] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 1000.881618][T19645] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1000.891313][T19645] CPU: 1 PID: 19645 Comm: syz.0.4672 Not tainted syzkaller #0 [ 1000.898845][T19645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1000.909102][T19645] Call Trace: [ 1000.912518][T19645] [ 1000.915490][T19645] dump_stack_lvl+0x18c/0x250 [ 1000.920258][T19645] ? show_regs_print_info+0x20/0x20 [ 1000.925501][T19645] ? load_image+0x420/0x420 [ 1000.930084][T19645] sysfs_warn_dup+0x8e/0xa0 [ 1000.934673][T19645] sysfs_do_create_link_sd+0xc0/0x110 [ 1000.940190][T19645] device_add_class_symlinks+0x1cf/0x240 [ 1000.945848][T19645] device_add+0x507/0xc20 [ 1000.950215][T19645] wiphy_register+0x1dad/0x2ae0 [ 1000.955283][T19645] ? cfg80211_event_work+0x40/0x40 [ 1000.960414][T19645] ? minstrel_ht_alloc+0x88a/0x990 [ 1000.965687][T19645] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1000.971898][T19645] ieee80211_register_hw+0x3464/0x4250 [ 1000.977504][T19645] ? ieee80211_tasklet_handler+0x20/0x20 [ 1000.983334][T19645] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1000.989299][T19645] ? __debug_object_init+0xec/0x450 [ 1000.994634][T19645] ? __asan_memset+0x22/0x40 [ 1000.999261][T19645] ? __hrtimer_init+0x186/0x270 [ 1001.004245][T19645] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1001.010017][T19645] ? mac80211_hwsim_free+0x220/0x220 [ 1001.015316][T19645] ? rcu_is_watching+0x15/0xb0 [ 1001.020188][T19645] ? kstrndup+0xbd/0x140 [ 1001.024556][T19645] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1001.029692][T19645] ? __nla_validate+0x50/0x50 [ 1001.034409][T19645] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1001.040775][T19645] ? __nla_parse+0x40/0x50 [ 1001.045250][T19645] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1001.051630][T19645] genl_family_rcv_msg_doit+0x211/0x310 [ 1001.057209][T19645] ? end_current_label_crit_section+0x170/0x170 [ 1001.063478][T19645] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1001.069487][T19645] ? bpf_lsm_capable+0x9/0x10 [ 1001.074205][T19645] ? security_capable+0x89/0xb0 [ 1001.079106][T19645] genl_rcv_msg+0x619/0x7a0 [ 1001.083647][T19645] ? genl_bind+0x360/0x360 [ 1001.088259][T19645] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1001.094788][T19645] ? ref_tracker_free+0x690/0x840 [ 1001.099877][T19645] netlink_rcv_skb+0x241/0x4d0 [ 1001.104696][T19645] ? genl_bind+0x360/0x360 [ 1001.109148][T19645] ? netlink_ack+0x1180/0x1180 [ 1001.114207][T19645] ? __lock_acquire+0x7d40/0x7d40 [ 1001.119449][T19645] ? down_read+0x1ac/0x2e0 [ 1001.123975][T19645] genl_rcv+0x28/0x40 [ 1001.127979][T19645] netlink_unicast+0x751/0x8d0 [ 1001.132864][T19645] netlink_sendmsg+0x8d0/0xbf0 [ 1001.137760][T19645] ? netlink_getsockopt+0x590/0x590 [ 1001.143107][T19645] ? aa_sock_msg_perm+0x94/0x150 [ 1001.148076][T19645] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1001.153385][T19645] ? security_socket_sendmsg+0x80/0xa0 [ 1001.158866][T19645] ? netlink_getsockopt+0x590/0x590 [ 1001.164096][T19645] ____sys_sendmsg+0x5ba/0x960 [ 1001.168920][T19645] ? __asan_memset+0x22/0x40 [ 1001.173696][T19645] ? __sys_sendmsg_sock+0x30/0x30 [ 1001.178928][T19645] ? __import_iovec+0x5f2/0x850 [ 1001.184173][T19645] ? import_iovec+0x73/0xa0 [ 1001.188703][T19645] ___sys_sendmsg+0x2a6/0x360 [ 1001.193412][T19645] ? __sys_sendmsg+0x2a0/0x2a0 [ 1001.198228][T19645] ? trace_call_bpf+0xc3/0x6c0 [ 1001.203058][T19645] __se_sys_sendmsg+0x1c2/0x2b0 [ 1001.207942][T19645] ? __x64_sys_sendmsg+0x80/0x80 [ 1001.213200][T19645] ? lockdep_hardirqs_on+0x98/0x150 [ 1001.218738][T19645] do_syscall_64+0x55/0xa0 [ 1001.223199][T19645] ? clear_bhb_loop+0x40/0x90 [ 1001.228078][T19645] ? clear_bhb_loop+0x40/0x90 [ 1001.232894][T19645] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1001.238819][T19645] RIP: 0033:0x7f4a5c39c819 [ 1001.243600][T19645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1001.263420][T19645] RSP: 002b:00007f4a5d1b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1001.271897][T19645] RAX: ffffffffffffffda RBX: 00007f4a5c616090 RCX: 00007f4a5c39c819 [ 1001.279902][T19645] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1001.288259][T19645] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 1001.296420][T19645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1001.304503][T19645] R13: 00007f4a5c616128 R14: 00007f4a5c616090 R15: 00007ffd71537948 [ 1001.312958][T19645] [ 1001.405608][T19649] netlink: 'syz.2.4674': attribute type 12 has an invalid length. [ 1001.413812][T19649] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4674'. [ 1001.541848][T16580] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1001.680028][T16580] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1001.814550][T16580] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1001.852459][T19660] FAULT_INJECTION: forcing a failure. [ 1001.852459][T19660] name failslab, interval 1, probability 0, space 0, times 0 [ 1001.866653][T19660] CPU: 1 PID: 19660 Comm: syz.2.4679 Not tainted syzkaller #0 [ 1001.874321][T19660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1001.884575][T19660] Call Trace: [ 1001.887883][T19660] [ 1001.890827][T19660] dump_stack_lvl+0x18c/0x250 [ 1001.895730][T19660] ? show_regs_print_info+0x20/0x20 [ 1001.901145][T19660] ? load_image+0x420/0x420 [ 1001.905683][T19660] ? __might_sleep+0xe0/0xe0 [ 1001.910302][T19660] ? __lock_acquire+0x7d40/0x7d40 [ 1001.915378][T19660] should_fail_ex+0x39d/0x4d0 [ 1001.920089][T19660] should_failslab+0x9/0x20 [ 1001.924626][T19660] slab_pre_alloc_hook+0x59/0x310 [ 1001.929683][T19660] ? kvmalloc_node+0x70/0x180 [ 1001.935045][T19660] ? kvmalloc_node+0x70/0x180 [ 1001.939773][T19660] __kmem_cache_alloc_node+0x53/0x250 [ 1001.945287][T19660] ? kvmalloc_node+0x70/0x180 [ 1001.950005][T19660] __kmalloc_node+0xa4/0x230 [ 1001.954731][T19660] kvmalloc_node+0x70/0x180 [ 1001.959351][T19660] page_pool_create+0x1eb/0x5c0 [ 1001.964242][T19660] __veth_napi_enable_range+0x195/0x700 [ 1001.970293][T19660] ? __skb_frag_ref+0x1c0/0x1c0 [ 1001.975218][T19660] ? netif_napi_add_weight+0xa22/0xdf0 [ 1001.980789][T19660] veth_napi_enable_range+0xd0/0x150 [ 1001.986134][T19660] veth_set_features+0x1c8/0x2a0 [ 1001.991098][T19660] __netdev_update_features+0x9cb/0x18e0 [ 1001.996771][T19660] ? dev_xdp_attach+0x1030/0x1030 [ 1002.001833][T19660] ? __might_fault+0xaa/0x120 [ 1002.006544][T19660] ? __lock_acquire+0x7d40/0x7d40 [ 1002.011591][T19660] ? aa_get_newest_label+0xfd/0x5c0 [ 1002.016810][T19660] ? __might_fault+0xaa/0x120 [ 1002.021503][T19660] ? __might_fault+0xc6/0x120 [ 1002.026193][T19660] ? __might_fault+0xaa/0x120 [ 1002.030894][T19660] ethtool_set_one_feature+0x2a8/0x2f0 [ 1002.036383][T19660] ? apparmor_capable+0x137/0x1a0 [ 1002.041518][T19660] ? ethtool_get_one_feature+0x280/0x280 [ 1002.047287][T19660] ? security_capable+0x89/0xb0 [ 1002.052202][T19660] dev_ethtool+0xfd7/0x18d0 [ 1002.056749][T19660] ? ethtool_get_module_eeprom_call+0x170/0x170 [ 1002.063017][T19660] ? __lock_acquire+0x7d40/0x7d40 [ 1002.068064][T19660] ? __might_fault+0xaa/0x120 [ 1002.072758][T19660] ? full_name_hash+0x92/0xe0 [ 1002.077473][T19660] ? dev_load+0x21/0x1f0 [ 1002.081829][T19660] dev_ioctl+0x392/0x1140 [ 1002.086181][T19660] sock_do_ioctl+0x239/0x310 [ 1002.091054][T19660] ? sock_show_fdinfo+0xb0/0xb0 [ 1002.096115][T19660] sock_ioctl+0x5ba/0x7e0 [ 1002.100596][T19660] ? sock_poll+0x3e0/0x3e0 [ 1002.105061][T19660] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1002.110018][T19660] ? security_file_ioctl+0x80/0xa0 [ 1002.115175][T19660] ? sock_poll+0x3e0/0x3e0 [ 1002.119626][T19660] __se_sys_ioctl+0xfd/0x170 [ 1002.124254][T19660] do_syscall_64+0x55/0xa0 [ 1002.128701][T19660] ? clear_bhb_loop+0x40/0x90 [ 1002.133510][T19660] ? clear_bhb_loop+0x40/0x90 [ 1002.138667][T19660] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1002.144586][T19660] RIP: 0033:0x7f637679c819 [ 1002.149109][T19660] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1002.169000][T19660] RSP: 002b:00007f6377735028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1002.177443][T19660] RAX: ffffffffffffffda RBX: 00007f6376a15fa0 RCX: 00007f637679c819 [ 1002.185456][T19660] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000002f [ 1002.193621][T19660] RBP: 00007f6377735090 R08: 0000000000000000 R09: 0000000000000000 [ 1002.201603][T19660] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1002.209755][T19660] R13: 00007f6376a16038 R14: 00007f6376a15fa0 R15: 00007ffd21a41f78 [ 1002.217845][T19660] [ 1002.240023][T19660] page_pool_create() gave up with errno -12 [ 1002.251268][T19660] veth1_virt_wifi: set_features() failed (-12); wanted 0x000061164fdd59e9, left 0x000061164fdd19e9 [ 1002.264424][T19663] netlink: 'syz.3.4681': attribute type 17 has an invalid length. [ 1002.273372][T19663] netlink: 148 bytes leftover after parsing attributes in process `syz.3.4681'. [ 1002.401068][T16580] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1002.461549][T19640] chnl_net:caif_netlink_parms(): no params data found [ 1002.595441][T14924] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 1002.637792][T19668] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4682'. [ 1002.772102][T14924] Bluetooth: hci0: command tx timeout [ 1002.824152][T14924] Bluetooth: hci1: command 0x0406 tx timeout [ 1003.170023][T19668] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1003.178334][T19668] CPU: 0 PID: 19668 Comm: syz.0.4682 Not tainted syzkaller #0 [ 1003.185851][T19668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1003.196136][T19668] Call Trace: [ 1003.199468][T19668] [ 1003.202445][T19668] dump_stack_lvl+0x18c/0x250 [ 1003.207363][T19668] ? show_regs_print_info+0x20/0x20 [ 1003.212619][T19668] ? load_image+0x420/0x420 [ 1003.217199][T19668] sysfs_warn_dup+0x8e/0xa0 [ 1003.221900][T19668] sysfs_do_create_link_sd+0xc0/0x110 [ 1003.227309][T19668] device_add_class_symlinks+0x1cf/0x240 [ 1003.232970][T19668] device_add+0x507/0xc20 [ 1003.237502][T19668] wiphy_register+0x1dad/0x2ae0 [ 1003.242375][T19668] ? lock_chain_count+0x20/0x20 [ 1003.247695][T19668] ? cfg80211_event_work+0x40/0x40 [ 1003.252834][T19668] ? wiphy_register+0x11/0x2ae0 [ 1003.257794][T19668] ieee80211_register_hw+0x3464/0x4250 [ 1003.263467][T19668] ? ieee80211_tasklet_handler+0x20/0x20 [ 1003.269160][T19668] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1003.275077][T19668] ? __debug_object_init+0xec/0x450 [ 1003.280449][T19668] ? __asan_memset+0x22/0x40 [ 1003.285179][T19668] ? __hrtimer_init+0x186/0x270 [ 1003.290330][T19668] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1003.296255][T19668] ? mac80211_hwsim_free+0x220/0x220 [ 1003.301651][T19668] ? rcu_is_watching+0x15/0xb0 [ 1003.306439][T19668] ? kstrndup+0xbd/0x140 [ 1003.310716][T19668] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1003.315973][T19668] ? __nla_validate+0x50/0x50 [ 1003.320882][T19668] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1003.327257][T19668] ? __nla_parse+0x40/0x50 [ 1003.331705][T19668] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1003.338065][T19668] genl_family_rcv_msg_doit+0x211/0x310 [ 1003.343634][T19668] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1003.349779][T19668] ? bpf_lsm_capable+0x9/0x10 [ 1003.354486][T19668] ? security_capable+0x89/0xb0 [ 1003.359366][T19668] genl_rcv_msg+0x619/0x7a0 [ 1003.363923][T19668] ? genl_bind+0x360/0x360 [ 1003.368356][T19668] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1003.375436][T19668] netlink_rcv_skb+0x241/0x4d0 [ 1003.380260][T19668] ? genl_bind+0x360/0x360 [ 1003.384713][T19668] ? netlink_ack+0x1180/0x1180 [ 1003.389519][T19668] ? __lock_acquire+0x7d40/0x7d40 [ 1003.394617][T19668] ? down_read+0x1ac/0x2e0 [ 1003.399318][T19668] genl_rcv+0x28/0x40 [ 1003.403417][T19668] netlink_unicast+0x751/0x8d0 [ 1003.408241][T19668] netlink_sendmsg+0x8d0/0xbf0 [ 1003.413039][T19668] ? netlink_getsockopt+0x590/0x590 [ 1003.418441][T19668] ? netlink_getsockopt+0x590/0x590 [ 1003.423662][T19668] ____sys_sendmsg+0x5ba/0x960 [ 1003.428462][T19668] ? __asan_memset+0x22/0x40 [ 1003.433158][T19668] ? __sys_sendmsg_sock+0x30/0x30 [ 1003.438195][T19668] ? __import_iovec+0x5f2/0x850 [ 1003.443169][T19668] ? import_iovec+0x73/0xa0 [ 1003.447795][T19668] ___sys_sendmsg+0x2a6/0x360 [ 1003.452499][T19668] ? __sys_sendmsg+0x2a0/0x2a0 [ 1003.457328][T19668] __se_sys_sendmsg+0x1c2/0x2b0 [ 1003.462197][T19668] ? __x64_sys_sendmsg+0x80/0x80 [ 1003.467184][T19668] ? lockdep_hardirqs_on+0x98/0x150 [ 1003.472579][T19668] do_syscall_64+0x55/0xa0 [ 1003.477010][T19668] ? clear_bhb_loop+0x40/0x90 [ 1003.481706][T19668] ? clear_bhb_loop+0x40/0x90 [ 1003.486497][T19668] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1003.492421][T19668] RIP: 0033:0x7f4a5c39c819 [ 1003.496873][T19668] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1003.516512][T19668] RSP: 002b:00007f4a5d1d8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1003.525220][T19668] RAX: ffffffffffffffda RBX: 00007f4a5c615fa0 RCX: 00007f4a5c39c819 [ 1003.533215][T19668] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1003.541206][T19668] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 1003.549194][T19668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1003.557194][T19668] R13: 00007f4a5c616038 R14: 00007f4a5c615fa0 R15: 00007ffd71537948 [ 1003.565587][T19668] [ 1003.637905][T19640] bridge0: port 1(bridge_slave_0) entered blocking state [ 1003.659617][T19640] bridge0: port 1(bridge_slave_0) entered disabled state [ 1003.667017][T19640] bridge_slave_0: entered allmulticast mode [ 1003.734525][T19640] bridge_slave_0: entered promiscuous mode [ 1003.765651][T19640] bridge0: port 2(bridge_slave_1) entered blocking state [ 1003.799733][T19688] FAULT_INJECTION: forcing a failure. [ 1003.799733][T19688] name failslab, interval 1, probability 0, space 0, times 0 [ 1003.808213][T19640] bridge0: port 2(bridge_slave_1) entered disabled state [ 1003.827566][T19688] CPU: 0 PID: 19688 Comm: syz.2.4687 Not tainted syzkaller #0 [ 1003.835135][T19688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1003.842094][T19640] bridge_slave_1: entered allmulticast mode [ 1003.845241][T19688] Call Trace: [ 1003.845254][T19688] [ 1003.857430][T19688] dump_stack_lvl+0x18c/0x250 [ 1003.862183][T19688] ? show_regs_print_info+0x20/0x20 [ 1003.863397][T19640] bridge_slave_1: entered promiscuous mode [ 1003.867424][T19688] ? load_image+0x420/0x420 [ 1003.867465][T19688] ? verify_lock_unused+0x140/0x140 [ 1003.867517][T19688] should_fail_ex+0x39d/0x4d0 [ 1003.867550][T19688] should_failslab+0x9/0x20 [ 1003.867577][T19688] slab_pre_alloc_hook+0x59/0x310 [ 1003.898064][T19688] kmem_cache_alloc+0x5a/0x2d0 [ 1003.903066][T19688] ? skb_clone+0x1eb/0x370 [ 1003.907647][T19688] skb_clone+0x1eb/0x370 [ 1003.911952][T19688] __netlink_deliver_tap+0x41c/0x830 [ 1003.917314][T19688] ? netlink_deliver_tap+0x2e/0x1b0 [ 1003.922660][T19688] netlink_deliver_tap+0x19c/0x1b0 [ 1003.927817][T19688] netlink_unicast+0x72c/0x8d0 [ 1003.932625][T19688] netlink_sendmsg+0x8d0/0xbf0 [ 1003.937524][T19688] ? netlink_getsockopt+0x590/0x590 [ 1003.942841][T19688] ? aa_sock_msg_perm+0x94/0x150 [ 1003.947977][T19688] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1003.953372][T19688] ? security_socket_sendmsg+0x80/0xa0 [ 1003.958867][T19688] ? netlink_getsockopt+0x590/0x590 [ 1003.964130][T19688] ____sys_sendmsg+0x5ba/0x960 [ 1003.968986][T19688] ? __asan_memset+0x22/0x40 [ 1003.973600][T19688] ? __sys_sendmsg_sock+0x30/0x30 [ 1003.978635][T19688] ? __import_iovec+0x5f2/0x850 [ 1003.983608][T19688] ? import_iovec+0x73/0xa0 [ 1003.988440][T19688] ___sys_sendmsg+0x2a6/0x360 [ 1003.993183][T19688] ? get_pid_task+0x20/0x1e0 [ 1003.997797][T19688] ? __sys_sendmsg+0x2a0/0x2a0 [ 1004.002592][T19688] ? __lock_acquire+0x7d40/0x7d40 [ 1004.007656][T19688] __se_sys_sendmsg+0x1c2/0x2b0 [ 1004.012559][T19688] ? __x64_sys_sendmsg+0x80/0x80 [ 1004.017540][T19688] ? lockdep_hardirqs_on+0x98/0x150 [ 1004.023024][T19688] do_syscall_64+0x55/0xa0 [ 1004.027455][T19688] ? clear_bhb_loop+0x40/0x90 [ 1004.032213][T19688] ? clear_bhb_loop+0x40/0x90 [ 1004.036937][T19688] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1004.042909][T19688] RIP: 0033:0x7f637679c819 [ 1004.047357][T19688] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1004.067156][T19688] RSP: 002b:00007f6377735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1004.075591][T19688] RAX: ffffffffffffffda RBX: 00007f6376a15fa0 RCX: 00007f637679c819 [ 1004.083669][T19688] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1004.091907][T19688] RBP: 00007f6377735090 R08: 0000000000000000 R09: 0000000000000000 [ 1004.099938][T19688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1004.108118][T19688] R13: 00007f6376a16038 R14: 00007f6376a15fa0 R15: 00007ffd21a41f78 [ 1004.116146][T19688] [ 1004.359163][T19640] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1004.456260][T19640] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1004.573488][T19640] team0: Port device team_slave_0 added [ 1004.629077][T19640] team0: Port device team_slave_1 added [ 1004.807960][T14924] Bluetooth: hci0: command tx timeout [ 1004.865219][T19640] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1004.889480][T14924] Bluetooth: hci1: command 0x0406 tx timeout [ 1004.889805][T19640] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1004.982659][T19640] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1005.126535][T19640] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1005.137483][T19640] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1005.185309][T19640] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1006.239110][T19640] hsr_slave_0: entered promiscuous mode [ 1006.288141][T19640] hsr_slave_1: entered promiscuous mode [ 1006.322672][T19640] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1006.382138][T19640] Cannot create hsr debugfs directory [ 1006.682931][T19728] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1006.889465][T14924] Bluetooth: hci0: command tx timeout [ 1007.489793][T19750] netlink: 'syz.3.4703': attribute type 21 has an invalid length. [ 1007.514933][T19750] netlink: 128 bytes leftover after parsing attributes in process `syz.3.4703'. [ 1007.525214][T19750] netlink: 'syz.3.4703': attribute type 4 has an invalid length. [ 1008.876955][T19640] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1008.959821][T19640] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1008.967663][T14924] Bluetooth: hci0: command tx timeout [ 1009.160613][T16580] hsr_slave_0: left promiscuous mode [ 1009.197963][T16580] hsr_slave_1: left promiscuous mode [ 1009.221665][T16580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1009.246495][T16580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1009.286078][T16580] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1009.317780][T16580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1009.398424][T16580] veth1_macvtap: left promiscuous mode [ 1009.404091][T16580] veth0_macvtap: left promiscuous mode [ 1009.430123][T16580] veth1_vlan: left promiscuous mode [ 1009.435646][T16580] veth0_vlan: left promiscuous mode [ 1009.605206][T19797] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1009.874219][T16580] .` (unregistering): (slave geneve0): Releasing backup interface [ 1011.849013][T16580] team0 (unregistering): Port device team_slave_1 removed [ 1011.938187][T16580] team0 (unregistering): Port device team_slave_0 removed [ 1012.050999][T16580] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 1012.216705][T16580] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 1012.754444][T16580] .` (unregistering): Released all slaves [ 1012.797172][T19640] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1012.812607][T19640] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1013.093690][T19882] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4741'. [ 1013.238148][T19640] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1013.310384][T19640] 8021q: adding VLAN 0 to HW filter on device team0 [ 1013.354138][T16578] bridge0: port 1(bridge_slave_0) entered blocking state [ 1013.361732][T16578] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1013.421120][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 1013.428362][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1014.118091][T19906] netlink: 'syz.2.4746': attribute type 21 has an invalid length. [ 1014.137316][T19906] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4746'. [ 1014.159842][T19906] netlink: 'syz.2.4746': attribute type 4 has an invalid length. [ 1014.314433][T19640] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1014.426431][T19640] veth0_vlan: entered promiscuous mode [ 1014.503402][T19640] veth1_vlan: entered promiscuous mode [ 1014.645696][T19640] veth0_macvtap: entered promiscuous mode [ 1014.691362][T19640] veth1_macvtap: entered promiscuous mode [ 1014.751319][T19640] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1014.786556][T19640] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1014.802914][T19640] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1014.821602][T19640] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1014.834059][T19640] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1014.855111][T19640] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1014.867795][T19640] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1014.912587][T19640] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1014.937639][T19640] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1014.953312][T19640] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1014.981151][T19925] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4750'. [ 1015.022221][T19640] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.047845][T19640] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.056632][T19640] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.085641][T19640] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1015.411391][T19943] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4755'. [ 1015.476592][T19943] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1015.521186][T19943] CPU: 1 PID: 19943 Comm: syz.2.4755 Not tainted syzkaller #0 [ 1015.528739][T19943] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1015.539021][T19943] Call Trace: [ 1015.542343][T19943] [ 1015.545327][T19943] dump_stack_lvl+0x18c/0x250 [ 1015.550180][T19943] ? show_regs_print_info+0x20/0x20 [ 1015.555461][T19943] ? load_image+0x420/0x420 [ 1015.560240][T19943] sysfs_warn_dup+0x8e/0xa0 [ 1015.564910][T19943] sysfs_do_create_link_sd+0xc0/0x110 [ 1015.570351][T19943] device_add_class_symlinks+0x1cf/0x240 [ 1015.576232][T19943] device_add+0x507/0xc20 [ 1015.580639][T19943] wiphy_register+0x1dad/0x2ae0 [ 1015.585578][T19943] ? cfg80211_event_work+0x40/0x40 [ 1015.590741][T19943] ? minstrel_ht_alloc+0x88a/0x990 [ 1015.595916][T19943] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1015.602019][T19943] ieee80211_register_hw+0x3464/0x4250 [ 1015.607523][T19943] ? ieee80211_tasklet_handler+0x20/0x20 [ 1015.613170][T19943] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1015.619171][T19943] ? __debug_object_init+0xec/0x450 [ 1015.624589][T19943] ? __asan_memset+0x22/0x40 [ 1015.629385][T19943] ? __hrtimer_init+0x186/0x270 [ 1015.634287][T19943] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1015.640166][T19943] ? mac80211_hwsim_free+0x220/0x220 [ 1015.645480][T19943] ? rcu_is_watching+0x15/0xb0 [ 1015.650270][T19943] ? kstrndup+0xbd/0x140 [ 1015.654543][T19943] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1015.659681][T19943] ? __nla_validate+0x50/0x50 [ 1015.664478][T19943] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1015.670946][T19943] ? __nla_parse+0x40/0x50 [ 1015.675413][T19943] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1015.681865][T19943] genl_family_rcv_msg_doit+0x211/0x310 [ 1015.687782][T19943] ? end_current_label_crit_section+0x170/0x170 [ 1015.694154][T19943] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1015.700086][T19943] ? bpf_lsm_capable+0x9/0x10 [ 1015.704910][T19943] ? security_capable+0x89/0xb0 [ 1015.709833][T19943] genl_rcv_msg+0x619/0x7a0 [ 1015.714381][T19943] ? genl_bind+0x360/0x360 [ 1015.718819][T19943] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1015.725264][T19943] ? ref_tracker_free+0x690/0x840 [ 1015.730330][T19943] netlink_rcv_skb+0x241/0x4d0 [ 1015.735213][T19943] ? genl_bind+0x360/0x360 [ 1015.739650][T19943] ? netlink_ack+0x1180/0x1180 [ 1015.744635][T19943] ? __lock_acquire+0x7d40/0x7d40 [ 1015.749780][T19943] ? down_read+0x1ac/0x2e0 [ 1015.754217][T19943] genl_rcv+0x28/0x40 [ 1015.758307][T19943] netlink_unicast+0x751/0x8d0 [ 1015.763190][T19943] netlink_sendmsg+0x8d0/0xbf0 [ 1015.768002][T19943] ? netlink_getsockopt+0x590/0x590 [ 1015.773275][T19943] ? aa_sock_msg_perm+0x94/0x150 [ 1015.778255][T19943] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1015.783701][T19943] ? security_socket_sendmsg+0x80/0xa0 [ 1015.789201][T19943] ? netlink_getsockopt+0x590/0x590 [ 1015.794446][T19943] ____sys_sendmsg+0x5ba/0x960 [ 1015.799334][T19943] ? __asan_memset+0x22/0x40 [ 1015.803955][T19943] ? __sys_sendmsg_sock+0x30/0x30 [ 1015.809269][T19943] ? __import_iovec+0x5f2/0x850 [ 1015.814232][T19943] ? import_iovec+0x73/0xa0 [ 1015.818854][T19943] ___sys_sendmsg+0x2a6/0x360 [ 1015.823556][T19943] ? __sys_sendmsg+0x2a0/0x2a0 [ 1015.828365][T19943] ? trace_call_bpf+0xc3/0x6c0 [ 1015.833554][T19943] __se_sys_sendmsg+0x1c2/0x2b0 [ 1015.838429][T19943] ? __x64_sys_sendmsg+0x80/0x80 [ 1015.843399][T19943] ? lockdep_hardirqs_on+0x98/0x150 [ 1015.848625][T19943] do_syscall_64+0x55/0xa0 [ 1015.853056][T19943] ? clear_bhb_loop+0x40/0x90 [ 1015.857838][T19943] ? clear_bhb_loop+0x40/0x90 [ 1015.862540][T19943] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1015.868465][T19943] RIP: 0033:0x7f637679c819 [ 1015.872904][T19943] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1015.892708][T19943] RSP: 002b:00007f6377714028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1015.901353][T19943] RAX: ffffffffffffffda RBX: 00007f6376a16090 RCX: 00007f637679c819 [ 1015.909355][T19943] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1015.917446][T19943] RBP: 00007f6376832c91 R08: 0000000000000000 R09: 0000000000000000 [ 1015.925738][T19943] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1015.933842][T19943] R13: 00007f6376a16128 R14: 00007f6376a16090 R15: 00007ffd21a41f78 [ 1015.942219][T19943] [ 1016.094641][T14924] Bluetooth: hci4: unexpected event 0x04 length: 151 > 10 [ 1016.153273][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1016.217873][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1016.319911][T16580] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1016.362395][T16580] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1016.960634][T19966] netlink: 'syz.0.4759': attribute type 21 has an invalid length. [ 1016.987096][T19966] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4759'. [ 1017.000984][T19966] netlink: 'syz.0.4759': attribute type 4 has an invalid length. [ 1018.171338][T14924] Bluetooth: hci4: command 0x0406 tx timeout [ 1020.015230][T20037] netlink: 'syz.0.4785': attribute type 3 has an invalid length. [ 1020.107627][T20037] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.4785'. [ 1020.536639][T20049] FAULT_INJECTION: forcing a failure. [ 1020.536639][T20049] name failslab, interval 1, probability 0, space 0, times 0 [ 1020.562431][T20049] CPU: 1 PID: 20049 Comm: syz.2.4793 Not tainted syzkaller #0 [ 1020.570245][T20049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1020.580509][T20049] Call Trace: [ 1020.583801][T20049] [ 1020.586735][T20049] dump_stack_lvl+0x18c/0x250 [ 1020.591456][T20049] ? show_regs_print_info+0x20/0x20 [ 1020.596807][T20049] ? load_image+0x420/0x420 [ 1020.601465][T20049] ? verify_lock_unused+0x140/0x140 [ 1020.606723][T20049] should_fail_ex+0x39d/0x4d0 [ 1020.611469][T20049] should_failslab+0x9/0x20 [ 1020.616111][T20049] slab_pre_alloc_hook+0x59/0x310 [ 1020.621205][T20049] kmem_cache_alloc+0x5a/0x2d0 [ 1020.626011][T20049] ? skb_clone+0x1eb/0x370 [ 1020.630581][T20049] skb_clone+0x1eb/0x370 [ 1020.634930][T20049] __netlink_deliver_tap+0x41c/0x830 [ 1020.640422][T20049] ? netlink_deliver_tap+0x2e/0x1b0 [ 1020.645742][T20049] netlink_deliver_tap+0x19c/0x1b0 [ 1020.650966][T20049] netlink_unicast+0x72c/0x8d0 [ 1020.655764][T20049] netlink_sendmsg+0x8d0/0xbf0 [ 1020.660858][T20049] ? netlink_getsockopt+0x590/0x590 [ 1020.666206][T20049] ? aa_sock_msg_perm+0x94/0x150 [ 1020.671189][T20049] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1020.676523][T20049] ? security_socket_sendmsg+0x80/0xa0 [ 1020.682374][T20049] ? netlink_getsockopt+0x590/0x590 [ 1020.687714][T20049] ____sys_sendmsg+0x5ba/0x960 [ 1020.692516][T20049] ? __asan_memset+0x22/0x40 [ 1020.697442][T20049] ? __sys_sendmsg_sock+0x30/0x30 [ 1020.702497][T20049] ? __import_iovec+0x5f2/0x850 [ 1020.707462][T20049] ? import_iovec+0x73/0xa0 [ 1020.711981][T20049] ___sys_sendmsg+0x2a6/0x360 [ 1020.716676][T20049] ? get_pid_task+0x20/0x1e0 [ 1020.721286][T20049] ? __sys_sendmsg+0x2a0/0x2a0 [ 1020.726088][T20049] ? __lock_acquire+0x7d40/0x7d40 [ 1020.731150][T20049] __se_sys_sendmsg+0x1c2/0x2b0 [ 1020.736015][T20049] ? __x64_sys_sendmsg+0x80/0x80 [ 1020.741112][T20049] ? lockdep_hardirqs_on+0x98/0x150 [ 1020.746439][T20049] do_syscall_64+0x55/0xa0 [ 1020.750882][T20049] ? clear_bhb_loop+0x40/0x90 [ 1020.755614][T20049] ? clear_bhb_loop+0x40/0x90 [ 1020.760345][T20049] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1020.766291][T20049] RIP: 0033:0x7f637679c819 [ 1020.770733][T20049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1020.790651][T20049] RSP: 002b:00007f6377735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1020.799173][T20049] RAX: ffffffffffffffda RBX: 00007f6376a15fa0 RCX: 00007f637679c819 [ 1020.807336][T20049] RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1020.815418][T20049] RBP: 00007f6377735090 R08: 0000000000000000 R09: 0000000000000000 [ 1020.823404][T20049] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1020.831654][T20049] R13: 00007f6376a16038 R14: 00007f6376a15fa0 R15: 00007ffd21a41f78 [ 1020.839657][T20049] [ 1021.865422][T14924] Bluetooth: hci4: unexpected event 0x04 length: 151 > 10 [ 1021.889001][T20074] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.4804'. [ 1021.963454][T20085] FAULT_INJECTION: forcing a failure. [ 1021.963454][T20085] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1021.963492][T20085] CPU: 1 PID: 20085 Comm: syz.0.4807 Not tainted syzkaller #0 [ 1021.963513][T20085] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1021.963525][T20085] Call Trace: [ 1021.963534][T20085] [ 1021.963543][T20085] dump_stack_lvl+0x18c/0x250 [ 1021.963590][T20085] ? show_regs_print_info+0x20/0x20 [ 1021.963619][T20085] ? load_image+0x420/0x420 [ 1021.963649][T20085] ? __lock_acquire+0x7d40/0x7d40 [ 1021.963676][T20085] ? snprintf+0xe9/0x140 [ 1021.963708][T20085] should_fail_ex+0x39d/0x4d0 [ 1021.963744][T20085] _copy_to_user+0x2f/0xa0 [ 1021.963771][T20085] simple_read_from_buffer+0xe7/0x150 [ 1021.963805][T20085] proc_fail_nth_read+0x1e8/0x260 [ 1021.963835][T20085] ? proc_fault_inject_write+0x360/0x360 [ 1021.963868][T20085] ? fsnotify_perm+0x271/0x5e0 [ 1021.963897][T20085] ? proc_fault_inject_write+0x360/0x360 [ 1021.963924][T20085] vfs_read+0x28b/0x970 [ 1021.963958][T20085] ? kernel_read+0x1e0/0x1e0 [ 1021.963985][T20085] ? __fget_files+0x28/0x4b0 [ 1021.964009][T20085] ? __fget_files+0x28/0x4b0 [ 1021.964035][T20085] ? __fget_files+0x43d/0x4b0 [ 1021.964069][T20085] ? __fdget_pos+0x2a3/0x330 [ 1021.964093][T20085] ? ksys_read+0x75/0x260 [ 1021.964120][T20085] ksys_read+0x150/0x260 [ 1021.964149][T20085] ? vfs_write+0x990/0x990 [ 1021.964179][T20085] ? lockdep_hardirqs_on+0x98/0x150 [ 1021.964206][T20085] do_syscall_64+0x55/0xa0 [ 1021.964224][T20085] ? clear_bhb_loop+0x40/0x90 [ 1021.964247][T20085] ? clear_bhb_loop+0x40/0x90 [ 1021.964273][T20085] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1021.964296][T20085] RIP: 0033:0x7f4a5c35d04e [ 1021.964315][T20085] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1021.964331][T20085] RSP: 002b:00007f4a5d1b6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1021.964356][T20085] RAX: ffffffffffffffda RBX: 00007f4a5d1b76c0 RCX: 00007f4a5c35d04e [ 1021.964371][T20085] RDX: 000000000000000f RSI: 00007f4a5d1b70a0 RDI: 0000000000000004 [ 1021.964385][T20085] RBP: 00007f4a5d1b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1021.964399][T20085] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1021.964412][T20085] R13: 00007f4a5c616128 R14: 00007f4a5c616090 R15: 00007ffd71537948 [ 1021.964444][T20085] [ 1022.576186][T20074] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1022.585642][T20074] CPU: 0 PID: 20074 Comm: syz.2.4804 Not tainted syzkaller #0 [ 1022.593377][T20074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1022.603481][T20074] Call Trace: [ 1022.606793][T20074] [ 1022.609760][T20074] dump_stack_lvl+0x18c/0x250 [ 1022.614672][T20074] ? show_regs_print_info+0x20/0x20 [ 1022.619923][T20074] ? load_image+0x420/0x420 [ 1022.624550][T20074] sysfs_warn_dup+0x8e/0xa0 [ 1022.629291][T20074] sysfs_do_create_link_sd+0xc0/0x110 [ 1022.634704][T20074] device_add_class_symlinks+0x1cf/0x240 [ 1022.640483][T20074] device_add+0x507/0xc20 [ 1022.644843][T20074] wiphy_register+0x1dad/0x2ae0 [ 1022.649759][T20074] ? cfg80211_event_work+0x40/0x40 [ 1022.654990][T20074] ? minstrel_ht_alloc+0x88a/0x990 [ 1022.660127][T20074] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1022.666215][T20074] ieee80211_register_hw+0x3464/0x4250 [ 1022.671736][T20074] ? ieee80211_tasklet_handler+0x20/0x20 [ 1022.677401][T20074] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1022.683787][T20074] ? __debug_object_init+0xec/0x450 [ 1022.689218][T20074] ? __asan_memset+0x22/0x40 [ 1022.694028][T20074] ? __hrtimer_init+0x186/0x270 [ 1022.699014][T20074] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1022.704783][T20074] ? mac80211_hwsim_free+0x220/0x220 [ 1022.710082][T20074] ? rcu_is_watching+0x15/0xb0 [ 1022.714868][T20074] ? kstrndup+0xbd/0x140 [ 1022.719145][T20074] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1022.724461][T20074] ? __nla_validate+0x50/0x50 [ 1022.729165][T20074] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1022.735697][T20074] ? __nla_parse+0x40/0x50 [ 1022.740150][T20074] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1022.746537][T20074] genl_family_rcv_msg_doit+0x211/0x310 [ 1022.752213][T20074] ? end_current_label_crit_section+0x170/0x170 [ 1022.758487][T20074] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1022.764405][T20074] ? bpf_lsm_capable+0x9/0x10 [ 1022.769110][T20074] ? security_capable+0x89/0xb0 [ 1022.773988][T20074] genl_rcv_msg+0x619/0x7a0 [ 1022.778517][T20074] ? genl_bind+0x360/0x360 [ 1022.782950][T20074] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1022.788948][T20074] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1022.795382][T20074] ? ref_tracker_free+0x690/0x840 [ 1022.800440][T20074] netlink_rcv_skb+0x241/0x4d0 [ 1022.805316][T20074] ? genl_bind+0x360/0x360 [ 1022.809899][T20074] ? netlink_ack+0x1180/0x1180 [ 1022.814764][T20074] ? __lock_acquire+0x7d40/0x7d40 [ 1022.819848][T20074] ? down_read+0x1ac/0x2e0 [ 1022.824296][T20074] genl_rcv+0x28/0x40 [ 1022.828426][T20074] netlink_unicast+0x751/0x8d0 [ 1022.833444][T20074] netlink_sendmsg+0x8d0/0xbf0 [ 1022.838398][T20074] ? netlink_getsockopt+0x590/0x590 [ 1022.843652][T20074] ? netlink_getsockopt+0x590/0x590 [ 1022.848888][T20074] ____sys_sendmsg+0x5ba/0x960 [ 1022.853786][T20074] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1022.860088][T20074] ? __asan_memset+0x22/0x40 [ 1022.864714][T20074] ? __sys_sendmsg_sock+0x30/0x30 [ 1022.869809][T20074] ? __import_iovec+0x5f2/0x850 [ 1022.874806][T20074] ? import_iovec+0x73/0xa0 [ 1022.879359][T20074] ___sys_sendmsg+0x2a6/0x360 [ 1022.884063][T20074] ? __sys_sendmsg+0x2a0/0x2a0 [ 1022.888857][T20074] ? irqentry_enter+0x37/0x50 [ 1022.893584][T20074] ? __se_sys_sendmsg+0xd9/0x2b0 [ 1022.898554][T20074] __se_sys_sendmsg+0x1c2/0x2b0 [ 1022.903424][T20074] ? __x64_sys_sendmsg+0x80/0x80 [ 1022.908395][T20074] ? syscall_enter_from_user_mode+0x2e/0x80 [ 1022.914312][T20074] do_syscall_64+0x55/0xa0 [ 1022.918744][T20074] ? clear_bhb_loop+0x40/0x90 [ 1022.923439][T20074] ? clear_bhb_loop+0x40/0x90 [ 1022.928137][T20074] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1022.934133][T20074] RIP: 0033:0x7f637679c819 [ 1022.938573][T20074] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1022.958205][T20074] RSP: 002b:00007f6377735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1022.967022][T20074] RAX: ffffffffffffffda RBX: 00007f6376a15fa0 RCX: 00007f637679c819 [ 1022.975666][T20074] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1022.983667][T20074] RBP: 00007f6376832c91 R08: 0000000000000000 R09: 0000000000000000 [ 1022.991673][T20074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1022.999761][T20074] R13: 00007f6376a16038 R14: 00007f6376a15fa0 R15: 00007ffd21a41f78 [ 1023.007941][T20074] [ 1023.928520][T14924] Bluetooth: hci4: command 0x0406 tx timeout [ 1023.985391][T20113] tap1: tun_chr_ioctl cmd 1074025677 [ 1023.998438][T20113] tap1: linktype set to 778 [ 1024.767546][T14924] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 1024.885764][T20131] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4827'. [ 1025.255871][T20131] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1025.315953][T20131] CPU: 0 PID: 20131 Comm: syz.0.4827 Not tainted syzkaller #0 [ 1025.323484][T20131] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1025.333579][T20131] Call Trace: [ 1025.336878][T20131] [ 1025.339826][T20131] dump_stack_lvl+0x18c/0x250 [ 1025.344542][T20131] ? show_regs_print_info+0x20/0x20 [ 1025.349791][T20131] ? load_image+0x420/0x420 [ 1025.354337][T20131] sysfs_warn_dup+0x8e/0xa0 [ 1025.358960][T20131] sysfs_do_create_link_sd+0xc0/0x110 [ 1025.364353][T20131] device_add_class_symlinks+0x1cf/0x240 [ 1025.370016][T20131] device_add+0x507/0xc20 [ 1025.374549][T20131] wiphy_register+0x1dad/0x2ae0 [ 1025.379447][T20131] ? cfg80211_event_work+0x40/0x40 [ 1025.384586][T20131] ? minstrel_ht_alloc+0x88a/0x990 [ 1025.389735][T20131] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1025.395953][T20131] ieee80211_register_hw+0x3464/0x4250 [ 1025.401454][T20131] ? ieee80211_tasklet_handler+0x20/0x20 [ 1025.407201][T20131] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1025.413119][T20131] ? __debug_object_init+0xec/0x450 [ 1025.418345][T20131] ? __asan_memset+0x22/0x40 [ 1025.422953][T20131] ? __hrtimer_init+0x186/0x270 [ 1025.427825][T20131] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1025.433622][T20131] ? mac80211_hwsim_free+0x220/0x220 [ 1025.439008][T20131] ? rcu_is_watching+0x15/0xb0 [ 1025.443965][T20131] ? kstrndup+0xbd/0x140 [ 1025.448408][T20131] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1025.453561][T20131] ? __nla_validate+0x50/0x50 [ 1025.458398][T20131] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1025.464919][T20131] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1025.471284][T20131] ? lockdep_hardirqs_on+0x98/0x150 [ 1025.476519][T20131] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1025.482709][T20131] ? __nla_parse+0x40/0x50 [ 1025.487241][T20131] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1025.493751][T20131] genl_family_rcv_msg_doit+0x211/0x310 [ 1025.499436][T20131] ? end_current_label_crit_section+0x170/0x170 [ 1025.505799][T20131] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1025.511745][T20131] ? bpf_lsm_capable+0x9/0x10 [ 1025.516484][T20131] ? security_capable+0x89/0xb0 [ 1025.521386][T20131] genl_rcv_msg+0x619/0x7a0 [ 1025.525921][T20131] ? genl_bind+0x360/0x360 [ 1025.530354][T20131] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1025.536715][T20131] netlink_rcv_skb+0x241/0x4d0 [ 1025.541508][T20131] ? genl_bind+0x360/0x360 [ 1025.545942][T20131] ? netlink_ack+0x1180/0x1180 [ 1025.550725][T20131] ? preempt_schedule_common+0x82/0xc0 [ 1025.556224][T20131] ? preempt_schedule_thunk+0x1a/0x30 [ 1025.561798][T20131] ? down_read+0x1dc/0x2e0 [ 1025.566233][T20131] genl_rcv+0x28/0x40 [ 1025.570241][T20131] netlink_unicast+0x751/0x8d0 [ 1025.575126][T20131] netlink_sendmsg+0x8d0/0xbf0 [ 1025.579917][T20131] ? lockdep_hardirqs_on+0x98/0x150 [ 1025.585145][T20131] ? netlink_getsockopt+0x590/0x590 [ 1025.590372][T20131] ? security_socket_sendmsg+0x37/0xa0 [ 1025.595934][T20131] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1025.601240][T20131] ? security_socket_sendmsg+0x80/0xa0 [ 1025.606714][T20131] ? netlink_getsockopt+0x590/0x590 [ 1025.612082][T20131] ____sys_sendmsg+0x5ba/0x960 [ 1025.616871][T20131] ? __asan_memset+0x22/0x40 [ 1025.621830][T20131] ? __sys_sendmsg_sock+0x30/0x30 [ 1025.626956][T20131] ? __import_iovec+0x5f2/0x850 [ 1025.631854][T20131] ? import_iovec+0x73/0xa0 [ 1025.636375][T20131] ___sys_sendmsg+0x2a6/0x360 [ 1025.641075][T20131] ? __sys_sendmsg+0x2a0/0x2a0 [ 1025.646058][T20131] ? trace_call_bpf+0xc3/0x6c0 [ 1025.650958][T20131] __se_sys_sendmsg+0x1c2/0x2b0 [ 1025.655836][T20131] ? __x64_sys_sendmsg+0x80/0x80 [ 1025.660890][T20131] ? lockdep_hardirqs_on+0x98/0x150 [ 1025.666287][T20131] do_syscall_64+0x55/0xa0 [ 1025.670715][T20131] ? clear_bhb_loop+0x40/0x90 [ 1025.675669][T20131] ? clear_bhb_loop+0x40/0x90 [ 1025.680455][T20131] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1025.686398][T20131] RIP: 0033:0x7f4a5c39c819 [ 1025.691026][T20131] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1025.710922][T20131] RSP: 002b:00007f4a5d1d8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1025.719444][T20131] RAX: ffffffffffffffda RBX: 00007f4a5c615fa0 RCX: 00007f4a5c39c819 [ 1025.727445][T20131] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1025.735453][T20131] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 1025.743444][T20131] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1025.751462][T20131] R13: 00007f4a5c616038 R14: 00007f4a5c615fa0 R15: 00007ffd71537948 [ 1025.759620][T20131] [ 1025.929359][T20145] netlink: 55631 bytes leftover after parsing attributes in process `syz.2.4833'. [ 1026.167184][T20152] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.4837'. [ 1026.923204][T14924] Bluetooth: hci1: command 0x0406 tx timeout [ 1027.819276][T20172] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.4843'. [ 1027.874081][T20172] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1028.033505][T20172] CPU: 1 PID: 20172 Comm: syz.0.4843 Not tainted syzkaller #0 [ 1028.041063][T20172] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1028.051161][T20172] Call Trace: [ 1028.054462][T20172] [ 1028.057499][T20172] dump_stack_lvl+0x18c/0x250 [ 1028.062237][T20172] ? show_regs_print_info+0x20/0x20 [ 1028.067565][T20172] ? load_image+0x420/0x420 [ 1028.072202][T20172] sysfs_warn_dup+0x8e/0xa0 [ 1028.076730][T20172] sysfs_do_create_link_sd+0xc0/0x110 [ 1028.082228][T20172] device_add_class_symlinks+0x1cf/0x240 [ 1028.087891][T20172] device_add+0x507/0xc20 [ 1028.092245][T20172] wiphy_register+0x1dad/0x2ae0 [ 1028.097151][T20172] ? cfg80211_event_work+0x40/0x40 [ 1028.102276][T20172] ? minstrel_ht_alloc+0x88a/0x990 [ 1028.107426][T20172] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1028.113530][T20172] ieee80211_register_hw+0x3464/0x4250 [ 1028.119120][T20172] ? ieee80211_tasklet_handler+0x20/0x20 [ 1028.124802][T20172] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1028.130856][T20172] ? __debug_object_init+0xec/0x450 [ 1028.136117][T20172] ? __asan_memset+0x22/0x40 [ 1028.140735][T20172] ? __hrtimer_init+0x186/0x270 [ 1028.145622][T20172] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1028.151574][T20172] ? mac80211_hwsim_free+0x220/0x220 [ 1028.157060][T20172] ? rcu_is_watching+0x15/0xb0 [ 1028.162104][T20172] ? kstrndup+0xbd/0x140 [ 1028.166387][T20172] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1028.171521][T20172] ? __nla_validate+0x50/0x50 [ 1028.176349][T20172] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1028.182845][T20172] ? __nla_parse+0x40/0x50 [ 1028.187293][T20172] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1028.193673][T20172] genl_family_rcv_msg_doit+0x211/0x310 [ 1028.199328][T20172] ? end_current_label_crit_section+0x170/0x170 [ 1028.205604][T20172] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1028.211543][T20172] ? bpf_lsm_capable+0x9/0x10 [ 1028.216336][T20172] ? security_capable+0x89/0xb0 [ 1028.221217][T20172] genl_rcv_msg+0x619/0x7a0 [ 1028.225747][T20172] ? genl_bind+0x360/0x360 [ 1028.230189][T20172] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1028.236623][T20172] ? ref_tracker_free+0x690/0x840 [ 1028.241778][T20172] netlink_rcv_skb+0x241/0x4d0 [ 1028.246577][T20172] ? genl_bind+0x360/0x360 [ 1028.251101][T20172] ? netlink_ack+0x1180/0x1180 [ 1028.255992][T20172] ? __lock_acquire+0x7d40/0x7d40 [ 1028.261059][T20172] ? down_read+0x1ac/0x2e0 [ 1028.265595][T20172] genl_rcv+0x28/0x40 [ 1028.269723][T20172] netlink_unicast+0x751/0x8d0 [ 1028.274521][T20172] netlink_sendmsg+0x8d0/0xbf0 [ 1028.279339][T20172] ? netlink_getsockopt+0x590/0x590 [ 1028.284660][T20172] ? aa_sock_msg_perm+0x94/0x150 [ 1028.289624][T20172] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1028.295106][T20172] ? security_socket_sendmsg+0x80/0xa0 [ 1028.300683][T20172] ? netlink_getsockopt+0x590/0x590 [ 1028.305906][T20172] ____sys_sendmsg+0x5ba/0x960 [ 1028.310698][T20172] ? __asan_memset+0x22/0x40 [ 1028.315310][T20172] ? __sys_sendmsg_sock+0x30/0x30 [ 1028.320351][T20172] ? __import_iovec+0x5f2/0x850 [ 1028.325233][T20172] ? import_iovec+0x73/0xa0 [ 1028.329765][T20172] ___sys_sendmsg+0x2a6/0x360 [ 1028.334658][T20172] ? __sys_sendmsg+0x2a0/0x2a0 [ 1028.339633][T20172] ? trace_call_bpf+0xc3/0x6c0 [ 1028.344446][T20172] __se_sys_sendmsg+0x1c2/0x2b0 [ 1028.349315][T20172] ? __x64_sys_sendmsg+0x80/0x80 [ 1028.354298][T20172] ? lockdep_hardirqs_on+0x98/0x150 [ 1028.359524][T20172] do_syscall_64+0x55/0xa0 [ 1028.364049][T20172] ? clear_bhb_loop+0x40/0x90 [ 1028.368829][T20172] ? clear_bhb_loop+0x40/0x90 [ 1028.373529][T20172] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1028.379442][T20172] RIP: 0033:0x7f4a5c39c819 [ 1028.383881][T20172] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1028.403509][T20172] RSP: 002b:00007f4a5d1b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1028.411949][T20172] RAX: ffffffffffffffda RBX: 00007f4a5c616090 RCX: 00007f4a5c39c819 [ 1028.420027][T20172] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1028.428033][T20172] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 1028.436450][T20172] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1028.444432][T20172] R13: 00007f4a5c616128 R14: 00007f4a5c616090 R15: 00007ffd71537948 [ 1028.452435][T20172] [ 1028.678627][T14924] Bluetooth: hci1: unexpected event 0x04 length: 151 > 10 [ 1029.438413][T20187] tap1: tun_chr_ioctl cmd 1074025677 [ 1029.479646][T20187] tap1: linktype set to 778 [ 1029.862457][T20213] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4858'. [ 1030.050948][T20217] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.4859'. [ 1030.135698][T20216] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4857'. [ 1030.171168][T14924] Bluetooth: hci3: unexpected event 0x04 length: 151 > 10 [ 1030.648641][T20236] bridge_slave_1: left allmulticast mode [ 1030.670056][T20236] bridge_slave_1: left promiscuous mode [ 1030.676309][T20236] bridge0: port 2(bridge_slave_1) entered disabled state [ 1030.698095][T20236] bridge_slave_0: left allmulticast mode [ 1030.709373][T20236] bridge_slave_0: left promiscuous mode [ 1030.715317][T20236] bridge0: port 1(bridge_slave_0) entered disabled state [ 1030.727762][T14924] Bluetooth: hci1: command 0x0406 tx timeout [ 1031.735321][T20239] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4868'. [ 1031.756514][T20250] tap1: tun_chr_ioctl cmd 1074025677 [ 1031.763527][T20250] tap1: linktype set to 778 [ 1032.021348][T14924] Bluetooth: hci0: unexpected event 0x04 length: 151 > 10 [ 1032.024609][T20256] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.4873'. [ 1032.176165][T20256] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 1032.259068][T14924] Bluetooth: hci3: command tx timeout [ 1032.341082][T20259] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4872'. [ 1033.294781][T20283] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4882'. [ 1033.661119][T20292] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4884'. [ 1034.101588][T14924] Bluetooth: hci0: command tx timeout [ 1034.697814][T20319] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4896'. [ 1035.451322][T16580] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1035.523640][T20331] netlink: 'syz.0.4899': attribute type 10 has an invalid length. [ 1035.554668][ T5085] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1035.565231][ T5085] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1035.573839][ T5085] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1035.583838][ T5085] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1035.623580][ T5085] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1035.631781][ T5085] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1035.685181][T20331] team0 (unregistering): Port device team_slave_0 removed [ 1035.715740][T20331] team0 (unregistering): Port device team_slave_1 removed [ 1035.803418][T16580] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1035.897642][T16580] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1036.004535][T16580] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1036.215552][T20332] chnl_net:caif_netlink_parms(): no params data found [ 1036.603716][T20332] bridge0: port 1(bridge_slave_0) entered blocking state [ 1036.673594][T20332] bridge0: port 1(bridge_slave_0) entered disabled state [ 1036.691285][T20332] bridge_slave_0: entered allmulticast mode [ 1036.704063][T20332] bridge_slave_0: entered promiscuous mode [ 1036.721474][T20347] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4902'. [ 1036.994740][T20332] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.004149][T20332] bridge0: port 2(bridge_slave_1) entered disabled state [ 1037.027792][T20332] bridge_slave_1: entered allmulticast mode [ 1037.035415][T20332] bridge_slave_1: entered promiscuous mode [ 1037.103570][T20375] FAULT_INJECTION: forcing a failure. [ 1037.103570][T20375] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1037.147638][T20375] CPU: 1 PID: 20375 Comm: syz.0.4907 Not tainted syzkaller #0 [ 1037.151726][T20360] syzkaller0: entered promiscuous mode [ 1037.155179][T20375] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1037.155197][T20375] Call Trace: [ 1037.155208][T20375] [ 1037.155218][T20375] dump_stack_lvl+0x18c/0x250 [ 1037.155261][T20375] ? show_regs_print_info+0x20/0x20 [ 1037.187467][T20375] ? load_image+0x420/0x420 [ 1037.192101][T20375] ? __might_fault+0xaa/0x120 [ 1037.196793][T20375] ? __lock_acquire+0x7d40/0x7d40 [ 1037.201846][T20375] should_fail_ex+0x39d/0x4d0 [ 1037.206550][T20375] _copy_from_user+0x2f/0xe0 [ 1037.211167][T20375] ___sys_sendmsg+0x1c7/0x360 [ 1037.215953][T20375] ? __sys_sendmsg+0x2a0/0x2a0 [ 1037.220842][T20375] ? __lock_acquire+0x7d40/0x7d40 [ 1037.225907][T20375] __se_sys_sendmsg+0x1c2/0x2b0 [ 1037.230791][T20375] ? __x64_sys_sendmsg+0x80/0x80 [ 1037.235833][T20375] ? lockdep_hardirqs_on+0x98/0x150 [ 1037.241080][T20375] do_syscall_64+0x55/0xa0 [ 1037.245906][T20375] ? clear_bhb_loop+0x40/0x90 [ 1037.250708][T20375] ? clear_bhb_loop+0x40/0x90 [ 1037.255411][T20375] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1037.261323][T20375] RIP: 0033:0x7f4a5c39c819 [ 1037.266017][T20375] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1037.285989][T20375] RSP: 002b:00007f4a5d1b7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1037.294687][T20375] RAX: ffffffffffffffda RBX: 00007f4a5c616090 RCX: 00007f4a5c39c819 [ 1037.303061][T20375] RDX: 0000000024000000 RSI: 00002000000001c0 RDI: 0000000000000003 [ 1037.311216][T20375] RBP: 00007f4a5d1b7090 R08: 0000000000000000 R09: 0000000000000000 [ 1037.319352][T20375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1037.327407][T20375] R13: 00007f4a5c616128 R14: 00007f4a5c616090 R15: 00007ffd71537948 [ 1037.335448][T20375] [ 1037.347838][T20360] syzkaller0: entered allmulticast mode [ 1037.698485][T14924] Bluetooth: hci2: command tx timeout [ 1039.769551][T14924] Bluetooth: hci2: command tx timeout [ 1040.458768][T20332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1040.586384][T20397] netlink: 'syz.0.4911': attribute type 10 has an invalid length. [ 1040.606989][T20332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1040.816100][T20332] team0: Port device team_slave_0 added [ 1040.836692][T20332] team0: Port device team_slave_1 added [ 1041.063767][T20332] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1041.087615][T20332] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1041.127523][T20332] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1041.147929][T20332] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1041.155677][T20332] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1041.200209][T20332] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1041.826808][T20332] hsr_slave_0: entered promiscuous mode [ 1041.848305][T14924] Bluetooth: hci2: command tx timeout [ 1041.860127][T20332] hsr_slave_1: entered promiscuous mode [ 1041.881607][T20332] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1041.897729][T20332] Cannot create hsr debugfs directory [ 1043.584477][T16580] hsr_slave_0: left promiscuous mode [ 1043.605107][T16580] hsr_slave_1: left promiscuous mode [ 1043.658127][T16580] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1043.665738][T16580] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1043.705617][T16580] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1043.726046][T16580] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1043.764500][T16580] veth1_macvtap: left promiscuous mode [ 1043.777554][T16580] veth0_macvtap: left promiscuous mode [ 1043.929256][T14924] Bluetooth: hci2: command tx timeout [ 1054.811395][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.818297][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1059.036863][ T5085] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1059.047637][ T5085] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1059.055862][ T5085] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1059.064930][ T5085] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1059.078457][ T5085] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1059.086075][ T5085] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1060.158233][T14924] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1060.167117][T14924] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1060.181002][T14924] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1060.192222][T14924] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1060.202098][T14924] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 1060.217759][T14924] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1060.302299][ T5085] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1060.312703][ T5085] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1060.325158][ T5085] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1060.335236][ T5085] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1060.349405][ T5085] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 1060.356982][ T5085] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1061.127800][ T5085] Bluetooth: hci4: command tx timeout [ 1062.247620][ T5085] Bluetooth: hci5: command tx timeout [ 1062.407728][ T5085] Bluetooth: hci6: command tx timeout [ 1063.207611][ T5085] Bluetooth: hci4: command tx timeout [ 1064.327576][ T5085] Bluetooth: hci5: command tx timeout [ 1064.487616][ T5085] Bluetooth: hci6: command tx timeout [ 1065.297517][ T5085] Bluetooth: hci4: command tx timeout [ 1066.407750][ T5085] Bluetooth: hci5: command tx timeout [ 1066.567655][ T5085] Bluetooth: hci6: command tx timeout [ 1067.367673][ T5085] Bluetooth: hci4: command tx timeout [ 1068.487564][ T5085] Bluetooth: hci5: command tx timeout [ 1068.647744][ T5085] Bluetooth: hci6: command tx timeout [ 1095.093547][T14924] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1095.103843][T14924] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1095.118576][T14924] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1095.127053][T14924] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1095.135486][T14924] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 1095.143129][T14924] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1097.217709][T14924] Bluetooth: hci7: command tx timeout [ 1099.297578][T14924] Bluetooth: hci7: command tx timeout [ 1101.367558][T14924] Bluetooth: hci7: command tx timeout [ 1103.447560][T14924] Bluetooth: hci7: command tx timeout [ 1108.087589][ T5085] Bluetooth: hci3: command 0x0406 tx timeout [ 1116.252920][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1116.264486][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1119.088600][ T5085] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1119.099121][ T5085] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1119.108531][ T5085] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1119.120169][ T5085] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1119.132655][ T5085] Bluetooth: hci8: unexpected cc 0x0c25 length: 249 > 3 [ 1119.140339][ T5085] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1120.206184][ T5085] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1120.215381][ T5085] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1120.223920][ T5085] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1120.241374][ T5085] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1120.251068][ T5085] Bluetooth: hci9: unexpected cc 0x0c25 length: 249 > 3 [ 1120.258936][ T5085] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1120.313868][T14924] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1120.323093][T14924] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1120.332698][T14924] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1120.343798][T14924] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1120.352152][T14924] Bluetooth: hci10: unexpected cc 0x0c25 length: 249 > 3 [ 1120.360060][T14924] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1121.207655][T14924] Bluetooth: hci8: command tx timeout [ 1122.327750][ T5085] Bluetooth: hci9: command tx timeout [ 1122.407895][ T5085] Bluetooth: hci10: command tx timeout [ 1123.287618][ T5085] Bluetooth: hci8: command tx timeout [ 1123.463185][T14924] Bluetooth: hci0: command 0x0406 tx timeout [ 1124.407746][T14924] Bluetooth: hci9: command tx timeout [ 1124.488112][T14924] Bluetooth: hci10: command tx timeout [ 1125.367596][T14924] Bluetooth: hci8: command tx timeout [ 1126.491153][T14924] Bluetooth: hci9: command tx timeout [ 1126.577419][T14924] Bluetooth: hci10: command tx timeout [ 1127.457587][T14924] Bluetooth: hci8: command tx timeout [ 1128.578050][T14924] Bluetooth: hci9: command tx timeout [ 1128.647544][T14924] Bluetooth: hci10: command tx timeout [ 1155.666633][ T5085] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1155.678721][ T5085] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1155.687277][ T5085] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1155.702349][ T5085] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1155.710879][ T5085] Bluetooth: hci11: unexpected cc 0x0c25 length: 249 > 3 [ 1155.720106][ T5085] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1157.767673][T14924] Bluetooth: hci11: command tx timeout [ 1159.297574][ T5085] Bluetooth: hci2: command 0x0406 tx timeout [ 1159.847630][ T5085] Bluetooth: hci11: command tx timeout [ 1161.928180][ T5085] Bluetooth: hci11: command tx timeout [ 1164.007858][ T5085] Bluetooth: hci11: command tx timeout [ 1177.694523][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.700986][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1179.176975][T14924] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1179.188491][T14924] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1179.198790][T14924] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1179.208421][T14924] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1179.216452][T14924] Bluetooth: hci12: unexpected cc 0x0c25 length: 249 > 3 [ 1179.224416][T14924] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1180.337111][T14924] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 1180.347286][T14924] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 1180.362319][T14924] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 1180.373105][T14924] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 1180.381443][T14924] Bluetooth: hci13: unexpected cc 0x0c25 length: 249 > 3 [ 1180.389163][T14924] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 1180.443236][T14924] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 1180.452626][T14924] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 1180.462539][T14924] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 1180.474726][T14924] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 1180.483434][T14924] Bluetooth: hci14: unexpected cc 0x0c25 length: 249 > 3 [ 1180.491353][T14924] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 1181.287692][T14924] Bluetooth: hci12: command tx timeout [ 1182.487772][T14924] Bluetooth: hci13: command tx timeout [ 1182.573818][T14924] Bluetooth: hci14: command tx timeout [ 1183.377625][T20533] Bluetooth: hci12: command tx timeout [ 1184.567501][T20533] Bluetooth: hci13: command tx timeout [ 1184.647529][T20533] Bluetooth: hci14: command tx timeout [ 1184.897563][ T5085] Bluetooth: hci4: command 0x0406 tx timeout [ 1184.903687][ T5085] Bluetooth: hci5: command 0x0406 tx timeout [ 1184.910560][T20533] Bluetooth: hci6: command 0x0406 tx timeout [ 1185.447466][ T51] Bluetooth: hci12: command tx timeout [ 1186.647625][ T51] Bluetooth: hci13: command tx timeout [ 1186.727543][ T51] Bluetooth: hci14: command tx timeout [ 1187.527511][ T51] Bluetooth: hci12: command tx timeout [ 1188.727507][ T51] Bluetooth: hci13: command tx timeout [ 1188.817496][ T51] Bluetooth: hci14: command tx timeout [ 1196.248414][ T29] INFO: task dhcpcd:5435 blocked for more than 143 seconds. [ 1196.255791][ T29] Not tainted syzkaller #0 [ 1196.261164][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1196.270351][ T29] task:dhcpcd state:D stack:20936 pid:5435 ppid:5434 flags:0x00004002 [ 1196.279855][ T29] Call Trace: [ 1196.283189][ T29] [ 1196.286866][ T29] __schedule+0x1553/0x45a0 [ 1196.291706][ T29] ? lock_chain_count+0x20/0x20 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1196.296805][ T29] ? asan.module_dtor+0x20/0x20 [ 1196.302847][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1196.307666][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1196.313181][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1196.319535][ T29] schedule+0xbd/0x170 [ 1196.323677][ T29] schedule_preempt_disabled+0x13/0x20 [ 1196.329297][ T29] __mutex_lock+0x6a9/0xcc0 [ 1196.333855][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1196.338749][ T29] ? netlink_dump+0x78f/0xe50 [ 1196.343513][ T29] ? mutex_lock_nested+0x20/0x20 [ 1196.348632][ T29] ? __build_skb_around+0x255/0x3d0 [ 1196.353896][ T29] ? __alloc_skb+0x1b2/0x2c0 [ 1196.358593][ T29] netlink_dump+0x78f/0xe50 [ 1196.367488][ T29] ? netlink_lookup+0x200/0x200 [ 1196.372477][ T29] ? slab_free_freelist_hook+0x130/0x1a0 [ 1196.407489][ T29] ? netlink_recvmsg+0x5e7/0xe60 [ 1196.412549][ T29] ? kmem_cache_free+0xf8/0x270 [ 1196.443591][ T29] netlink_recvmsg+0x693/0xe60 [ 1196.449317][ T29] ? netlink_sendmsg+0xbf0/0xbf0 [ 1196.454426][ T29] ? mark_lock+0x94/0x320 [ 1196.459772][ T29] ? aa_af_perm+0x330/0x330 [ 1196.464436][ T29] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 1196.469904][ T29] ? security_socket_recvmsg+0x89/0xb0 [ 1196.475665][ T29] ? netlink_sendmsg+0xbf0/0xbf0 [ 1196.480698][ T29] ____sys_recvmsg+0x2ce/0x5e0 [ 1196.485623][ T29] ? __sys_recvmsg_sock+0x50/0x50 [ 1196.491471][ T29] ? import_iovec+0x73/0xa0 [ 1196.496119][ T29] ___sys_recvmsg+0x216/0x590 [ 1196.501006][ T29] ? __sys_recvmsg+0x2a0/0x2a0 [ 1196.506453][ T29] ? rcu_is_watching+0x15/0xb0 [ 1196.511738][ T29] __x64_sys_recvmsg+0x20c/0x2e0 [ 1196.516727][ T29] ? ___sys_recvmsg+0x590/0x590 [ 1196.521705][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1196.527084][ T29] do_syscall_64+0x55/0xa0 [ 1196.531670][ T29] ? clear_bhb_loop+0x40/0x90 [ 1196.536420][ T29] ? clear_bhb_loop+0x40/0x90 [ 1196.541278][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1196.547238][ T29] RIP: 0033:0x7fcaec312407 [ 1196.551859][ T29] RSP: 002b:00007ffec8c66ad0 EFLAGS: 00000202 ORIG_RAX: 000000000000002f [ 1196.560529][ T29] RAX: ffffffffffffffda RBX: 00007fcaec288740 RCX: 00007fcaec312407 [ 1196.574876][ T29] RDX: 0000000000000000 RSI: 00007ffec8c66b60 RDI: 0000000000000015 [ 1196.582970][ T29] RBP: 00007ffec8c66b44 R08: 0000000000000000 R09: 0000000000000000 [ 1196.591056][ T29] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000001dd8 [ 1196.599832][ T29] R13: 00007ffec8c66b50 R14: 00007ffec8c66c40 R15: 0000000000000000 [ 1196.608168][ T29] [ 1196.611264][ T29] INFO: task kworker/u4:21:16581 blocked for more than 143 seconds. [ 1196.619829][ T29] Not tainted syzkaller #0 [ 1196.624811][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1196.633707][ T29] task:kworker/u4:21 state:D stack:21928 pid:16581 ppid:2 flags:0x00004000 [ 1196.643110][ T29] Workqueue: events_unbound linkwatch_event [ 1196.649225][ T29] Call Trace: [ 1196.652544][ T29] [ 1196.655590][ T29] __schedule+0x1553/0x45a0 [ 1196.660436][ T29] ? asan.module_dtor+0x20/0x20 [ 1196.665418][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1196.670498][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1196.676287][ T29] ? kthread_data+0x4f/0xc0 [ 1196.684381][ T29] ? wq_worker_sleeping+0x63/0x240 [ 1196.690546][ T29] schedule+0xbd/0x170 [ 1196.694675][ T29] schedule_preempt_disabled+0x13/0x20 [ 1196.701140][ T29] __mutex_lock+0x6a9/0xcc0 [ 1196.705702][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1196.710579][ T29] ? linkwatch_event+0xe/0x60 [ 1196.715302][ T29] ? mutex_lock_nested+0x20/0x20 [ 1196.720352][ T29] ? _raw_spin_unlock_irq+0x23/0x50 [ 1196.725582][ T29] ? process_scheduled_works+0x96f/0x15d0 [ 1196.731570][ T29] linkwatch_event+0xe/0x60 [ 1196.736140][ T29] process_scheduled_works+0xa5d/0x15d0 [ 1196.741921][ T29] ? worker_attach_to_pool+0x380/0x380 [ 1196.747614][ T29] ? assign_work+0x3d2/0x5d0 [ 1196.752257][ T29] worker_thread+0xa55/0xfc0 [ 1196.756899][ T29] kthread+0x2fa/0x390 [ 1196.761114][ T29] ? pr_cont_work+0x560/0x560 [ 1196.765845][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1196.770629][ T29] ret_from_fork+0x48/0x80 [ 1196.775165][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1196.779830][ T29] ret_from_fork_asm+0x11/0x20 [ 1196.784649][ T29] [ 1196.787963][ T29] INFO: task syz-executor:20332 blocked for more than 143 seconds. [ 1196.795895][ T29] Not tainted syzkaller #0 [ 1196.801280][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1196.810464][ T29] task:syz-executor state:D stack:22280 pid:20332 ppid:1 flags:0x00004004 [ 1196.819980][ T29] Call Trace: [ 1196.823301][ T29] [ 1196.826270][ T29] __schedule+0x1553/0x45a0 [ 1196.830955][ T29] ? stack_trace_snprint+0xf0/0xf0 [ 1196.836134][ T29] ? asan.module_dtor+0x20/0x20 [ 1196.841474][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1196.846231][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1196.851912][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1196.858175][ T29] schedule+0xbd/0x170 [ 1196.862310][ T29] schedule_preempt_disabled+0x13/0x20 [ 1196.867909][ T29] __mutex_lock+0x6a9/0xcc0 [ 1196.872565][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1196.877285][ T29] ? nsim_destroy+0x3f/0x180 [ 1196.881999][ T29] ? mutex_lock_nested+0x20/0x20 [ 1196.886996][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1196.892467][ T29] nsim_destroy+0x3f/0x180 [ 1196.896948][ T29] __nsim_dev_port_del+0x14d/0x1b0 [ 1196.902443][ T29] nsim_dev_reload_destroy+0x283/0x480 [ 1196.908107][ T29] nsim_drv_remove+0x58/0x170 [ 1196.912845][ T29] ? nsim_bus_probe+0x20/0x20 [ 1196.917641][ T29] device_release_driver_internal+0x468/0x7a0 [ 1196.923799][ T29] bus_remove_device+0x342/0x400 [ 1196.928866][ T29] device_del+0x522/0x910 [ 1196.933307][ T29] ? kill_device+0x160/0x160 [ 1196.938034][ T29] device_unregister+0x20/0xc0 [ 1196.942841][ T29] del_device_store+0x2b1/0x370 [ 1196.947917][ T29] ? del_port_store+0x170/0x170 [ 1196.952902][ T29] ? sysfs_kf_write+0x187/0x2a0 [ 1196.957927][ T29] ? sysfs_kf_read+0x310/0x310 [ 1196.962731][ T29] kernfs_fop_write_iter+0x3b6/0x520 [ 1196.968278][ T29] vfs_write+0x46c/0x990 [ 1196.972937][ T29] ? file_end_write+0x250/0x250 [ 1196.977905][ T29] ? do_sys_openat2+0x170/0x1d0 [ 1196.982830][ T29] ? __fdget_pos+0x2ba/0x330 [ 1196.987685][ T29] ksys_write+0x150/0x260 [ 1196.992202][ T29] ? __ia32_sys_read+0x90/0x90 [ 1196.997007][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1197.002498][ T29] do_syscall_64+0x55/0xa0 [ 1197.007286][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.012183][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.016922][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1197.022928][ T29] RIP: 0033:0x7fd7d0d5d04e [ 1197.027454][ T29] RSP: 002b:00007ffd0e72c3b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1197.035926][ T29] RAX: ffffffffffffffda RBX: 000055557f9a7500 RCX: 00007fd7d0d5d04e [ 1197.044023][ T29] RDX: 0000000000000001 RSI: 00007ffd0e72c440 RDI: 0000000000000005 [ 1197.052203][ T29] RBP: 00007fd7d0e33514 R08: 0000000000000000 R09: 0000000000000000 [ 1197.060395][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1197.068482][ T29] R13: 00007ffd0e72c440 R14: 00007fd7d1b44620 R15: 0000000000000003 [ 1197.076636][ T29] [ 1197.079828][ T29] INFO: task syz.1.4931:20475 blocked for more than 144 seconds. [ 1197.088905][ T29] Not tainted syzkaller #0 [ 1197.093878][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1197.102792][ T29] task:syz.1.4931 state:D stack:25800 pid:20475 ppid:19640 flags:0x00004004 [ 1197.112566][ T29] Call Trace: [ 1197.115900][ T29] [ 1197.118942][ T29] __schedule+0x1553/0x45a0 [ 1197.123600][ T29] ? asan.module_dtor+0x20/0x20 [ 1197.128622][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1197.133349][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1197.138949][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1197.145210][ T29] schedule+0xbd/0x170 [ 1197.149425][ T29] schedule_preempt_disabled+0x13/0x20 [ 1197.155045][ T29] __mutex_lock+0x6a9/0xcc0 [ 1197.159665][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1197.164397][ T29] ? bpf_xdp_link_attach+0x136/0x730 [ 1197.169936][ T29] ? mutex_lock_nested+0x20/0x20 [ 1197.174949][ T29] ? verify_lock_unused+0x140/0x140 [ 1197.180365][ T29] bpf_xdp_link_attach+0x136/0x730 [ 1197.185549][ T29] ? dev_xdp_prog+0x100/0x100 [ 1197.190358][ T29] ? __fget_files+0x28/0x4b0 [ 1197.195008][ T29] ? __lock_acquire+0x7d40/0x7d40 [ 1197.203030][ T29] ? __fget_files+0x43d/0x4b0 [ 1197.211270][ T29] ? attach_type_to_prog_type+0x330/0x3a0 [ 1197.217078][ T29] ? bpf_prog_attach_check_attach_type+0x2d8/0x440 [ 1197.226463][ T29] link_create+0x3ff/0x720 [ 1197.232026][ T29] __sys_bpf+0x4d7/0x890 [ 1197.236331][ T29] ? bpf_link_show_fdinfo+0x390/0x390 [ 1197.243020][ T29] ? lock_chain_count+0x20/0x20 [ 1197.248068][ T29] __x64_sys_bpf+0x7c/0x90 [ 1197.252541][ T29] do_syscall_64+0x55/0xa0 [ 1197.257077][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.261917][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.266818][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1197.274060][ T29] RIP: 0033:0x7fafc859c819 [ 1197.281275][ T29] RSP: 002b:00007fafc946a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1197.291009][ T29] RAX: ffffffffffffffda RBX: 00007fafc8815fa0 RCX: 00007fafc859c819 [ 1197.300245][ T29] RDX: 0000000000000040 RSI: 0000200000000240 RDI: 000000000000001c [ 1197.308555][ T29] RBP: 00007fafc8632c91 R08: 0000000000000000 R09: 0000000000000000 [ 1197.317153][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1197.328792][ T29] R13: 00007fafc8816038 R14: 00007fafc8815fa0 R15: 00007ffc8a2e2728 [ 1197.336858][ T29] [ 1197.340153][ T29] INFO: task syz.1.4931:20476 blocked for more than 144 seconds. [ 1197.348173][ T29] Not tainted syzkaller #0 [ 1197.353271][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1197.363988][ T29] task:syz.1.4931 state:D stack:29128 pid:20476 ppid:19640 flags:0x00004004 [ 1197.373639][ T29] Call Trace: [ 1197.376960][ T29] [ 1197.380073][ T29] __schedule+0x1553/0x45a0 [ 1197.384730][ T29] ? asan.module_dtor+0x20/0x20 [ 1197.389840][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1197.394574][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1197.400245][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1197.406468][ T29] schedule+0xbd/0x170 [ 1197.411830][ T29] schedule_preempt_disabled+0x13/0x20 [ 1197.418999][ T29] __mutex_lock+0x6a9/0xcc0 [ 1197.423670][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1197.431433][ T29] ? bpf_xdp_link_attach+0x136/0x730 [ 1197.436825][ T29] ? mutex_lock_nested+0x20/0x20 [ 1197.442030][ T29] ? verify_lock_unused+0x140/0x140 [ 1197.447294][ T29] ? verify_lock_unused+0x140/0x140 [ 1197.452678][ T29] bpf_xdp_link_attach+0x136/0x730 [ 1197.459132][ T29] ? dev_xdp_prog+0x100/0x100 [ 1197.463963][ T29] ? __fget_files+0x28/0x4b0 [ 1197.468680][ T29] ? __lock_acquire+0x7d40/0x7d40 [ 1197.473925][ T29] ? __fget_files+0x43d/0x4b0 [ 1197.478783][ T29] ? attach_type_to_prog_type+0x330/0x3a0 [ 1197.484577][ T29] ? bpf_prog_attach_check_attach_type+0x2d8/0x440 [ 1197.491184][ T29] link_create+0x3ff/0x720 [ 1197.495775][ T29] __sys_bpf+0x4d7/0x890 [ 1197.500241][ T29] ? recalc_sigpending+0x169/0x1c0 [ 1197.505399][ T29] ? bpf_link_show_fdinfo+0x390/0x390 [ 1197.512757][ T29] ? lock_chain_count+0x20/0x20 [ 1197.518588][ T29] __x64_sys_bpf+0x7c/0x90 [ 1197.523080][ T29] do_syscall_64+0x55/0xa0 [ 1197.528845][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.533571][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.538377][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1197.544406][ T29] RIP: 0033:0x7fafc859c819 [ 1197.548910][ T29] RSP: 002b:00007fafc9449028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1197.557478][ T29] RAX: ffffffffffffffda RBX: 00007fafc8816090 RCX: 00007fafc859c819 [ 1197.565714][ T29] RDX: 0000000000000040 RSI: 0000200000000240 RDI: 000000000000001c [ 1197.575939][ T29] RBP: 00007fafc8632c91 R08: 0000000000000000 R09: 0000000000000000 [ 1197.585930][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1197.595715][ T29] R13: 00007fafc8816128 R14: 00007fafc8816090 R15: 00007ffc8a2e2728 [ 1197.605775][ T29] [ 1197.616838][ T29] INFO: task syz.3.4934:20482 blocked for more than 144 seconds. [ 1197.625701][ T29] Not tainted syzkaller #0 [ 1197.632788][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1197.643936][ T29] task:syz.3.4934 state:D stack:27016 pid:20482 ppid:19373 flags:0x00004004 [ 1197.655057][ T29] Call Trace: [ 1197.660271][ T29] [ 1197.663252][ T29] __schedule+0x1553/0x45a0 [ 1197.669694][ T29] ? asan.module_dtor+0x20/0x20 [ 1197.674601][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1197.680609][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1197.686138][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1197.692785][ T29] schedule+0xbd/0x170 [ 1197.696903][ T29] schedule_preempt_disabled+0x13/0x20 [ 1197.702489][ T29] __mutex_lock+0x6a9/0xcc0 [ 1197.707039][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1197.713519][ T29] ? tun_chr_close+0x41/0x1c0 [ 1197.720756][ T29] ? mutex_lock_nested+0x20/0x20 [ 1197.725885][ T29] ? __fput+0x61c/0x970 [ 1197.732007][ T29] ? tun_chr_open+0x510/0x510 [ 1197.737013][ T29] tun_chr_close+0x41/0x1c0 [ 1197.744061][ T29] __fput+0x234/0x970 [ 1197.749443][ T29] task_work_run+0x1d4/0x260 [ 1197.754188][ T29] ? task_work_cancel+0x220/0x220 [ 1197.759477][ T29] ? exit_to_user_mode_loop+0x3b/0x110 [ 1197.765022][ T29] exit_to_user_mode_loop+0xe6/0x110 [ 1197.770829][ T29] exit_to_user_mode_prepare+0xee/0x180 [ 1197.776446][ T29] syscall_exit_to_user_mode+0x1a/0x50 [ 1197.782072][ T29] do_syscall_64+0x61/0xa0 [ 1197.786614][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.791405][ T29] ? clear_bhb_loop+0x40/0x90 [ 1197.796122][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1197.802131][ T29] RIP: 0033:0x7f0fff59c819 [ 1197.806670][ T29] RSP: 002b:00007ffeb2adc128 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 1197.815327][ T29] RAX: 0000000000000000 RBX: 00007f0fff817da0 RCX: 00007f0fff59c819 [ 1197.823782][ T29] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 1197.832119][ T29] RBP: 00007f0fff817da0 R08: 0000000000000006 R09: 0000000000000000 [ 1197.840194][ T29] R10: 00007f0fff817cb0 R11: 0000000000000246 R12: 00000000000ff0f6 [ 1197.848598][ T29] R13: 00007f0fff815fac R14: 00000000000fedf0 R15: 00007ffeb2adc230 [ 1197.856634][ T29] [ 1197.860926][ T29] INFO: task syz.3.4934:20483 blocked for more than 144 seconds. [ 1197.869371][ T29] Not tainted syzkaller #0 [ 1197.874341][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1197.883666][ T29] task:syz.3.4934 state:D stack:25800 pid:20483 ppid:19373 flags:0x00004004 [ 1197.893033][ T29] Call Trace: [ 1197.896732][ T29] [ 1197.900207][ T29] __schedule+0x1553/0x45a0 [ 1197.904796][ T29] ? asan.module_dtor+0x20/0x20 [ 1197.909727][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1197.914755][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1197.920337][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1197.926823][ T29] schedule+0xbd/0x170 [ 1197.931239][ T29] schedule_preempt_disabled+0x13/0x20 [ 1197.936752][ T29] __mutex_lock+0x6a9/0xcc0 [ 1197.941528][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1197.946258][ T29] ? rtnetlink_rcv_msg+0x811/0xfa0 [ 1197.951464][ T29] ? mutex_lock_nested+0x20/0x20 [ 1197.956461][ T29] rtnetlink_rcv_msg+0x811/0xfa0 [ 1197.962969][ T29] ? rtnetlink_rcv_msg+0x221/0xfa0 [ 1197.970251][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1197.975560][ T29] ? rtnetlink_bind+0x80/0x80 [ 1197.982102][ T29] ? preempt_schedule_common+0x82/0xc0 [ 1197.989763][ T29] ? preempt_schedule+0xc0/0xd0 [ 1197.994780][ T29] ? schedule_preempt_disabled+0x20/0x20 [ 1198.000816][ T29] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1198.007134][ T29] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1198.014718][ T29] ? lock_chain_count+0x20/0x20 [ 1198.019832][ T29] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 1198.025853][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1198.031842][ T29] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1198.039519][ T29] ? _raw_spin_unlock+0x40/0x40 [ 1198.044426][ T29] ? rcu_preempt_deferred_qs_irqrestore+0x88e/0xce0 [ 1198.053061][ T29] netlink_rcv_skb+0x241/0x4d0 [ 1198.059775][ T29] ? rtnetlink_bind+0x80/0x80 [ 1198.064570][ T29] ? netlink_ack+0x1180/0x1180 [ 1198.070659][ T29] ? __lock_acquire+0x7d40/0x7d40 [ 1198.075778][ T29] ? __rcu_read_unlock+0x7c/0xd0 [ 1198.082644][ T29] ? netlink_deliver_tap+0x2e/0x1b0 [ 1198.089785][ T29] netlink_unicast+0x751/0x8d0 [ 1198.094641][ T29] netlink_sendmsg+0x8d0/0xbf0 [ 1198.099765][ T29] ? netlink_getsockopt+0x590/0x590 [ 1198.105129][ T29] ? aa_sock_msg_perm+0x94/0x150 [ 1198.110364][ T29] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1198.116602][ T29] ? security_socket_sendmsg+0x80/0xa0 [ 1198.124393][ T29] ? netlink_getsockopt+0x590/0x590 [ 1198.132350][ T29] ____sys_sendmsg+0x5ba/0x960 [ 1198.139431][ T29] ? __asan_memset+0x22/0x40 [ 1198.144168][ T29] ? __sys_sendmsg_sock+0x30/0x30 [ 1198.151260][ T29] ? __import_iovec+0x5f2/0x850 [ 1198.156171][ T29] ? import_iovec+0x73/0xa0 [ 1198.162786][ T29] ___sys_sendmsg+0x2a6/0x360 [ 1198.170694][ T29] ? __sys_sendmsg+0x2a0/0x2a0 [ 1198.175604][ T29] __se_sys_sendmsg+0x1c2/0x2b0 [ 1198.181954][ T29] ? __x64_sys_sendmsg+0x80/0x80 [ 1198.187147][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1198.192570][ T29] do_syscall_64+0x55/0xa0 [ 1198.197036][ T29] ? clear_bhb_loop+0x40/0x90 [ 1198.201872][ T29] ? clear_bhb_loop+0x40/0x90 [ 1198.206766][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1198.212737][ T29] RIP: 0033:0x7f0fff59c819 [ 1198.217192][ T29] RSP: 002b:00007f1000453028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1198.225739][ T29] RAX: ffffffffffffffda RBX: 00007f0fff815fa0 RCX: 00007f0fff59c819 [ 1198.234343][ T29] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000007 [ 1198.242435][ T29] RBP: 00007f0fff632c91 R08: 0000000000000000 R09: 0000000000000000 [ 1198.251140][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1198.259252][ T29] R13: 00007f0fff816038 R14: 00007f0fff815fa0 R15: 00007ffeb2adbfc8 [ 1198.267735][ T29] [ 1198.270823][ T29] INFO: task syz.0.4935:20485 blocked for more than 145 seconds. [ 1198.278860][ T29] Not tainted syzkaller #0 [ 1198.283931][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1198.292836][ T29] task:syz.0.4935 state:D stack:22632 pid:20485 ppid:13607 flags:0x00004004 [ 1198.302255][ T29] Call Trace: [ 1198.305642][ T29] [ 1198.310578][ T29] __schedule+0x1553/0x45a0 [ 1198.315253][ T29] ? mark_lock+0x94/0x320 [ 1198.321717][ T29] ? asan.module_dtor+0x20/0x20 [ 1198.326724][ T29] ? __mutex_lock+0x6a4/0xcc0 [ 1198.335914][ T29] ? __mutex_trylock_common+0x8a/0x260 [ 1198.343985][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1198.352152][ T29] schedule+0xbd/0x170 [ 1198.356373][ T29] schedule_preempt_disabled+0x13/0x20 [ 1198.364042][ T29] __mutex_lock+0x6a9/0xcc0 [ 1198.370626][ T29] ? __mutex_lock+0x4f9/0xcc0 [ 1198.375466][ T29] ? ethnl_default_dumpit+0x78/0x8a0 [ 1198.381144][ T29] ? mutex_lock_nested+0x20/0x20 [ 1198.386138][ T29] ? __kmem_cache_alloc_node+0x13a/0x250 [ 1198.392012][ T29] ethnl_default_dumpit+0x78/0x8a0 [ 1198.397212][ T29] ? __build_skb_around+0x255/0x3d0 [ 1198.402561][ T29] genl_dumpit+0xff/0x1a0 [ 1198.406941][ T29] netlink_dump+0x747/0xe50 [ 1198.411613][ T29] ? netlink_lookup+0x200/0x200 [ 1198.416570][ T29] ? genl_start+0x574/0x6b0 [ 1198.421434][ T29] __netlink_dump_start+0x5f1/0x810 [ 1198.426708][ T29] genl_family_rcv_msg_dumpit+0x214/0x310 [ 1198.432847][ T29] ? genl_rcv_msg+0x7a0/0x7a0 [ 1198.437937][ T29] ? genl_get_cmd+0x692/0x920 [ 1198.442668][ T29] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1198.448978][ T29] ? genl_family_rcv_msg_doit+0x310/0x310 [ 1198.454830][ T29] ? genl_start+0x6b0/0x6b0 [ 1198.459418][ T29] ? genl_dumpit+0x1a0/0x1a0 [ 1198.464143][ T29] ? radix_tree_lookup+0x122/0x280 [ 1198.469695][ T29] genl_rcv_msg+0x5e5/0x7a0 [ 1198.474531][ T29] ? genl_bind+0x360/0x360 [ 1198.479588][ T29] ? ethnl_default_doit+0xb80/0xb80 [ 1198.485024][ T29] ? ethnl_default_start+0x560/0x560 [ 1198.490643][ T29] ? ethnl_default_dumpit+0x8a0/0x8a0 [ 1198.496286][ T29] netlink_rcv_skb+0x241/0x4d0 [ 1198.501189][ T29] ? genl_bind+0x360/0x360 [ 1198.505759][ T29] ? netlink_ack+0x1180/0x1180 [ 1198.510764][ T29] ? __lock_acquire+0x7d40/0x7d40 [ 1198.515834][ T29] ? down_read+0x1ac/0x2e0 [ 1198.520376][ T29] genl_rcv+0x28/0x40 [ 1198.524391][ T29] netlink_unicast+0x751/0x8d0 [ 1198.529248][ T29] netlink_sendmsg+0x8d0/0xbf0 [ 1198.534059][ T29] ? netlink_getsockopt+0x590/0x590 [ 1198.540097][ T29] ? aa_sock_msg_perm+0x94/0x150 [ 1198.545219][ T29] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1198.550601][ T29] ? security_socket_sendmsg+0x80/0xa0 [ 1198.556194][ T29] ? netlink_getsockopt+0x590/0x590 [ 1198.561565][ T29] ____sys_sendmsg+0x5ba/0x960 [ 1198.566418][ T29] ? __asan_memset+0x22/0x40 [ 1198.573822][ T29] ? __sys_sendmsg_sock+0x30/0x30 [ 1198.580915][ T29] ? __import_iovec+0x5f2/0x850 [ 1198.585819][ T29] ? import_iovec+0x73/0xa0 [ 1198.592279][ T29] ___sys_sendmsg+0x2a6/0x360 [ 1198.597156][ T29] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 1198.603164][ T29] ? __sys_sendmsg+0x2a0/0x2a0 [ 1198.608078][ T29] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1198.614193][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1198.619618][ T29] ? kasan_check_range+0x85/0x290 [ 1198.624683][ T29] __se_sys_sendmsg+0x1c2/0x2b0 [ 1198.629620][ T29] ? __x64_sys_sendmsg+0x80/0x80 [ 1198.634615][ T29] ? syscall_enter_from_user_mode+0x2e/0x80 [ 1198.640700][ T29] do_syscall_64+0x55/0xa0 [ 1198.645532][ T29] ? clear_bhb_loop+0x40/0x90 [ 1198.656923][ T29] ? clear_bhb_loop+0x40/0x90 [ 1198.661850][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1198.667853][ T29] RIP: 0033:0x7f4a5c39c819 [ 1198.672312][ T29] RSP: 002b:00007f4a5d1d8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1198.680871][ T29] RAX: ffffffffffffffda RBX: 00007f4a5c615fa0 RCX: 00007f4a5c39c819 [ 1198.689061][ T29] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000008 [ 1198.697439][ T29] RBP: 00007f4a5c432c91 R08: 0000000000000000 R09: 0000000000000000 [ 1198.706213][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1198.714810][ T29] R13: 00007f4a5c616038 R14: 00007f4a5c615fa0 R15: 00007ffd71537948 [ 1198.722902][ T29] [ 1198.725968][ T29] [ 1198.725968][ T29] Showing all locks held in the system: [ 1198.734036][ T29] 1 lock held by khungtaskd/29: [ 1198.739010][ T29] #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 1198.749480][ T29] 2 locks held by dhcpcd/5435: [ 1198.754307][ T29] #0: ffff88804427a690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: netlink_dump+0xf9/0xe50 [ 1198.764142][ T29] #1: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x78f/0xe50 [ 1198.773336][ T29] 2 locks held by getty/5532: [ 1198.778376][ T29] #0: ffff88802de070a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1198.788321][ T29] #1: ffffc900015d02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x433/0x1390 [ 1198.798629][ T29] 3 locks held by kworker/1:8/5847: [ 1198.804045][ T29] #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.816846][ T29] #1: ffffc90004bbfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.829069][ T29] #2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 [ 1198.839442][ T29] 4 locks held by kworker/u4:13/16573: [ 1198.845060][ T29] #0: ffff8880b8e3c018 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 1198.855962][ T29] #1: ffff8880b8e289c0 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2176/0x45a0 [ 1198.864953][ T29] #2: ffff8880b8e29598 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 [ 1198.874815][ T29] #3: ffffffff9748ec10 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x6c/0x4f0 [ 1198.885407][ T29] 3 locks held by kworker/u4:18/16578: [ 1198.891182][ T29] #0: ffff88802cb96538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.902958][ T29] #1: ffffc90003777d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.916771][ T29] #2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 [ 1198.926396][ T29] 4 locks held by kworker/u4:20/16580: [ 1198.932051][ T29] #0: ffff88801a254938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.943412][ T29] #1: ffffc90003797d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.955712][ T29] #2: ffffffff8e3b57d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 [ 1198.965684][ T29] #3: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xf2/0xa80 [ 1198.976623][ T29] 3 locks held by kworker/u4:21/16581: [ 1198.984906][ T29] #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1198.997470][ T29] #1: ffffc900037a7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 [ 1199.008984][ T29] #2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 [ 1199.018346][ T29] 7 locks held by syz-executor/20332: [ 1199.023776][ T29] #0: ffff88802e6f0418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21b/0x990 [ 1199.033143][ T29] #1: ffff88805be7dc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x520 [ 1199.043342][ T29] #2: ffff888024e23ab0 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x23a/0x520 [ 1199.053853][ T29] #3: ffffffff8dca2848 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd8/0x370 [ 1199.064263][ T29] #4: ffff88803238e0e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xb6/0x7a0 [ 1199.075058][ T29] #5: ffff88803238c250 (&devlink->lock_key#7){+.+.}-{3:3}, at: nsim_drv_remove+0x50/0x170 [ 1199.085495][ T29] #6: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3f/0x180 [ 1199.094544][ T29] 1 lock held by syz.1.4931/20475: [ 1199.100610][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: bpf_xdp_link_attach+0x136/0x730 [ 1199.112850][ T29] 1 lock held by syz.1.4931/20476: [ 1199.119334][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: bpf_xdp_link_attach+0x136/0x730 [ 1199.129307][ T29] 1 lock held by syz.3.4934/20482: [ 1199.134539][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 [ 1199.143614][ T29] 1 lock held by syz.3.4934/20483: [ 1199.148832][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.158841][ T29] 3 locks held by syz.0.4935/20485: [ 1199.164163][ T29] #0: ffffffff8e4274b0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 [ 1199.172569][ T29] #1: ffff888050a04690 (nlk_cb_mutex-GENERIC){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x810 [ 1199.183387][ T29] #2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_dumpit+0x78/0x8a0 [ 1199.193217][ T29] 1 lock held by syz-executor/20488: [ 1199.198568][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.208177][ T29] 1 lock held by syz-executor/20494: [ 1199.213853][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.223420][ T29] 1 lock held by syz-executor/20496: [ 1199.228858][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.238772][ T29] 2 locks held by kworker/u4:1/20498: [ 1199.244181][ T29] #0: ffff8880b8f3c018 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 1199.254590][ T29] #1: ffff8880b8f289c0 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2176/0x45a0 [ 1199.263759][ T29] 1 lock held by syz-executor/20500: [ 1199.269255][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.278869][ T29] 1 lock held by syz-executor/20505: [ 1199.284285][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.294448][ T29] 1 lock held by syz-executor/20511: [ 1199.300081][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.309949][ T29] 1 lock held by syz-executor/20513: [ 1199.315447][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.325202][ T29] 1 lock held by syz-executor/20517: [ 1199.330910][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.340550][ T29] 1 lock held by syz-executor/20522: [ 1199.345859][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.355442][ T29] 1 lock held by syz-executor/20528: [ 1199.361096][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.370666][ T29] 1 lock held by syz-executor/20530: [ 1199.376000][ T29] #0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 [ 1199.385801][ T29] [ 1199.388204][ T29] ============================================= [ 1199.388204][ T29] [ 1199.396628][ T29] NMI backtrace for cpu 0 [ 1199.400973][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1199.408196][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1199.418266][ T29] Call Trace: [ 1199.421558][ T29] [ 1199.424515][ T29] dump_stack_lvl+0x18c/0x250 [ 1199.429259][ T29] ? show_regs_print_info+0x20/0x20 [ 1199.434487][ T29] ? load_image+0x420/0x420 [ 1199.439219][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 1199.444183][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 1199.450362][ T29] ? _printk+0xde/0x130 [ 1199.454657][ T29] ? load_image+0x420/0x420 [ 1199.459211][ T29] ? load_image+0x420/0x420 [ 1199.463782][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 1199.469998][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 1199.476012][ T29] watchdog+0xf3d/0xf80 [ 1199.480176][ T29] ? watchdog+0x1e1/0xf80 [ 1199.484551][ T29] kthread+0x2fa/0x390 [ 1199.488632][ T29] ? hungtask_pm_notify+0x90/0x90 [ 1199.493697][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1199.498339][ T29] ret_from_fork+0x48/0x80 [ 1199.502887][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1199.507594][ T29] ret_from_fork_asm+0x11/0x20 [ 1199.512399][ T29] [ 1199.515979][ T29] Sending NMI from CPU 0 to CPUs 1: [ 1199.521506][ C1] NMI backtrace for cpu 1 [ 1199.521518][ C1] CPU: 1 PID: 20498 Comm: kworker/u4:1 Not tainted syzkaller #0 [ 1199.521534][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1199.521544][ C1] Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet [ 1199.521569][ C1] RIP: 0010:__lock_acquire+0x16b/0x7d40 [ 1199.521590][ C1] Code: 77 30 44 89 f8 4c 8d 74 c7 08 4c 89 f0 48 c1 e8 03 42 80 3c 00 00 74 12 4c 89 f7 e8 9f 28 77 00 49 b8 00 00 00 00 00 fc ff df <4d> 8b 2e 4d 85 ed 75 2b 45 31 f6 48 8b bc 24 88 00 00 00 44 89 fe [ 1199.521603][ C1] RSP: 0018:ffffc900107c7620 EFLAGS: 00000046 [ 1199.521616][ C1] RAX: 1ffffffff1a2641d RBX: ffff888044053c00 RCX: 1ffff920020f8ee8 [ 1199.521627][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8d1320e0 [ 1199.521637][ C1] RBP: ffffc900107c7868 R08: dffffc0000000000 R09: 0000000000000000 [ 1199.521647][ C1] R10: dffffc0000000000 R11: fffffbfff1d162be R12: 0000000000000000 [ 1199.521657][ C1] R13: 0000000000000002 R14: ffffffff8d1320e8 R15: 0000000000000000 [ 1199.521667][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 1199.521680][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1199.521690][ C1] CR2: 00007f3080a1fdd8 CR3: 000000000cf32000 CR4: 00000000003506e0 [ 1199.521706][ C1] DR0: 0000000000000008 DR1: 0000000000000000 DR2: 0000000000000000 [ 1199.521715][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1199.521725][ C1] Call Trace: [ 1199.521731][ C1] [ 1199.521737][ C1] ? kasan_set_track+0x5f/0x70 [ 1199.521755][ C1] ? slab_free_freelist_hook+0x130/0x1a0 [ 1199.521769][ C1] ? __kmem_cache_free+0xba/0x1e0 [ 1199.521796][ C1] ? process_scheduled_works+0xa5d/0x15d0 [ 1199.521821][ C1] ? verify_lock_unused+0x140/0x140 [ 1199.521836][ C1] ? mark_lock+0x94/0x320 [ 1199.521854][ C1] ? mark_lock+0x94/0x320 [ 1199.521870][ C1] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1199.521888][ C1] ? lock_chain_count+0x20/0x20 [ 1199.521904][ C1] lock_acquire+0x19e/0x420 [ 1199.521920][ C1] ? batadv_iv_ogm_schedule+0x3e7/0xf10 [ 1199.521939][ C1] ? batadv_iv_ogm_schedule+0x3e7/0xf10 [ 1199.521954][ C1] ? read_lock_is_recursive+0x20/0x20 [ 1199.521970][ C1] ? batadv_tvlv_container_ogm_append+0x466/0x4e0 [ 1199.521992][ C1] ? batadv_tvlv_container_ogm_append+0x466/0x4e0 [ 1199.522014][ C1] batadv_iv_ogm_schedule+0x40b/0xf10 [ 1199.522029][ C1] ? batadv_iv_ogm_schedule+0x3e7/0xf10 [ 1199.522049][ C1] ? batadv_iv_ogm_schedule+0x3e7/0xf10 [ 1199.522065][ C1] ? batadv_iv_send_outstanding_bat_ogm_packet+0x850/0x850 [ 1199.522087][ C1] batadv_iv_send_outstanding_bat_ogm_packet+0x733/0x850 [ 1199.522109][ C1] ? process_scheduled_works+0x96f/0x15d0 [ 1199.522126][ C1] process_scheduled_works+0xa5d/0x15d0 [ 1199.522154][ C1] ? worker_attach_to_pool+0x380/0x380 [ 1199.522174][ C1] ? assign_work+0x3d2/0x5d0 [ 1199.522193][ C1] worker_thread+0xa55/0xfc0 [ 1199.522210][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1199.522228][ C1] ? _raw_spin_unlock+0x40/0x40 [ 1199.522244][ C1] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 1199.522268][ C1] kthread+0x2fa/0x390 [ 1199.522282][ C1] ? pr_cont_work+0x560/0x560 [ 1199.522299][ C1] ? kthread_blkcg+0xd0/0xd0 [ 1199.522313][ C1] ret_from_fork+0x48/0x80 [ 1199.522330][ C1] ? kthread_blkcg+0xd0/0xd0 [ 1199.522344][ C1] ret_from_fork_asm+0x11/0x20 [ 1199.522368][ C1] [ 1199.524794][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 1199.864054][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1199.871270][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1199.881598][ T29] Call Trace: [ 1199.885064][ T29] [ 1199.888114][ T29] dump_stack_lvl+0x18c/0x250 [ 1199.892942][ T29] ? show_regs_print_info+0x20/0x20 [ 1199.898189][ T29] ? load_image+0x420/0x420 [ 1199.902822][ T29] panic+0x2dc/0x730 [ 1199.906820][ T29] ? schedule_preempt_disabled+0x20/0x20 [ 1199.912537][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 1199.917056][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 1199.922617][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 1199.928803][ T29] watchdog+0xf7c/0xf80 [ 1199.932974][ T29] ? watchdog+0x1e1/0xf80 [ 1199.937322][ T29] kthread+0x2fa/0x390 [ 1199.941453][ T29] ? hungtask_pm_notify+0x90/0x90 [ 1199.946546][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1199.951148][ T29] ret_from_fork+0x48/0x80 [ 1199.955576][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1199.960303][ T29] ret_from_fork_asm+0x11/0x20 [ 1199.965827][ T29] [ 1199.969637][ T29] Kernel Offset: disabled [ 1199.974167][ T29] Rebooting in 86400 seconds..