last executing test programs: 5.263027191s ago: executing program 3 (id=3147): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x0, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xb}, 0x100000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0), 0xc) r1 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0x17, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xc}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x48}], {0x95, 0x0, 0x9}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) openat$cgroup_subtree(r2, 0x0, 0x2, 0x0) 4.868925018s ago: executing program 3 (id=3149): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x40009, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0xffffffffffffffff, 0x3fff8000}, 0x0, 0xff, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext={0x0, 0x1000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x13, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000057700000000000000000000182ec0002020702500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb70200000800c309b7030000240000008500"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0xc}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000540)={0x7, 0x80, 0xb, 0xc0, 0x7, 0x6, 0x0, 0x5, 0x100, 0x4, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x8, 0x1}, 0x8, 0x5, 0x6, 0x9, 0x7, 0x35b, 0x7, 0x0, 0x2, 0x0, 0x8}, 0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x8) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="020000000b0a"}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000780)="d80000001a0081044e81f782db4cb904021d0800fe007c05e8fe55a115001c000200142603600e12080005007a010401a800160020001d400d000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000dc0)={0x0, 0x80, 0x0, 0x5, 0x8, 0x6, 0x0, 0xd, 0x20002, 0xf, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfb, 0x4, @perf_config_ext={0x5, 0x8}, 0x2a0f, 0xc046, 0x3e, 0xa, 0x0, 0x7, 0x8, 0x0, 0x8, 0x0, 0x4}, r4, 0xc, r2, 0x0) socket$kcm(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000140)={'wlan1\x00', @random="0100000000eb"}) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f00000006c0), 0x6e, &(0x7f0000000e40)=[{&(0x7f0000000f00)=""/121, 0x79}, {&(0x7f0000000900)=""/148, 0x94}, {&(0x7f00000009c0)=""/93, 0x5d}, {&(0x7f0000000cc0)=""/216, 0xd8}, {0x0}], 0x5, &(0x7f0000000f80)}, 0x3) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000ec0)=ANY=[@ANYBLOB="720ac4ffe3d5332d6910160f848e00000000009500"], &(0x7f0000000480)='GPL\x00'}, 0x94) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) ioctl$TUNGETFEATURES(r6, 0x800454cf, &(0x7f0000000500)) socket$kcm(0xa, 0x7, 0x88) close(0x3) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000100)={&(0x7f0000000180)="8621457b1771c16215fa9f61f75cf2b7f246ca4726d77339de5f19bddf0e5e56d67a9c943710e1856ef4ad79e01a9e315c18d7cfe9f2b7527bb11ccb33e891fa895730a87e5468f436edbb5d4eba1e745b31397bed3c53a4c68eaf5697a2c64ed886ef9b468a17df0d2b8c040881d9bedade4bdde343850d24292a7c60802c73cf50c1ae0025bd41c61d4c0b3102ef54a5f3794886c958e725ec90ce3eca7054853eec33b7402219c45ff36057cf8b61e733ff4aeeac7cd30de0c2ecc2acd297be4c9ef5be139211942840f35ce90696aee14a5897b38c31f11599d9130fda79a950312b9a3c827897be60496a100454", &(0x7f0000000280)=""/154, &(0x7f0000000040)="5c40ff6c90ecb6021e46e04c1f7aae2f2d8e506a417ab09fbb2b537853cfa3e9c5d04be090aed655ef6821faf3ca9dadea8cafd1a902", &(0x7f0000000340)="784be7fc6158bb0b3359fdfa2a5268088c9a001d031aeebbe7ea32e7d7471d6a12035e3e287920198e1e8b7f4b9ea835cd3507f75eeb3d14aaf87b67cd380c6aca71308453aa304c285216186aa407310c25a9cdc6f262efe072fe58b303a96c51616cffa3f1235c60d84dd19034455c78646b6318116eef81d035553dc7f149e23c84b72fc2cd5363fbe9411d5f4c8ac8a75c352e0e4a24a1c50f95d3d2e6eb9c4d4afff03860fe1455a9fc8b2ddcdc38cbee31137a544b36fa3690d6449ea78c1a3702c99a11ccbb998d210cb81c5c11", 0x8a8, 0xffffffffffffffff, 0x4}, 0x38) 2.744186786s ago: executing program 1 (id=3165): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb0100180000601fac8b00e2c30d000c00000005000000fdffffff0000000604000000839a6ab19c15f93747692e19f5f757860712df9ec5be3423764c2ccaf3e78fe8d2d2b6c64e34f78894fd7566d763eb89be4f198af192c873ba35d3f238b59aaafc2c445a7a19c9100af292fd50d3cf7257441a8a9dbd45626b09ea6e65aa79ea4e2c2ce2b4135679b6f0d87f7dc8e2eed54e615f7683ce7910862b8b5176357ae4906d2507c35f0bd811"], 0x0, 0x29, 0x0, 0x1, 0xfffffffa}, 0x28) r2 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001000), 0xc}, 0xa01}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x12, 0x8, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, 0x0, &(0x7f0000000140)=r3}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe1d}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b05d25a806c8c6394f90424fc60100005000b000900053582c137153e37000c0280fc0b1000f80b", 0x33fe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xc, 0xc, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x723, 0x0, 0x0, 0x0, 0x40}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x86}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, r1}, 0x94) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8940, &(0x7f0000000080)) sendmsg$inet(r8, &(0x7f0000000100)={0x0, 0xfeff, 0x0}, 0x20000000) openat$tun(0xffffffffffffff9c, 0x0, 0x402400, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r11 = socket$kcm(0x2b, 0x1, 0x0) socket$kcm(0x29, 0x0, 0x0) setsockopt$sock_attach_bpf(r11, 0x6, 0xd, 0xfffffffffffffffe, 0x60) r12 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r12, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000600073582c137153e37080c18800cac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x24) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x81, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x7}, 0x0, 0x400008, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 2.560053322s ago: executing program 2 (id=3167): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000005c0)=[0x0, 0x0, 0x0], 0x0, 0xb5, &(0x7f0000000600), 0x38, 0x10, &(0x7f0000000640), &(0x7f0000000680), 0x8, 0x6b, 0x8, 0xfffffffffffffd4a, &(0x7f00000006c0)}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000b7020000000000008500000086000000850000008a0000008510000008000000181900", @ANYRES32], &(0x7f0000000200)='GPL\x00', 0x3, 0x2, &(0x7f0000000340)=""/2, 0x40f00, 0x6, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x5, 0x0, 0x2, 0x3eec4b6}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000400), &(0x7f00000005c0)=[{0x5, 0x3, 0x9, 0xb}, {0x2, 0x4, 0x4, 0xb}, {0x5, 0x1, 0xa, 0x1}, {0x1, 0x4, 0x7, 0x6}, {0x4, 0x2, 0x0, 0x3}, {0x5, 0x3, 0x9, 0xc}, {0x1, 0x2, 0x5, 0x4}, {0x1, 0x3, 0x10, 0x7}, {0x5, 0x2, 0x2, 0x1}], 0x10, 0x3b}, 0x94) perf_event_open(&(0x7f0000000ac0)={0x0, 0x80, 0x1, 0x8, 0x9b, 0x8, 0x0, 0x10001, 0x4812, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0xd4, 0x4, @perf_config_ext={0x0, 0x50a}, 0x1000, 0xfff, 0xffff, 0x5, 0x401, 0x7, 0x2, 0x0, 0xf, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0200000000000000000000000000000000000700", @ANYRES32=r0, @ANYRES32, @ANYBLOB="02000000030000000300"/28], 0x50) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x21, &(0x7f0000000140)=[{&(0x7f00000004c0)="d8000000180081154e81f782db4cb904021d0800fd02fe02e8fd50a10a000600258848000c600e41b0000900ac0008032500000016000b000a00ff150048035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x5, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21ca0000cf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe8799fe266e2ccac80fefe750151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa796ea7b156d19612297c63bb20e1e0469f7615f67a9218cbace38f5236821314f76302b98afa93044b83989339ca10e6ae30e70e17a82f03e915b8425e8e7a91614306d2ae0bc3550d856f2d7293672b5673d264fc886b0c8bdf436a0fcd21bf9da7bdca98e34cd6e59b0a7ce4ba1b466561aaa35448dff47bb1d7df23d467689a66", @ANYBLOB="82256209597a6d715a2d51881243ec79e2d1153dc72a0a785b6aee89674c410529ff116dc1fc7dd42fdb43eabefc518f1537fe048430e1f80cabbfd56e41b9e928bdb6392dba0dc976c1ff33358be16412a12db295d9da9dbb569af30278c36501e75648f9a2dd1123bda24b0696466296cf73047f18de99e7b77aadf88036c9ea8221e10a15293bcab2d04aae004c00333dba2c8a46112b57695f9502717f882db74eb6f8adc5d24368300dc607a6cb42bb8fdd5ca76c3ed95c77078514bd662c4509d7fae0438dd5b24cc27d6448db25a10fee97ce7f8b5713a32c0f242cfe98bd581887457140be4cb8", @ANYRES8=r0], &(0x7f0000000d00)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x29}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r2) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x8, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, 0xffffffffffffffff) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) write$cgroup_devices(r4, 0x0, 0xffdd) 2.22136669s ago: executing program 0 (id=3170): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@struct={0x1}]}, {0x0, [0x61, 0x2e, 0x2e]}}, &(0x7f0000000040)=""/247, 0x29, 0xf7, 0x1}, 0x28) 2.199654225s ago: executing program 1 (id=3171): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf5d, 0x3}, 0x0, 0xca, 0xdc1, 0x8, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) close(0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1509, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xe}, 0x0, 0x4, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x0, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85feff0fc9"], 0x0}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[@ANYRES8, @ANYRES8=r2], 0x12) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000), 0x4) 2.140208215s ago: executing program 0 (id=3172): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r3, &(0x7f00000010c0)={&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000480)='\\', 0x1}], 0x1}, 0x4000040) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f1, &(0x7f0000000080)) sendmsg$inet(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000180)="84", 0x1}], 0x1}, 0x8040) close(r3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@map, r0, 0xa, 0x2028}, 0x20) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r5, 0x4008240b, &(0x7f00000001c0)={0x4, 0x80, 0xf9, 0x3, 0x0, 0x0, 0x0, 0x62af, 0x62f02, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x800, 0x1, @perf_bp={&(0x7f00000000c0), 0x4}, 0x110, 0xfffffffffffffff0, 0x4b2, 0x5, 0x1000, 0x5, 0x88cc, 0x0, 0x0, 0x0, 0x8000000000000001}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000080)="2e00000010008188040f46ecdb4cb9cca7480ef431000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x8000) 2.139085264s ago: executing program 2 (id=3173): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x0, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xb}, 0x100000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0), 0xc) r1 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0x17, 0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xc}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x48}], {0x95, 0x0, 0x9}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) openat$cgroup_subtree(r2, 0x0, 0x2, 0x0) 2.036120595s ago: executing program 1 (id=3174): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @remote}) r2 = socket$kcm(0x2b, 0x1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x88, 0x67, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000380)=@framed={{}, [@printk={@lu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}, @call={0x85, 0x0, 0x0, 0x8}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r4}, 0xc) r5 = socket$kcm(0x11, 0x200000000000003, 0x300) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f00000003c0), 0x4) recvmsg$kcm(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000002580), 0x1}, 0x40002000) sendmsg$inet(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="00446916ab", 0x5}], 0x1, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xe}, @multicast2}}}], 0x20}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0xfffffffb, 0x9, 0x20002, 0x1, 0x4000000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) close(0xffffffffffffffff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x6, 0x13, &(0x7f0000000200)=r6, 0x4) 1.955292951s ago: executing program 2 (id=3175): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904, 0xd3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)="2e0000003e000511d25a80698c6394090324fc602f6e35400800018025581d00d1bd00"/46, 0x2e}], 0x1, 0x0, 0x0, 0x39c}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000040)='freezer.self_freezing\x00', 0x0, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000180)='blkio.throttle.io_serviced_recursive\x00', 0x0, 0x0) r4 = socket$kcm(0x2, 0x922000000001, 0x106) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x1fffffffffffffcd, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000080000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000070000008500000010"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x48, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.throttle.io_service_bytes\x00', 0x275a, 0x0) write$cgroup_pid(r7, &(0x7f0000000000), 0x2a979d) r8 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r1}, 0x8) setsockopt$sock_attach_bpf(r4, 0x6, 0x24, &(0x7f0000000000)=r8, 0xff7b) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r3) 1.746531362s ago: executing program 3 (id=3176): r0 = perf_event_open(&(0x7f0000000380)={0x4, 0x80, 0x0, 0x40, 0x0, 0x8, 0x0, 0x100000001, 0x60231, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_config_ext={0x8001, 0xc}, 0x12410, 0xc8, 0x3, 0x1, 0xfffffffffffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x6, 0x20, 0x0, 0x0, 0x200, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x1, @perf_bp={0x0}, 0x800, 0xcc8, 0x0, 0x7, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, r0, 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r4 = bpf$ITER_CREATE(0xb, &(0x7f00000002c0)={r3}, 0x8) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.controllers\x00', 0x275a, 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r5}, 0x8) ioctl$SIOCSIFHWADDR(r6, 0x541b, &(0x7f0000000180)={'veth0_virt_wifi\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}}) sendmsg$unix(r2, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x6000000000000000, 0xfa, 0x0, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281", 0x0}, 0x50) recvmsg$unix(r1, &(0x7f0000001ac0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x1ff, 0x200}, 0x8000, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r8 = socket$kcm(0xa, 0x2, 0x88) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x4, 0x8, 0x10, 0x80, 0x0, 0x400, 0x1d176, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xe}, 0x18, 0x0, 0xfffffffe, 0x1, 0x5, 0x2, 0x103, 0x0, 0x2, 0x0, 0x4}, 0x0, 0x4, 0xffffffffffffffff, 0x1b) r9 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1e000000000000000700400008"], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x890b, &(0x7f0000000000)) sendmsg$inet(r8, &(0x7f0000000000)={&(0x7f0000001340)={0x2, 0x6, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000001580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @multicast1}}}], 0x20}, 0x8000) sendmsg$inet(r8, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0) socket$kcm(0x10, 0x2, 0x10) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x1e, 0x10, &(0x7f00000001c0)=ANY=[@ANYBLOB="0100"/20, @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000008520000003000000bf91000000000000b7020000020000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0xa4, 0xfa, &(0x7f0000000580)=""/250, 0x41100, 0x40, '\x00', 0x0, @sk_lookup=0x24, r7, 0x8, &(0x7f0000000280)={0x4, 0x1}, 0x8, 0x10, &(0x7f0000000300)={0x4, 0xf, 0xe2d}, 0x10, 0x0, 0xffffffffffffffff, 0x1, &(0x7f0000000340)=[r6, r6, r5, r6, r4, r6, r3, r6, r6, r5], &(0x7f0000000680)=[{0x2, 0x2, 0x0, 0x5}], 0x10, 0x5}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000006c0)=@generic={&(0x7f0000000140)='./file0\x00', r10}, 0x18) openat$cgroup(r3, &(0x7f0000000700)='syz0\x00', 0x200002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) socket$kcm(0x2a, 0x2, 0x0) socket$kcm(0x2a, 0x2, 0x0) 1.745221562s ago: executing program 1 (id=3184): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @remote}) r2 = socket$kcm(0x2b, 0x1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x88, 0x67, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000380)=@framed={{}, [@printk={@lu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}, @call={0x85, 0x0, 0x0, 0x8}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r4}, 0xc) r5 = socket$kcm(0x11, 0x200000000000003, 0x300) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f00000003c0), 0x4) recvmsg$kcm(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000002580), 0x1}, 0x40002000) sendmsg$inet(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="00446916ab", 0x5}], 0x1, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xe}, @multicast2}}}], 0x20}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0xfffffffb, 0x9, 0x20002, 0x1, 0x4000000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) close(0xffffffffffffffff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x6, 0x13, &(0x7f0000000200)=r6, 0x4) 1.585338332s ago: executing program 0 (id=3177): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf5d, 0x3}, 0x0, 0xca, 0xdc1, 0x8, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7f, 0x7}, 0x104101, 0x4, 0x7fff, 0x1, 0x10, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1509, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xe}, 0x0, 0x4, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x0, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85feff0fc9"], 0x0}, 0x94) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r1, @ANYRES8=r5], 0x12) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000), 0x4) 1.485707484s ago: executing program 2 (id=3178): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000002c0)={r0}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x10, &(0x7f0000000600)=@framed={{}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf8ff}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, &(0x7f0000000300)='GPL\x00', 0xb, 0xff8, &(0x7f0000001e00)=""/4088}, 0x94) bpf$ENABLE_STATS(0x20, &(0x7f0000000000), 0x4) 1.452890737s ago: executing program 1 (id=3179): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, 0x0, &(0x7f0000000400)=""/177}, 0x20) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x0, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xb}, 0x100000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0x3100, 0x3100, &(0x7f0000000000), 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0), 0xc) r1 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r1, 0x6, 0x17, &(0x7f0000000200)=r1, 0x21) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xc}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x48}], {0x95, 0x0, 0x9}}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) openat$cgroup_subtree(r2, 0x0, 0x2, 0x0) 1.425382713s ago: executing program 2 (id=3180): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r0}, 0x8) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb0100180000601fac8b00e2c30d000c00000005000000fdffffff0000000604000000839a6ab19c15f93747692e19f5f757860712df9ec5be3423764c2ccaf3e78fe8d2d2b6c64e34f78894fd7566d763eb89be4f198af192c873ba35d3f238b59aaafc2c445a7a19c9100af292fd50d3cf7257441a8a9dbd45626b09ea6e65aa79ea4e2c2ce2b4135679b6f0d87f7dc8e2eed54e615f7683ce7910862b8b5176357ae4906d2507c35f0bd811"], 0x0, 0x29, 0x0, 0x1, 0xfffffffa}, 0x28) r2 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000001000), 0xc}, 0xa01}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x12, 0x8, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, 0x0, &(0x7f0000000140)=r3}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe1d}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x401}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b05d25a806c8c6394f90424fc60100005000b000900053582c137153e37000c0280fc0b1000f80b", 0x33fe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0xc, 0xc, &(0x7f0000000240)=@framed={{0x18, 0x2, 0x0, 0x0, 0x723, 0x0, 0x0, 0x0, 0x40}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x86}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002280)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57af, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000180)=r5, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe, r1}, 0x94) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8940, &(0x7f0000000080)) sendmsg$inet(r8, &(0x7f0000000100)={0x0, 0xfeff, 0x0}, 0x20000000) openat$tun(0xffffffffffffff9c, 0x0, 0x402400, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r11 = socket$kcm(0x2b, 0x1, 0x0) socket$kcm(0x29, 0x0, 0x0) setsockopt$sock_attach_bpf(r11, 0x6, 0xd, 0xfffffffffffffffe, 0x60) r12 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r12, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000600073582c137153e37080c18800cac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x24) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x81, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x7}, 0x0, 0x400008, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 1.388165356s ago: executing program 3 (id=3181): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f0000000600)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x5, [@struct={0x1}]}, {0x0, [0x61, 0x30, 0x2e]}}, &(0x7f0000000040)=""/247, 0x29, 0xf7, 0x1}, 0x28) 1.35586011s ago: executing program 0 (id=3182): bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={0xffffffffffffffff, 0xe0, &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x3, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000005c0)=[0x0, 0x0, 0x0], 0x0, 0xb5, &(0x7f0000000600), 0x38, 0x10, &(0x7f0000000640), &(0x7f0000000680), 0x8, 0x6b, 0x8, 0xfffffffffffffd4a, &(0x7f00000006c0)}}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0xf, &(0x7f0000000400)=ANY=[@ANYBLOB="0000000000000000b7020000000000008500000086000000850000008a0000008510000008000000181900", @ANYRES32], &(0x7f0000000200)='GPL\x00', 0x3, 0x2, &(0x7f0000000340)=""/2, 0x40f00, 0x6, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000003c0)={0x5, 0x0, 0x2, 0x3eec4b6}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000400), &(0x7f00000005c0)=[{0x5, 0x3, 0x9, 0xb}, {0x2, 0x4, 0x4, 0xb}, {0x5, 0x1, 0xa, 0x1}, {0x1, 0x4, 0x7, 0x6}, {0x4, 0x2, 0x0, 0x3}, {0x5, 0x3, 0x9, 0xc}, {0x1, 0x2, 0x5, 0x4}, {0x1, 0x3, 0x10, 0x7}, {0x5, 0x2, 0x2, 0x1}], 0x10, 0x3b}, 0x94) perf_event_open(&(0x7f0000000ac0)={0x0, 0x80, 0x1, 0x8, 0x9b, 0x8, 0x0, 0x10001, 0x4812, 0x8, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0xd4, 0x4, @perf_config_ext={0x0, 0x50a}, 0x1000, 0xfff, 0xffff, 0x5, 0x401, 0x7, 0x2, 0x0, 0xf, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="0200000000000000000000000000000000000700", @ANYRES32=r0, @ANYRES32, @ANYBLOB="02000000030000000300"/28], 0x50) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x21, &(0x7f0000000140)=[{&(0x7f00000004c0)="d8000000180081154e81f782db4cb904021d0800fd02fe02e8fd50a10a000600258848000c600e41b0000900ac0008032500000016000b000a00ff150048035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x5, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6494d614dcc6fab5335ec470db2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21ca0000cf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9b24be41a9169bdfaf16da915b2e249ee1c6eee84309e7a23c19a39484809539fca4e0b6eab1aa7d55545a34effa077faa56d59e88254f54077f799bf168301000000bf2255d6a0244d35b213bda84cc172afd8cc2e59a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d0faab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbfe5ab0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab8b4b380a00d72bc0480f94306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b846970cfd98b9d4139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e559d17879570c8ad9433269af3be5fa6a9a5c24e392955f4e979ea13201bafe4f0f6ea508000000a0c548552b571bed5647223c78a992810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151ffdf6f7820549cda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526890aa7fe5e68949a3b30567e54d3504723177d356c4604bca492ede62fc28839b5301160ecec37e83efceefd7ca2533659edc8be05cc85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d35a142a9ec9a7a3755e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e561a9845e4ff29e2bdb1d0b923b262341c5e093fd66a2946501559335781092cf8ce3c7c56cd31121624d76517fd3666276c3c0e812b28e2f30d035cee5d0e77a3c70008ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856cf24f370030be3b5f79f030b8d3ebce68663ef5af469abe753314fae31651e0ecea5ece8fb11a4ee288eb149f1fa33669cc8d901fa8e46354c9c3a041a1e7b55c4e81dba1e12289ee34463baf28345bde0c195bc9f021da8f3025ee9c8e3168b4177ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262fa3f1dabeb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a4601adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa700a86407e79ae29d2c117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cc50feeb7bfad9b7be3283b6450d014e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5671820420bf5b6522c0e21c882c66f4f25ffb6d95e07de02205fca4f18a2eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff2418a18217747ae442e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa6623920dacc107f532348cc21164efe794874eac73381e961f3d9c8c21578fe3245097c280abe51427a7f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6fc01e1b9e16587bb5f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d17eb0000000000000000000000fa08ad0731c4b839688b22c4da2a6b00008a1949a6ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282bffff2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae05334d5a44a020000001c0d882a564d74a7c72bf9a2152b261e58fea6d2f93589cfe261dc0410b5ccc92a5a0eab327a33431d62d2b7c75ce654d556c9e1817c1abca762ab53d40da51560351b673363652e1ecb56cfe4a746a45ab13c6014e9f361ab687d1cd1795ce9e05c817b83d76046bdb3709de5df7499a02d2f636a454b85b987580ada025d83bd7b8df28a540d5ec5537942e79f2f1ab25ea5f563bc77e4f9468bd309469880c7e34150ca886d1f9ac2f7e82dbe296c877d925c38c54cc8137b29028854b6bd57ca893927c331300e16aba792289e135589d93302fc37c73c303e383cdf8ef3f6d6265fe5ee01759d24027475c8901039a898582022bc95992b86dce0710887c8a625d9cbb897bdbfaf49a3f642a169827a9bae4fcfa5212461db000000000000e6ed75ca8fcda7ef3ee336189fef3b3ffb9f38fefc5ff39c4e69e3fa1f8b10ee97123e99b61eba065b1ad67530e7c4f11f9da7ae000002000000610101ad7f79cb9bbf64a0fc109f49fe8799fe266e2ccac80fefe750151f5ddfe51833ec65ece70e07ce8ab5d97db47da8f80000664dc0b86ae2b3ff9d4e220752a6b2f3ea9f793612386496dca5af7b8952aafa796ea7b156d19612297c63bb20e1e0469f7615f67a9218cbace38f5236821314f76302b98afa93044b83989339ca10e6ae30e70e17a82f03e915b8425e8e7a91614306d2ae0bc3550d856f2d7293672b5673d264fc886b0c8bdf436a0fcd21bf9da7bdca98e34cd6e59b0a7ce4ba1b466561aaa35448dff47bb1d7df23d467689a66", @ANYBLOB="82256209597a6d715a2d51881243ec79e2d1153dc72a0a785b6aee89674c410529ff116dc1fc7dd42fdb43eabefc518f1537fe048430e1f80cabbfd56e41b9e928bdb6392dba0dc976c1ff33358be16412a12db295d9da9dbb569af30278c36501e75648f9a2dd1123bda24b0696466296cf73047f18de99e7b77aadf88036c9ea8221e10a15293bcab2d04aae004c00333dba2c8a46112b57695f9502717f882db74eb6f8adc5d24368300dc607a6cb42bb8fdd5ca76c3ed95c77078514bd662c4509d7fae0438dd5b24cc27d6448db25a10fee97ce7f8b5713a32c0f242cfe98bd581887457140be4cb8", @ANYRES8=r0], &(0x7f0000000d00)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x29}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r2) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x8, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, 0xffffffffffffffff) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4801}) write$cgroup_devices(r4, 0x0, 0xffdd) 1.230663477s ago: executing program 3 (id=3183): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf5d, 0x3}, 0x0, 0xca, 0xdc1, 0x8, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) close(0xffffffffffffffff) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0xb, 0x1509, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0xe}, 0x0, 0x4, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x0, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85feff0fc9"], 0x0}, 0x94) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r1, &(0x7f0000000200)=ANY=[@ANYRES8, @ANYRES8=r2], 0x12) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x4c, &(0x7f0000000000), 0x4) 1.14024712s ago: executing program 1 (id=3185): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x40009, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0xffffffffffffffff, 0x3fff8000}, 0x0, 0xff, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext={0x0, 0x1000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0x13, &(0x7f00000001c0)=ANY=[@ANYBLOB="18020000057700000000000000000000182ec0002020702500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb70200000800c309b7030000240000008500"], 0x0, 0x5, 0x0, 0x0, 0x41000, 0xc}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000540)={0x7, 0x80, 0xb, 0xc0, 0x7, 0x6, 0x0, 0x5, 0x100, 0x4, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_config_ext={0x8, 0x1}, 0x8, 0x5, 0x6, 0x9, 0x7, 0x35b, 0x7, 0x0, 0x2, 0x0, 0x8}, 0xffffffffffffffff, 0x3, 0xffffffffffffffff, 0x8) ioctl$SIOCSIFHWADDR(r1, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="020000000b0a"}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000001540)={0x6, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000780)="d80000001a0081044e81f782db4cb904021d0800fe007c05e8fe55a115001c000200142603600e12080005007a010401a800160020001d400d000000035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9a941", 0xd8}], 0x1}, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open$cgroup(&(0x7f0000000dc0)={0x0, 0x80, 0x0, 0x5, 0x8, 0x6, 0x0, 0xd, 0x20002, 0xf, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfb, 0x4, @perf_config_ext={0x5, 0x8}, 0x2a0f, 0xc046, 0x3e, 0xa, 0x0, 0x7, 0x8, 0x0, 0x8, 0x0, 0x4}, r4, 0xc, r2, 0x0) socket$kcm(0xa, 0x2, 0x3a) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8b06, &(0x7f0000000140)={'wlan1\x00', @random="0100000000eb"}) recvmsg$unix(r3, &(0x7f00000005c0)={&(0x7f00000006c0), 0x6e, &(0x7f0000000e40)=[{&(0x7f0000000f00)=""/121, 0x79}, {&(0x7f0000000900)=""/148, 0x94}, {&(0x7f00000009c0)=""/93, 0x5d}, {&(0x7f0000000cc0)=""/216, 0xd8}, {0x0}], 0x5, &(0x7f0000000f80)}, 0x3) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000ec0)=ANY=[@ANYBLOB="720ac4ffe3d5332d6910160f848e00000000009500"], &(0x7f0000000480)='GPL\x00'}, 0x94) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x10000, 0x0) ioctl$TUNGETFEATURES(r6, 0x800454cf, &(0x7f0000000500)) socket$kcm(0xa, 0x7, 0x88) close(0x3) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000100)={&(0x7f0000000180)="8621457b1771c16215fa9f61f75cf2b7f246ca4726d77339de5f19bddf0e5e56d67a9c943710e1856ef4ad79e01a9e315c18d7cfe9f2b7527bb11ccb33e891fa895730a87e5468f436edbb5d4eba1e745b31397bed3c53a4c68eaf5697a2c64ed886ef9b468a17df0d2b8c040881d9bedade4bdde343850d24292a7c60802c73cf50c1ae0025bd41c61d4c0b3102ef54a5f3794886c958e725ec90ce3eca7054853eec33b7402219c45ff36057cf8b61e733ff4aeeac7cd30de0c2ecc2acd297be4c9ef5be139211942840f35ce90696aee14a5897b38c31f11599d9130fda79a950312b9a3c827897be60496a100454", &(0x7f0000000280)=""/154, &(0x7f0000000040)="5c40ff6c90ecb6021e46e04c1f7aae2f2d8e506a417ab09fbb2b537853cfa3e9c5d04be090aed655ef6821faf3ca9dadea8cafd1a902", &(0x7f0000000340)="784be7fc6158bb0b3359fdfa2a5268088c9a001d031aeebbe7ea32e7d7471d6a12035e3e287920198e1e8b7f4b9ea835cd3507f75eeb3d14aaf87b67cd380c6aca71308453aa304c285216186aa407310c25a9cdc6f262efe072fe58b303a96c51616cffa3f1235c60d84dd19034455c78646b6318116eef81d035553dc7f149e23c84b72fc2cd5363fbe9411d5f4c8ac8a75c352e0e4a24a1c50f95d3d2e6eb9c4d4afff03860fe1455a9fc8b2ddcdc38cbee31137a544b36fa3690d6449ea78c1a3702c99a11ccbb998d210cb81c5c11", 0x8a8, 0xffffffffffffffff, 0x4}, 0x38) 1.128734908s ago: executing program 0 (id=3186): bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000c80)=@o_path={0x0}, 0x18) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0xffffffffffffff82}, 0x101, 0x32, 0x43a1bd76, 0x7, 0x1, 0x3, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$cgroup_procs(r2, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d31, 0x80048, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x7400}, 0x4050) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x46, 0x1, 0x0, 0x0, 0x0, 0x210d, 0x41080, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x407fff, 0x1}, 0x14105, 0x32, 0xfffffbff, 0x3, 0x6, 0x0, 0xffda, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x9) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000240)="1400000016000b63d25a80648c25940121", 0x11}, {&(0x7f0000000280)="e26248", 0x3}], 0x2}, 0x40050) (fail_nth: 7) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) 1.013168877s ago: executing program 3 (id=3187): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r3, &(0x7f00000010c0)={&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f0000000480)='\\', 0x1}], 0x1}, 0x4000040) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x89f1, &(0x7f0000000080)) sendmsg$inet(r3, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000180)="84", 0x1}], 0x1}, 0x8040) close(r3) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@map, r0, 0xa, 0x2028}, 0x20) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r5, 0x4008240b, &(0x7f00000001c0)={0x4, 0x80, 0xf9, 0x3, 0x0, 0x0, 0x0, 0x62af, 0x62f02, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x800, 0x1, @perf_bp={&(0x7f00000000c0), 0x4}, 0x110, 0xfffffffffffffff0, 0x4b2, 0x5, 0x1000, 0x5, 0x88cc, 0x0, 0x0, 0x0, 0x8000000000000001}) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000080)="2e00000010008188040f46ecdb4cb9cca7480ef431000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x8000) 45.460538ms ago: executing program 0 (id=3188): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @remote}) r2 = socket$kcm(0x2b, 0x1, 0x0) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r3, 0x88, 0x67, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xc, &(0x7f0000000380)=@framed={{}, [@printk={@lu, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}, @call={0x85, 0x0, 0x0, 0x8}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r4}, 0xc) r5 = socket$kcm(0x11, 0x200000000000003, 0x300) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f00000003c0), 0x4) recvmsg$kcm(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000002580), 0x1}, 0x40002000) sendmsg$inet(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000040)="00446916ab", 0x5}], 0x1, &(0x7f0000000000)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xe}, @multicast2}}}], 0x20}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1f, 0x7fff, 0xfffffffb, 0x9, 0x20002, 0x1, 0x4000000, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) close(0xffffffffffffffff) recvmsg$unix(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r2, 0x6, 0x13, &(0x7f0000000200)=r6, 0x4) 0s ago: executing program 2 (id=3189): socket$kcm(0xa, 0x922000000003, 0x11) socket$kcm(0xa, 0x1, 0x106) socket$kcm(0x29, 0x5, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x5, 0x84) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) perf_event_open(&(0x7f00000002c0)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x200000000000003, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000005"], 0x48) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0xb0}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000440)={&(0x7f0000000340)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000000100)=[{&(0x7f0000000500)=""/131, 0x83}, {&(0x7f0000000740)=""/249, 0xf9}], 0x2, &(0x7f00000005c0)=""/139, 0x8b}, 0x2040) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x28, 0xe, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee68888a8", 0x0, 0xadf0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) kernel console output (not intermixed with test programs): et_sendmsg_permission+0x1e1/0x2f0 [ 435.043931][T12039] ? sock_rps_record_flow+0x19/0x3f0 [ 435.049280][T12039] ? inet_sendmsg+0x7c/0x2f0 [ 435.053945][T12039] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 435.059307][T12039] ? security_socket_sendmsg+0x80/0xa0 [ 435.064833][T12039] ? inet_send_prepare+0x260/0x260 [ 435.070459][T12039] ____sys_sendmsg+0x5ba/0x960 [ 435.075296][T12039] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 435.081534][T12039] ? __asan_memset+0x22/0x40 [ 435.086195][T12039] ? __sys_sendmsg_sock+0x30/0x30 [ 435.091291][T12039] ? __import_iovec+0x5f2/0x850 [ 435.096235][T12039] ? import_iovec+0x73/0xa0 [ 435.100844][T12039] ___sys_sendmsg+0x2a6/0x360 [ 435.105590][T12039] ? __sys_sendmsg+0x2a0/0x2a0 [ 435.110484][T12039] __se_sys_sendmsg+0x1c2/0x2b0 [ 435.115556][T12039] ? __x64_sys_sendmsg+0x80/0x80 [ 435.120586][T12039] ? syscall_enter_from_user_mode+0x2e/0x80 [ 435.126559][T12039] do_syscall_64+0x55/0xa0 [ 435.131042][T12039] ? clear_bhb_loop+0x40/0x90 [ 435.135787][T12039] ? clear_bhb_loop+0x40/0x90 [ 435.140531][T12039] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 435.146488][T12039] RIP: 0033:0x7fc13299c799 [ 435.150965][T12039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 435.170993][T12039] RSP: 002b:00007fc1338ef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 435.179490][T12039] RAX: ffffffffffffffda RBX: 00007fc132c15fa0 RCX: 00007fc13299c799 [ 435.187533][T12039] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 435.195563][T12039] RBP: 00007fc1338ef090 R08: 0000000000000000 R09: 0000000000000000 [ 435.203637][T12039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 435.211852][T12039] R13: 00007fc132c16038 R14: 00007fc132c15fa0 R15: 00007ffda16d7338 [ 435.219913][T12039] [ 435.804210][T12046] bond_slave_1: entered promiscuous mode [ 435.834020][T12046] bond_slave_1: entered allmulticast mode [ 435.874327][T12043] netlink: 'syz.2.2122': attribute type 39 has an invalid length. [ 436.207616][T12054] netlink: 'syz.3.2126': attribute type 6 has an invalid length. [ 436.834559][T12068] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2130'. [ 436.988457][T12068] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2130'. [ 437.077847][T12068] netlink: 'syz.3.2130': attribute type 2 has an invalid length. [ 437.096189][T12068] netlink: 'syz.3.2130': attribute type 8 has an invalid length. [ 437.144053][T12068] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2130'. [ 437.231261][T12069] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2130'. [ 437.283319][T12078] netlink: 105120 bytes leftover after parsing attributes in process `syz.1.2133'. [ 437.323136][T12072] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2130'. [ 437.324420][T12078] netlink: 16126 bytes leftover after parsing attributes in process `syz.1.2133'. [ 438.401149][T12085] netlink: 'syz.0.2137': attribute type 6 has an invalid length. [ 439.101231][T12096] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2140'. [ 439.143368][T12095] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2140'. [ 439.210406][T12095] openvswitch: netlink: Flow key attribute not present in set flow. [ 440.612085][T12123] IPv6: Can't replace route, no match found [ 440.755186][T12124] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 440.843581][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.854260][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.865940][T12124] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.2145'. [ 441.736283][T12144] netlink: 'syz.1.2149': attribute type 46 has an invalid length. [ 441.784789][T12145] netlink: 'syz.3.2153': attribute type 21 has an invalid length. [ 441.806174][T12142] openvswitch: netlink: Flow key attribute not present in set flow. [ 441.878049][T12146] __nla_validate_parse: 1 callbacks suppressed [ 441.878070][T12146] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2154'. [ 441.937154][T12139] pim6reg1: entered promiscuous mode [ 441.973319][T12139] pim6reg1: entered allmulticast mode [ 442.987649][T12158] bond_slave_1: entered promiscuous mode [ 443.007743][T12158] bond_slave_1: entered allmulticast mode [ 443.140382][T12164] netlink: 'syz.3.2158': attribute type 39 has an invalid length. [ 443.807931][T12179] netlink: 'syz.1.2164': attribute type 21 has an invalid length. [ 444.539127][T12194] netlink: 'syz.1.2170': attribute type 2 has an invalid length. [ 444.547223][T12194] netlink: 'syz.1.2170': attribute type 8 has an invalid length. [ 444.577851][T12194] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2170'. [ 445.603526][T12204] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 446.395164][T12234] netlink: 'syz.2.2179': attribute type 21 has an invalid length. [ 447.858016][T12269] FAULT_INJECTION: forcing a failure. [ 447.858016][T12269] name failslab, interval 1, probability 0, space 0, times 0 [ 447.875055][T12269] CPU: 0 PID: 12269 Comm: syz.1.2195 Not tainted syzkaller #0 [ 447.882772][T12269] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 447.893321][T12269] Call Trace: [ 447.896658][T12269] [ 447.899644][T12269] dump_stack_lvl+0x18c/0x250 [ 447.904384][T12269] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 447.910609][T12269] ? show_regs_print_info+0x20/0x20 [ 447.915905][T12269] ? load_image+0x400/0x400 [ 447.920495][T12269] should_fail_ex+0x39d/0x4d0 [ 447.925341][T12269] should_failslab+0x9/0x20 [ 447.929924][T12269] slab_pre_alloc_hook+0x59/0x310 [ 447.935007][T12269] ? make_kgid+0x1c8/0x660 [ 447.939472][T12269] ? __scm_send+0x64c/0x14a0 [ 447.944096][T12269] __kmem_cache_alloc_node+0x53/0x250 [ 447.949516][T12269] ? __scm_send+0x64c/0x14a0 [ 447.954152][T12269] kmalloc_trace+0x2a/0xe0 [ 447.958608][T12269] __scm_send+0x64c/0x14a0 [ 447.963074][T12269] ? __scm_destroy+0x160/0x160 [ 447.967884][T12269] ? bpf_lsm_socket_getpeersec_dgram+0x9/0x10 [ 447.974508][T12269] ? security_socket_getpeersec_dgram+0x83/0xa0 [ 447.980811][T12269] unix_stream_sendmsg+0x152/0xbf0 [ 447.985969][T12269] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 447.992240][T12269] ? lockdep_hardirqs_on+0x98/0x150 [ 447.997476][T12269] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 448.003672][T12269] ? unix_show_fdinfo+0x270/0x270 [ 448.008744][T12269] ? security_socket_sendmsg+0x5a/0xa0 [ 448.014334][T12269] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 448.019666][T12269] ? security_socket_sendmsg+0x80/0xa0 [ 448.025162][T12269] ? unix_show_fdinfo+0x270/0x270 [ 448.030243][T12269] ____sys_sendmsg+0x5ba/0x960 [ 448.035053][T12269] ? __sys_sendmsg_sock+0x30/0x30 [ 448.040206][T12269] ? __import_iovec+0x5f2/0x850 [ 448.045106][T12269] ? import_iovec+0x73/0xa0 [ 448.049738][T12269] ___sys_sendmsg+0x2a6/0x360 [ 448.054455][T12269] ? __sys_sendmsg+0x2a0/0x2a0 [ 448.059291][T12269] __se_sys_sendmsg+0x1c2/0x2b0 [ 448.064261][T12269] ? __x64_sys_sendmsg+0x80/0x80 [ 448.069251][T12269] ? syscall_enter_from_user_mode+0x2e/0x80 [ 448.075451][T12269] do_syscall_64+0x55/0xa0 [ 448.079941][T12269] ? clear_bhb_loop+0x40/0x90 [ 448.084654][T12269] ? clear_bhb_loop+0x40/0x90 [ 448.089392][T12269] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 448.095343][T12269] RIP: 0033:0x7fc13299c799 [ 448.099805][T12269] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.119454][T12269] RSP: 002b:00007fc1338ef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 448.127900][T12269] RAX: ffffffffffffffda RBX: 00007fc132c15fa0 RCX: 00007fc13299c799 [ 448.135907][T12269] RDX: 0000000004004881 RSI: 0000200000000600 RDI: 000000000000000e [ 448.144004][T12269] RBP: 00007fc1338ef090 R08: 0000000000000000 R09: 0000000000000000 [ 448.152005][T12269] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 448.160009][T12269] R13: 00007fc132c16038 R14: 00007fc132c15fa0 R15: 00007ffda16d7338 [ 448.168028][T12269] [ 452.148851][T12311] FAULT_INJECTION: forcing a failure. [ 452.148851][T12311] name failslab, interval 1, probability 0, space 0, times 0 [ 452.188989][T12311] CPU: 0 PID: 12311 Comm: syz.2.2209 Not tainted syzkaller #0 [ 452.196543][T12311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 452.206654][T12311] Call Trace: [ 452.209985][T12311] [ 452.212962][T12311] dump_stack_lvl+0x18c/0x250 [ 452.217716][T12311] ? show_regs_print_info+0x20/0x20 [ 452.222994][T12311] ? load_image+0x400/0x400 [ 452.227554][T12311] ? verify_lock_unused+0x140/0x140 [ 452.233001][T12311] should_fail_ex+0x39d/0x4d0 [ 452.237761][T12311] should_failslab+0x9/0x20 [ 452.242336][T12311] slab_pre_alloc_hook+0x59/0x310 [ 452.247430][T12311] kmem_cache_alloc+0x5a/0x2d0 [ 452.252258][T12311] ? skb_clone+0x1eb/0x370 [ 452.256744][T12311] skb_clone+0x1eb/0x370 [ 452.261048][T12311] __netlink_deliver_tap+0x41c/0x830 [ 452.266405][T12311] ? netlink_deliver_tap+0x2e/0x1b0 [ 452.271673][T12311] netlink_deliver_tap+0x19c/0x1b0 [ 452.276877][T12311] netlink_unicast+0x72c/0x8d0 [ 452.282137][T12311] netlink_sendmsg+0x8d0/0xbf0 [ 452.286996][T12311] ? netlink_getsockopt+0x590/0x590 [ 452.292268][T12311] ? aa_sock_msg_perm+0x94/0x150 [ 452.297266][T12311] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 452.302647][T12311] ? security_socket_sendmsg+0x80/0xa0 [ 452.308158][T12311] ? netlink_getsockopt+0x590/0x590 [ 452.313424][T12311] ____sys_sendmsg+0x5ba/0x960 [ 452.318256][T12311] ? __asan_memset+0x22/0x40 [ 452.322915][T12311] ? __sys_sendmsg_sock+0x30/0x30 [ 452.327988][T12311] ? __import_iovec+0x5f2/0x850 [ 452.332924][T12311] ? import_iovec+0x73/0xa0 [ 452.337489][T12311] ___sys_sendmsg+0x2a6/0x360 [ 452.342220][T12311] ? get_pid_task+0x20/0x1e0 [ 452.346872][T12311] ? __sys_sendmsg+0x2a0/0x2a0 [ 452.351728][T12311] ? __lock_acquire+0x7d40/0x7d40 [ 452.356856][T12311] __se_sys_sendmsg+0x1c2/0x2b0 [ 452.361777][T12311] ? __x64_sys_sendmsg+0x80/0x80 [ 452.366805][T12311] ? lockdep_hardirqs_on+0x98/0x150 [ 452.372085][T12311] do_syscall_64+0x55/0xa0 [ 452.376577][T12311] ? clear_bhb_loop+0x40/0x90 [ 452.381346][T12311] ? clear_bhb_loop+0x40/0x90 [ 452.386088][T12311] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 452.392048][T12311] RIP: 0033:0x7f44a9f9c799 [ 452.396612][T12311] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.416367][T12311] RSP: 002b:00007f44aae85028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 452.424847][T12311] RAX: ffffffffffffffda RBX: 00007f44aa215fa0 RCX: 00007f44a9f9c799 [ 452.432873][T12311] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 452.440979][T12311] RBP: 00007f44aae85090 R08: 0000000000000000 R09: 0000000000000000 [ 452.449023][T12311] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 452.457230][T12311] R13: 00007f44aa216038 R14: 00007f44aa215fa0 R15: 00007ffce07a4818 [ 452.465282][T12311] [ 452.527709][T12311] netlink: 10 bytes leftover after parsing attributes in process `syz.2.2209'. [ 452.645556][T12320] netlink: 'syz.1.2210': attribute type 10 has an invalid length. [ 452.657565][T12320] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2210'. [ 452.666657][T12320] batadv_slave_1: entered promiscuous mode [ 452.678893][T12320] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 452.686468][T12320] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 453.064893][T12330] syzkaller0: entered promiscuous mode [ 453.073006][T12330] syzkaller0: entered allmulticast mode [ 453.332188][T12343] netlink: 'syz.0.2220': attribute type 3 has an invalid length. [ 453.340365][T12343] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2220'. [ 453.675023][T12355] netlink: 668 bytes leftover after parsing attributes in process `syz.2.2222'. [ 453.685961][T12355] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 453.696149][T12355] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 455.671824][T12366] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2226'. [ 455.695972][T12366] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2226'. [ 455.738927][T12366] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2226'. [ 456.545877][T12385] netlink: 'syz.3.2233': attribute type 10 has an invalid length. [ 456.554098][T12385] netlink: 2 bytes leftover after parsing attributes in process `syz.3.2233'. [ 456.569410][T12385] batadv_slave_1: entered promiscuous mode [ 456.576855][T12385] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 456.609915][T12385] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 456.838868][T12387] netlink: 'syz.1.2234': attribute type 10 has an invalid length. [ 456.881674][T12394] netlink: 830 bytes leftover after parsing attributes in process `syz.2.2235'. [ 457.539185][T12418] netlink: 'syz.3.2246': attribute type 10 has an invalid length. [ 457.553114][T12418] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2246'. [ 457.575449][T12418] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 457.616123][T12418] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 457.716509][T12422] netlink: 'syz.3.2246': attribute type 27 has an invalid length. [ 458.057404][T12432] netlink: 161460 bytes leftover after parsing attributes in process `syz.0.2250'. [ 458.372288][T12443] netlink: 'syz.0.2255': attribute type 3 has an invalid length. [ 458.399818][T12443] netlink: 16098 bytes leftover after parsing attributes in process `syz.0.2255'. [ 458.405517][T12430] netlink: 110532 bytes leftover after parsing attributes in process `syz.3.2249'. [ 458.432191][T12446] .`: left allmulticast mode [ 458.443415][T12446] bond_slave_0: left allmulticast mode [ 458.459442][T12446] bond_slave_1: left allmulticast mode [ 458.464998][T12446] batadv_slave_0: left allmulticast mode [ 458.477875][T12446] bridge_slave_1: left allmulticast mode [ 458.497421][T12446] bridge0: port 3(.`) entered disabled state [ 458.527346][ T51] Bluetooth: hci2: unexpected event 0x09 length: 15 > 3 [ 458.541332][T12446] bridge_slave_0: left allmulticast mode [ 458.569688][T12446] bridge_slave_0: left promiscuous mode [ 458.596748][T12446] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.128068][T12457] netlink: 'syz.0.2259': attribute type 10 has an invalid length. [ 459.192593][T12457] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2259'. [ 459.258181][T12457] `: Device lo is loopback device. Loopback devices can't be added as a team port [ 459.276028][T12457] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 459.350720][T12457] netlink: 'syz.0.2259': attribute type 27 has an invalid length. [ 459.682089][T12475] netlink: 'syz.0.2267': attribute type 10 has an invalid length. [ 460.386717][T12491] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2273'. [ 460.478426][T12491] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 460.933547][T12507] netlink: 'syz.1.2278': attribute type 10 has an invalid length. [ 460.943179][T12507] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2278'. [ 460.956943][T12507] lo: left promiscuous mode [ 460.964268][T12507] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 461.026803][T12507] netlink: 'syz.1.2278': attribute type 27 has an invalid length. [ 461.229785][T12522] FAULT_INJECTION: forcing a failure. [ 461.229785][T12522] name failslab, interval 1, probability 0, space 0, times 0 [ 461.242630][T12523] netlink: 'syz.1.2283': attribute type 10 has an invalid length. [ 461.255543][T12522] CPU: 1 PID: 12522 Comm: syz.0.2282 Not tainted syzkaller #0 [ 461.263082][T12522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 461.273193][T12522] Call Trace: [ 461.276524][T12522] [ 461.279502][T12522] dump_stack_lvl+0x18c/0x250 [ 461.284258][T12522] ? show_regs_print_info+0x20/0x20 [ 461.289504][T12522] ? load_image+0x400/0x400 [ 461.294035][T12522] ? __might_sleep+0xe0/0xe0 [ 461.298769][T12522] ? __lock_acquire+0x7d40/0x7d40 [ 461.303837][T12522] ? rcu_is_watching+0x15/0xb0 [ 461.308647][T12522] should_fail_ex+0x39d/0x4d0 [ 461.313399][T12522] should_failslab+0x9/0x20 [ 461.317982][T12522] slab_pre_alloc_hook+0x59/0x310 [ 461.323095][T12522] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 461.329042][T12522] __kmem_cache_alloc_node+0x53/0x250 [ 461.334478][T12522] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 461.340431][T12522] kmalloc_trace+0x2a/0xe0 [ 461.344935][T12522] sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 461.350732][T12522] sctp_association_new+0x15d3/0x25c0 [ 461.356186][T12522] sctp_connect_new_asoc+0x2de/0x6a0 [ 461.361536][T12522] ? __sctp_connect+0xd80/0xd80 [ 461.366441][T12522] ? __local_bh_enable_ip+0x13a/0x1c0 [ 461.371868][T12522] ? _local_bh_enable+0xa0/0xa0 [ 461.376765][T12522] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 461.382627][T12522] ? sctp_endpoint_lookup_assoc+0x7b/0x260 [ 461.388479][T12522] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 461.394090][T12522] ? security_sctp_bind_connect+0x89/0xb0 [ 461.399873][T12522] sctp_sendmsg+0x1575/0x28c0 [ 461.404613][T12522] ? sctp_getsockopt+0xb60/0xb60 [ 461.409604][T12522] ? aa_sk_perm+0x83c/0x970 [ 461.414187][T12522] ? aa_af_perm+0x330/0x330 [ 461.418751][T12522] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 461.425220][T12522] ? sock_rps_record_flow+0x19/0x3f0 [ 461.430651][T12522] ? inet_sendmsg+0x7c/0x2f0 [ 461.435289][T12522] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 461.440631][T12522] ? security_socket_sendmsg+0x80/0xa0 [ 461.446135][T12522] ? inet_send_prepare+0x260/0x260 [ 461.451301][T12522] ____sys_sendmsg+0x5ba/0x960 [ 461.456113][T12522] ? __lock_acquire+0x7d40/0x7d40 [ 461.461220][T12522] ? __asan_memset+0x22/0x40 [ 461.465871][T12522] ? __sys_sendmsg_sock+0x30/0x30 [ 461.470947][T12522] ? __import_iovec+0x5f2/0x850 [ 461.475859][T12522] ? import_iovec+0x73/0xa0 [ 461.480417][T12522] ___sys_sendmsg+0x2a6/0x360 [ 461.485137][T12522] ? get_pid_task+0x20/0x1e0 [ 461.489780][T12522] ? __sys_sendmsg+0x2a0/0x2a0 [ 461.494611][T12522] ? __lock_acquire+0x7d40/0x7d40 [ 461.499710][T12522] __se_sys_sendmsg+0x1c2/0x2b0 [ 461.504612][T12522] ? __x64_sys_sendmsg+0x80/0x80 [ 461.509609][T12522] ? lockdep_hardirqs_on+0x98/0x150 [ 461.514876][T12522] do_syscall_64+0x55/0xa0 [ 461.519348][T12522] ? clear_bhb_loop+0x40/0x90 [ 461.524156][T12522] ? clear_bhb_loop+0x40/0x90 [ 461.529060][T12522] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 461.535003][T12522] RIP: 0033:0x7f680279c799 [ 461.539471][T12522] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 461.559160][T12522] RSP: 002b:00007f68035bd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 461.567641][T12522] RAX: ffffffffffffffda RBX: 00007f6802a15fa0 RCX: 00007f680279c799 [ 461.575668][T12522] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 461.583688][T12522] RBP: 00007f68035bd090 R08: 0000000000000000 R09: 0000000000000000 [ 461.591707][T12522] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 461.599744][T12522] R13: 00007f6802a16038 R14: 00007f6802a15fa0 R15: 00007ffca905ed98 [ 461.607785][T12522] [ 463.193565][T12550] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2290'. [ 463.343584][T12541] syzkaller0: entered promiscuous mode [ 463.357053][T12541] syzkaller0: entered allmulticast mode [ 463.672888][T12558] netlink: 'syz.1.2294': attribute type 10 has an invalid length. [ 464.120456][T12555] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2292'. [ 466.681649][T12570] netlink: 'syz.1.2297': attribute type 10 has an invalid length. [ 466.700785][T12570] netlink: 55 bytes leftover after parsing attributes in process `syz.1.2297'. [ 467.159562][T12555] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 467.170362][T12555] CPU: 1 PID: 12555 Comm: syz.3.2292 Not tainted syzkaller #0 [ 467.177885][T12555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 467.188081][T12555] Call Trace: [ 467.191399][T12555] [ 467.194379][T12555] dump_stack_lvl+0x18c/0x250 [ 467.199126][T12555] ? show_regs_print_info+0x20/0x20 [ 467.204366][T12555] ? load_image+0x400/0x400 [ 467.208926][T12555] sysfs_warn_dup+0x8e/0xa0 [ 467.213470][T12555] sysfs_do_create_link_sd+0xc0/0x110 [ 467.218866][T12555] device_add_class_symlinks+0x1cf/0x240 [ 467.224547][T12555] device_add+0x507/0xc20 [ 467.228928][T12555] wiphy_register+0x1dad/0x2ae0 [ 467.233854][T12555] ? cfg80211_event_work+0x40/0x40 [ 467.239013][T12555] ? minstrel_ht_alloc+0x88a/0x990 [ 467.244219][T12555] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 467.250342][T12555] ieee80211_register_hw+0x3464/0x4250 [ 467.255881][T12555] ? ieee80211_tasklet_handler+0x20/0x20 [ 467.261574][T12555] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 467.267581][T12555] ? __debug_object_init+0xec/0x450 [ 467.272852][T12555] ? __asan_memset+0x22/0x40 [ 467.277519][T12555] ? __hrtimer_init+0x186/0x270 [ 467.282443][T12555] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 467.288270][T12555] ? mac80211_hwsim_free+0x220/0x220 [ 467.293629][T12555] ? rcu_is_watching+0x15/0xb0 [ 467.298488][T12555] ? kstrndup+0xbd/0x140 [ 467.302813][T12555] hwsim_new_radio_nl+0xdc9/0x1a90 [ 467.307982][T12555] ? mark_lock+0x94/0x320 [ 467.312425][T12555] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 467.318442][T12555] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 467.324806][T12555] ? lockdep_hardirqs_on+0x98/0x150 [ 467.330052][T12555] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 467.336293][T12555] ? genl_family_rcv_msg_doit+0x195/0x310 [ 467.342088][T12555] ? kasan_check_range+0x8f/0x290 [ 467.347171][T12555] genl_family_rcv_msg_doit+0x211/0x310 [ 467.352753][T12555] ? end_current_label_crit_section+0x170/0x170 [ 467.359102][T12555] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 467.365058][T12555] ? bpf_lsm_capable+0x9/0x10 [ 467.369770][T12555] ? security_capable+0x89/0xb0 [ 467.374671][T12555] genl_rcv_msg+0x619/0x7a0 [ 467.379225][T12555] ? genl_bind+0x360/0x360 [ 467.383797][T12555] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 467.390284][T12555] ? lockdep_hardirqs_on+0x98/0x150 [ 467.395555][T12555] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 467.401778][T12555] netlink_rcv_skb+0x241/0x4d0 [ 467.406596][T12555] ? genl_bind+0x360/0x360 [ 467.411032][T12555] ? netlink_ack+0x1180/0x1180 [ 467.415869][T12555] ? __lock_acquire+0x7d40/0x7d40 [ 467.420947][T12555] ? down_read+0x1ac/0x2e0 [ 467.425399][T12555] genl_rcv+0x28/0x40 [ 467.429423][T12555] netlink_unicast+0x751/0x8d0 [ 467.434271][T12555] netlink_sendmsg+0x8d0/0xbf0 [ 467.439124][T12555] ? lockdep_hardirqs_on+0x98/0x150 [ 467.444399][T12555] ? netlink_getsockopt+0x590/0x590 [ 467.449679][T12555] ? aa_sock_msg_perm+0x94/0x150 [ 467.454655][T12555] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 467.459975][T12555] ? security_socket_sendmsg+0x80/0xa0 [ 467.465459][T12555] ? netlink_getsockopt+0x590/0x590 [ 467.470697][T12555] ____sys_sendmsg+0x5ba/0x960 [ 467.475494][T12555] ? __asan_memset+0x22/0x40 [ 467.480131][T12555] ? __sys_sendmsg_sock+0x30/0x30 [ 467.485201][T12555] ? __import_iovec+0x5f2/0x850 [ 467.490125][T12555] ? import_iovec+0x73/0xa0 [ 467.494656][T12555] ___sys_sendmsg+0x2a6/0x360 [ 467.499387][T12555] ? __sys_sendmsg+0x2a0/0x2a0 [ 467.504211][T12555] ? perf_trace_preemptirq_template+0xac/0x330 [ 467.510459][T12555] __se_sys_sendmsg+0x1c2/0x2b0 [ 467.515338][T12555] ? __x64_sys_sendmsg+0x80/0x80 [ 467.520310][T12555] ? lockdep_hardirqs_on+0x98/0x150 [ 467.525591][T12555] do_syscall_64+0x55/0xa0 [ 467.530049][T12555] ? clear_bhb_loop+0x40/0x90 [ 467.534781][T12555] ? clear_bhb_loop+0x40/0x90 [ 467.539520][T12555] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 467.545469][T12555] RIP: 0033:0x7fad15f9c799 [ 467.550022][T12555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.569676][T12555] RSP: 002b:00007fad16d7e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 467.578179][T12555] RAX: ffffffffffffffda RBX: 00007fad16216090 RCX: 00007fad15f9c799 [ 467.586320][T12555] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000b [ 467.594354][T12555] RBP: 00007fad16032c99 R08: 0000000000000000 R09: 0000000000000000 [ 467.602366][T12555] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 467.610366][T12555] R13: 00007fad16216128 R14: 00007fad16216090 R15: 00007ffd370723b8 [ 467.618375][T12555] [ 467.653014][T12567] netlink: 'syz.2.2296': attribute type 1 has an invalid length. [ 467.668264][T12567] netlink: 112865 bytes leftover after parsing attributes in process `syz.2.2296'. [ 467.933255][ T51] Bluetooth: hci0: unexpected event 0x09 length: 15 > 3 [ 469.046520][T12604] syzkaller0: entered promiscuous mode [ 469.097923][T12604] syzkaller0: entered allmulticast mode [ 470.047835][T12614] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2310'. [ 471.714660][T12621] netlink: 'syz.0.2311': attribute type 10 has an invalid length. [ 471.722714][T12621] netlink: 55 bytes leftover after parsing attributes in process `syz.0.2311'. [ 471.998784][T12621] veth1_vlan (unregistering): left allmulticast mode [ 472.063946][T12621] `: Port device macvlan0 removed [ 472.143978][T12614] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 472.391042][T12633] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2317'. [ 472.973700][T12650] FAULT_INJECTION: forcing a failure. [ 472.973700][T12650] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 473.032139][T12650] CPU: 1 PID: 12650 Comm: syz.2.2322 Not tainted syzkaller #0 [ 473.039713][T12650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 473.049923][T12650] Call Trace: [ 473.053249][T12650] [ 473.056226][T12650] dump_stack_lvl+0x18c/0x250 [ 473.060971][T12650] ? show_regs_print_info+0x20/0x20 [ 473.066227][T12650] ? load_image+0x400/0x400 [ 473.070794][T12650] ? __might_fault+0xaa/0x120 [ 473.075553][T12650] ? __lock_acquire+0x7d40/0x7d40 [ 473.080640][T12650] should_fail_ex+0x39d/0x4d0 [ 473.085390][T12650] _copy_from_user+0x2f/0xe0 [ 473.090041][T12650] ___sys_sendmsg+0x1c7/0x360 [ 473.094779][T12650] ? get_pid_task+0x20/0x1e0 [ 473.099437][T12650] ? __sys_sendmsg+0x2a0/0x2a0 [ 473.104283][T12650] ? __lock_acquire+0x7d40/0x7d40 [ 473.109393][T12650] __se_sys_sendmsg+0x1c2/0x2b0 [ 473.114301][T12650] ? __x64_sys_sendmsg+0x80/0x80 [ 473.119312][T12650] ? lockdep_hardirqs_on+0x98/0x150 [ 473.124576][T12650] do_syscall_64+0x55/0xa0 [ 473.129070][T12650] ? clear_bhb_loop+0x40/0x90 [ 473.133817][T12650] ? clear_bhb_loop+0x40/0x90 [ 473.138665][T12650] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 473.144613][T12650] RIP: 0033:0x7f44a9f9c799 [ 473.149090][T12650] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.168757][T12650] RSP: 002b:00007f44aae85028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 473.177233][T12650] RAX: ffffffffffffffda RBX: 00007f44aa215fa0 RCX: 00007f44a9f9c799 [ 473.185262][T12650] RDX: 0000000000000010 RSI: 0000200000000080 RDI: 0000000000000003 [ 473.193375][T12650] RBP: 00007f44aae85090 R08: 0000000000000000 R09: 0000000000000000 [ 473.201405][T12650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 473.209450][T12650] R13: 00007f44aa216038 R14: 00007f44aa215fa0 R15: 00007ffce07a4818 [ 473.217513][T12650] [ 473.230624][T12646] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2321'. [ 473.743514][T12656] netlink: 'syz.3.2324': attribute type 10 has an invalid length. [ 473.774255][T12656] netlink: 55 bytes leftover after parsing attributes in process `syz.3.2324'. [ 475.134990][T12659] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2327'. [ 475.234401][T12659] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 476.397009][T12693] veth1_macvtap: left promiscuous mode [ 476.773583][T12700] netlink: 'syz.2.2337': attribute type 6 has an invalid length. [ 477.041043][T12703] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2338'. [ 478.528322][T12738] netlink: 'syz.1.2350': attribute type 6 has an invalid length. [ 479.421350][ T5780] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 479.437339][ T5780] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 479.452220][ T5780] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 479.497784][ T5780] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 479.529353][ T5780] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 479.538796][ T5780] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 479.757794][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 479.963414][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.044171][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.246451][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 480.548587][T12775] netlink: 'syz.3.2362': attribute type 6 has an invalid length. [ 480.645048][T12756] chnl_net:caif_netlink_parms(): no params data found [ 480.664790][T12767] netlink: 'syz.1.2360': attribute type 10 has an invalid length. [ 480.995248][ T12] tipc: Left network mode [ 481.137220][T12756] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.145132][T12756] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.153369][T12756] bridge_slave_0: entered allmulticast mode [ 481.166219][T12756] bridge_slave_0: entered promiscuous mode [ 481.318561][T12756] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.338855][T12756] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.359862][T12756] bridge_slave_1: entered allmulticast mode [ 481.385733][T12756] bridge_slave_1: entered promiscuous mode [ 481.628486][ T51] Bluetooth: hci3: command tx timeout [ 481.827190][T12805] mac80211_hwsim hwsim8 wlan0: left promiscuous mode [ 481.844204][T12805] mac80211_hwsim hwsim8 wlan0: left allmulticast mode [ 481.896223][T12801] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 481.918285][T12801] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 482.138437][T12756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 482.175609][T12756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 482.672721][T12756] team0: Port device team_slave_0 added [ 482.688793][T12756] team0: Port device team_slave_1 added [ 482.831283][T12832] netlink: 'syz.1.2382': attribute type 10 has an invalid length. [ 482.851171][T12832] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2382'. [ 482.870124][T12756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 482.897774][T12756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 482.947671][T12756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 482.959352][T12834] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2375'. [ 482.981779][T12756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 483.008523][T12756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 483.060000][T12756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 483.412930][T12756] hsr_slave_0: entered promiscuous mode [ 483.425260][T12756] hsr_slave_1: entered promiscuous mode [ 483.433615][T12756] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 483.447655][T12756] Cannot create hsr debugfs directory [ 483.709223][ T51] Bluetooth: hci3: command tx timeout [ 484.165479][T12865] netlink: 'syz.3.2380': attribute type 1 has an invalid length. [ 484.183865][T12865] netlink: 112865 bytes leftover after parsing attributes in process `syz.3.2380'. [ 484.207896][T12866] netlink: 'syz.3.2380': attribute type 1 has an invalid length. [ 484.215786][T12866] netlink: 112865 bytes leftover after parsing attributes in process `syz.3.2380'. [ 484.376377][T12870] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2381'. [ 484.777725][ T51] Bluetooth: hci2: unexpected event 0x09 length: 15 > 3 [ 485.798158][ T51] Bluetooth: hci3: command tx timeout [ 486.206716][T12888] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 486.232072][T12888] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 486.303161][T12756] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 486.383302][T12756] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 486.435007][T12756] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 486.597627][T12756] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 487.204024][T12913] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2392'. [ 487.790246][T12756] 8021q: adding VLAN 0 to HW filter on device bond0 [ 487.867934][ T51] Bluetooth: hci3: command tx timeout [ 487.891859][T12923] netlink: 188 bytes leftover after parsing attributes in process `syz.3.2395'. [ 488.311183][T12756] 8021q: adding VLAN 0 to HW filter on device team0 [ 488.410033][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 488.417304][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 488.728564][T12927] syzkaller0: entered promiscuous mode [ 488.742194][ T3480] bridge0: port 2(bridge_slave_1) entered blocking state [ 488.749531][ T3480] bridge0: port 2(bridge_slave_1) entered forwarding state [ 491.693559][T12756] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 491.814293][T12974] FAULT_INJECTION: forcing a failure. [ 491.814293][T12974] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 491.888354][T12974] CPU: 0 PID: 12974 Comm: syz.2.2405 Not tainted syzkaller #0 [ 491.895941][T12974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 491.906080][T12974] Call Trace: [ 491.909436][T12974] [ 491.912457][T12974] dump_stack_lvl+0x18c/0x250 [ 491.917244][T12974] ? show_regs_print_info+0x20/0x20 [ 491.922553][T12974] ? load_image+0x400/0x400 [ 491.927179][T12974] ? __might_fault+0xaa/0x120 [ 491.931970][T12974] ? __lock_acquire+0x7d40/0x7d40 [ 491.937108][T12974] should_fail_ex+0x39d/0x4d0 [ 491.941904][T12974] _copy_from_user+0x2f/0xe0 [ 491.946593][T12974] ___sys_sendmsg+0x1c7/0x360 [ 491.951385][T12974] ? __sys_sendmsg+0x2a0/0x2a0 [ 491.956314][T12974] ? __lock_acquire+0x7d40/0x7d40 [ 491.961541][T12974] __se_sys_sendmsg+0x1c2/0x2b0 [ 491.966483][T12974] ? __x64_sys_sendmsg+0x80/0x80 [ 491.971567][T12974] ? lockdep_hardirqs_on+0x98/0x150 [ 491.976871][T12974] do_syscall_64+0x55/0xa0 [ 491.981378][T12974] ? clear_bhb_loop+0x40/0x90 [ 491.986133][T12974] ? clear_bhb_loop+0x40/0x90 [ 491.990901][T12974] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 491.996878][T12974] RIP: 0033:0x7f44a9f9c799 [ 492.001403][T12974] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.021612][T12974] RSP: 002b:00007f44aae85028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.030128][T12974] RAX: ffffffffffffffda RBX: 00007f44aa215fa0 RCX: 00007f44a9f9c799 [ 492.038275][T12974] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 492.046417][T12974] RBP: 00007f44aae85090 R08: 0000000000000000 R09: 0000000000000000 [ 492.054484][T12974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.062531][T12974] R13: 00007f44aa216038 R14: 00007f44aa215fa0 R15: 00007ffce07a4818 [ 492.071350][T12974] [ 493.021085][T12989] mac80211_hwsim hwsim64 wlan0: entered promiscuous mode [ 493.038837][T12989] mac80211_hwsim hwsim64 wlan0: entered allmulticast mode [ 493.338000][T13006] syzkaller0: entered promiscuous mode [ 493.368090][T13006] syzkaller0: entered allmulticast mode [ 493.754803][T12756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 496.082256][T13027] netlink: 'syz.3.2414': attribute type 10 has an invalid length. [ 496.090286][T13027] netlink: 2 bytes leftover after parsing attributes in process `syz.3.2414'. [ 496.313068][T13036] netlink: 'syz.3.2416': attribute type 3 has an invalid length. [ 496.322684][T13036] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.2416'. [ 496.497178][T12756] veth0_vlan: entered promiscuous mode [ 496.626773][T13043] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2417'. [ 496.781129][T12756] veth1_vlan: entered promiscuous mode [ 496.917964][ T12] hsr_slave_0: left promiscuous mode [ 496.960150][ T12] hsr_slave_1: left promiscuous mode [ 496.976518][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 496.989166][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 497.018894][ T12] veth0_macvtap: left promiscuous mode [ 497.828974][ T12] .` (unregistering): (slave batadv_slave_0): Releasing backup interface [ 497.845389][ T12] batadv_slave_0 (unregistering): left promiscuous mode [ 497.935952][ T12] ` (unregistering): Port device team_slave_1 removed [ 497.995682][ T12] ` (unregistering): Port device team_slave_0 removed [ 498.049731][ T12] .` (unregistering): (slave bond_slave_1): Releasing backup interface [ 498.061076][ T12] bond_slave_1 (unregistering): left promiscuous mode [ 498.111921][ T12] .` (unregistering): (slave bond_slave_0): Releasing backup interface [ 498.121250][ T12] bond_slave_0 (unregistering): left promiscuous mode [ 498.171470][ T12] .` (unregistering): (slave bridge_slave_1): Releasing backup interface [ 498.181121][ T12] bridge_slave_1 (unregistering): left promiscuous mode [ 498.529588][ T12] .` (unregistering): Released all slaves [ 498.712628][T12756] veth0_macvtap: entered promiscuous mode [ 498.735478][T12756] veth1_macvtap: entered promiscuous mode [ 498.866846][ T51] Bluetooth: hci0: unexpected event 0x09 length: 15 > 3 [ 498.910255][T12756] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 498.937846][T12756] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 498.950606][T12756] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 498.961709][T12756] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 498.972597][T12756] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 498.983905][T12756] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 499.012420][T12756] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 499.040330][T12756] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 499.068667][T12756] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 499.083568][T12756] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 499.096432][T12756] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.107321][T12756] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.117056][T12756] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.126566][T12756] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.392365][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.437651][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 499.553916][T13081] netlink: 'syz.2.2423': attribute type 10 has an invalid length. [ 499.565088][T13081] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2423'. [ 499.581416][T13081] batadv_slave_1: entered promiscuous mode [ 499.588355][T13081] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 499.596017][T13081] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 499.638429][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 499.660967][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 499.672397][T13085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2425'. [ 499.944522][T13092] FAULT_INJECTION: forcing a failure. [ 499.944522][T13092] name failslab, interval 1, probability 0, space 0, times 0 [ 500.001547][T13092] CPU: 1 PID: 13092 Comm: syz.2.2426 Not tainted syzkaller #0 [ 500.009135][T13092] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 500.019243][T13092] Call Trace: [ 500.022593][T13092] [ 500.025572][T13092] dump_stack_lvl+0x18c/0x250 [ 500.030322][T13092] ? show_regs_print_info+0x20/0x20 [ 500.035580][T13092] ? load_image+0x400/0x400 [ 500.040147][T13092] ? __might_sleep+0xe0/0xe0 [ 500.044808][T13092] ? __lock_acquire+0x7d40/0x7d40 [ 500.049889][T13092] should_fail_ex+0x39d/0x4d0 [ 500.054638][T13092] should_failslab+0x9/0x20 [ 500.059293][T13092] slab_pre_alloc_hook+0x59/0x310 [ 500.064370][T13092] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 500.070139][T13092] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 500.075925][T13092] __kmem_cache_alloc_node+0x53/0x250 [ 500.081375][T13092] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 500.087239][T13092] __kmalloc+0xa4/0x230 [ 500.091460][T13092] tomoyo_realpath_from_path+0xe3/0x5d0 [ 500.097074][T13092] tomoyo_path_number_perm+0x248/0x620 [ 500.102593][T13092] ? tomoyo_path_number_perm+0x217/0x620 [ 500.108289][T13092] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 500.113815][T13092] ? ksys_write+0x1c4/0x260 [ 500.118393][T13092] ? __fget_files+0x28/0x4b0 [ 500.123029][T13092] ? __fget_files+0x28/0x4b0 [ 500.127665][T13092] security_file_ioctl+0x70/0xa0 [ 500.132638][T13092] __se_sys_ioctl+0x48/0x170 [ 500.137260][T13092] do_syscall_64+0x55/0xa0 [ 500.141717][T13092] ? clear_bhb_loop+0x40/0x90 [ 500.146428][T13092] ? clear_bhb_loop+0x40/0x90 [ 500.151143][T13092] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 500.157076][T13092] RIP: 0033:0x7f44a9f9c799 [ 500.161524][T13092] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.181289][T13092] RSP: 002b:00007f44aae64028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 500.189831][T13092] RAX: ffffffffffffffda RBX: 00007f44aa216090 RCX: 00007f44a9f9c799 [ 500.197837][T13092] RDX: 0000200000000180 RSI: 00000000c008744c RDI: 0000000000000004 [ 500.205843][T13092] RBP: 00007f44aae64090 R08: 0000000000000000 R09: 0000000000000000 [ 500.213842][T13092] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.221842][T13092] R13: 00007f44aa216128 R14: 00007f44aa216090 R15: 00007ffce07a4818 [ 500.229879][T13092] [ 500.387567][T13092] ERROR: Out of memory at tomoyo_realpath_from_path. [ 501.303178][T13098] delete_channel: no stack [ 501.974254][ T5780] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 501.984401][ T5780] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 501.993559][ T5780] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 502.002531][ T5780] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 502.012451][ T5780] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 502.020805][ T5780] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 502.187808][ T49] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.298663][T13116] netlink: 'syz.0.2434': attribute type 10 has an invalid length. [ 502.317255][T13116] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2434'. [ 502.326336][T13116] batadv_slave_1: entered promiscuous mode [ 502.337111][T13116] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 502.350537][T13116] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 502.535146][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.541699][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.614981][ T49] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.715566][ T49] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.930639][ T49] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.125725][T13111] chnl_net:caif_netlink_parms(): no params data found [ 503.408564][T13111] bridge0: port 1(bridge_slave_0) entered blocking state [ 503.419541][T13111] bridge0: port 1(bridge_slave_0) entered disabled state [ 503.427021][T13111] bridge_slave_0: entered allmulticast mode [ 503.435349][T13111] bridge_slave_0: entered promiscuous mode [ 503.470938][T13111] bridge0: port 2(bridge_slave_1) entered blocking state [ 503.484088][T13111] bridge0: port 2(bridge_slave_1) entered disabled state [ 503.498770][T13111] bridge_slave_1: entered allmulticast mode [ 503.511530][T13111] bridge_slave_1: entered promiscuous mode [ 503.649900][T13111] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 503.694430][T13111] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 504.115875][ T51] Bluetooth: hci0: command tx timeout [ 505.051424][T13111] team0: Port device team_slave_0 added [ 505.433636][T13111] team0: Port device team_slave_1 added [ 505.453982][T13162] netlink: 'syz.0.2442': attribute type 10 has an invalid length. [ 505.478530][T13162] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2442'. [ 505.702161][T13111] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 505.718083][T13111] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 505.752138][T13111] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 505.771406][ T51] Bluetooth: hci3: unexpected event 0x09 length: 15 > 3 [ 505.776945][T13167] netlink: 'syz.1.2445': attribute type 6 has an invalid length. [ 505.923830][T13111] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 505.931788][T13111] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 506.030163][T13111] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 506.197807][ T51] Bluetooth: hci0: command tx timeout [ 506.569067][T13111] hsr_slave_0: entered promiscuous mode [ 506.585469][T13111] hsr_slave_1: entered promiscuous mode [ 507.374739][T13203] netlink: 'syz.1.2453': attribute type 10 has an invalid length. [ 507.425190][T13203] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2453'. [ 507.706232][T13214] FAULT_INJECTION: forcing a failure. [ 507.706232][T13214] name failslab, interval 1, probability 0, space 0, times 0 [ 507.748400][T13214] CPU: 1 PID: 13214 Comm: syz.1.2456 Not tainted syzkaller #0 [ 507.755967][T13214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 507.766077][T13214] Call Trace: [ 507.769416][T13214] [ 507.772391][T13214] dump_stack_lvl+0x18c/0x250 [ 507.777135][T13214] ? show_regs_print_info+0x20/0x20 [ 507.782413][T13214] ? load_image+0x400/0x400 [ 507.786977][T13214] ? __lock_acquire+0x7d40/0x7d40 [ 507.792044][T13214] should_fail_ex+0x39d/0x4d0 [ 507.796778][T13214] should_failslab+0x9/0x20 [ 507.801330][T13214] slab_pre_alloc_hook+0x59/0x310 [ 507.806405][T13214] ? __lock_acquire+0x7d40/0x7d40 [ 507.811474][T13214] ? bpf_test_init+0x9f/0x140 [ 507.816183][T13214] ? bpf_test_init+0x9f/0x140 [ 507.820911][T13214] __kmem_cache_alloc_node+0x53/0x250 [ 507.826331][T13214] ? bpf_test_init+0x9f/0x140 [ 507.831066][T13214] __kmalloc+0xa4/0x230 [ 507.835281][T13214] bpf_test_init+0x9f/0x140 [ 507.839825][T13214] bpf_prog_test_run_xdp+0x4d1/0x10e0 [ 507.845327][T13214] ? dev_put+0x80/0x80 [ 507.849437][T13214] ? dev_put+0x80/0x80 [ 507.853535][T13214] bpf_prog_test_run+0x321/0x390 [ 507.858510][T13214] __sys_bpf+0x49d/0x890 [ 507.862790][T13214] ? bpf_link_show_fdinfo+0x390/0x390 [ 507.868202][T13214] ? lock_chain_count+0x20/0x20 [ 507.873088][T13214] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 507.879110][T13214] __x64_sys_bpf+0x7c/0x90 [ 507.883558][T13214] do_syscall_64+0x55/0xa0 [ 507.888063][T13214] ? clear_bhb_loop+0x40/0x90 [ 507.892786][T13214] ? clear_bhb_loop+0x40/0x90 [ 507.897505][T13214] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 507.903449][T13214] RIP: 0033:0x7fc13299c799 [ 507.907892][T13214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 507.927556][T13214] RSP: 002b:00007fc1338ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 507.936010][T13214] RAX: ffffffffffffffda RBX: 00007fc132c15fa0 RCX: 00007fc13299c799 [ 507.944012][T13214] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 507.952007][T13214] RBP: 00007fc1338ef090 R08: 0000000000000000 R09: 0000000000000000 [ 507.960001][T13214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 507.968001][T13214] R13: 00007fc132c16038 R14: 00007fc132c15fa0 R15: 00007ffda16d7338 [ 507.976012][T13214] [ 508.267683][ T51] Bluetooth: hci0: command tx timeout [ 508.420985][T13217] syzkaller0: entered promiscuous mode [ 508.426598][T13217] syzkaller0: entered allmulticast mode [ 510.354564][ T51] Bluetooth: hci0: command tx timeout [ 511.046104][T13232] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2462'. [ 511.306580][T13240] netlink: 'syz.0.2465': attribute type 6 has an invalid length. [ 511.363255][T13243] netlink: 'syz.2.2463': attribute type 10 has an invalid length. [ 511.408887][T13244] FAULT_INJECTION: forcing a failure. [ 511.408887][T13244] name failslab, interval 1, probability 0, space 0, times 0 [ 511.424808][T13244] CPU: 0 PID: 13244 Comm: syz.1.2464 Not tainted syzkaller #0 [ 511.428163][T13243] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2463'. [ 511.432321][T13244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 511.432338][T13244] Call Trace: [ 511.454720][T13244] [ 511.457700][T13244] dump_stack_lvl+0x18c/0x250 [ 511.462438][T13244] ? show_regs_print_info+0x20/0x20 [ 511.467699][T13244] ? load_image+0x400/0x400 [ 511.472265][T13244] ? __might_sleep+0xe0/0xe0 [ 511.477008][T13244] ? __lock_acquire+0x7d40/0x7d40 [ 511.482126][T13244] should_fail_ex+0x39d/0x4d0 [ 511.486869][T13244] should_failslab+0x9/0x20 [ 511.491436][T13244] slab_pre_alloc_hook+0x59/0x310 [ 511.496518][T13244] kmem_cache_alloc_node+0x60/0x320 [ 511.501849][T13244] ? __alloc_skb+0x103/0x2c0 [ 511.506517][T13244] __alloc_skb+0x103/0x2c0 [ 511.511022][T13244] netlink_sendmsg+0x66a/0xbf0 [ 511.515855][T13244] ? lockdep_hardirqs_on+0x98/0x150 [ 511.521118][T13244] ? netlink_getsockopt+0x590/0x590 [ 511.526386][T13244] ? security_socket_sendmsg+0x37/0xa0 [ 511.532069][T13244] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 511.537390][T13244] ? security_socket_sendmsg+0x80/0xa0 [ 511.542882][T13244] ? netlink_getsockopt+0x590/0x590 [ 511.548120][T13244] ____sys_sendmsg+0x5ba/0x960 [ 511.552942][T13244] ? __asan_memset+0x22/0x40 [ 511.557664][T13244] ? __sys_sendmsg_sock+0x30/0x30 [ 511.562742][T13244] ? __import_iovec+0x5f2/0x850 [ 511.567723][T13244] ? import_iovec+0x73/0xa0 [ 511.572277][T13244] ___sys_sendmsg+0x2a6/0x360 [ 511.577091][T13244] ? __sys_sendmsg+0x2a0/0x2a0 [ 511.581930][T13244] __se_sys_sendmsg+0x1c2/0x2b0 [ 511.586824][T13244] ? __x64_sys_sendmsg+0x80/0x80 [ 511.591885][T13244] ? syscall_enter_from_user_mode+0x2e/0x80 [ 511.597838][T13244] do_syscall_64+0x55/0xa0 [ 511.602290][T13244] ? clear_bhb_loop+0x40/0x90 [ 511.607000][T13244] ? clear_bhb_loop+0x40/0x90 [ 511.611733][T13244] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 511.617667][T13244] RIP: 0033:0x7fc13299c799 [ 511.622123][T13244] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 511.641779][T13244] RSP: 002b:00007fc1338ef028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 511.650228][T13244] RAX: ffffffffffffffda RBX: 00007fc132c15fa0 RCX: 00007fc13299c799 [ 511.658234][T13244] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 511.666338][T13244] RBP: 00007fc1338ef090 R08: 0000000000000000 R09: 0000000000000000 [ 511.674337][T13244] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.682336][T13244] R13: 00007fc132c16038 R14: 00007fc132c15fa0 R15: 00007ffda16d7338 [ 511.690358][T13244] [ 511.786820][T13111] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 511.857620][T13111] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 511.891953][T13111] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 511.950450][T13246] netlink: 'syz.0.2466': attribute type 33 has an invalid length. [ 511.967706][T13246] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.2466'. [ 512.076779][T13111] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 512.376575][T13263] netlink: 'syz.2.2471': attribute type 6 has an invalid length. [ 512.564216][T13265] FAULT_INJECTION: forcing a failure. [ 512.564216][T13265] name failslab, interval 1, probability 0, space 0, times 0 [ 512.623358][T13265] CPU: 0 PID: 13265 Comm: syz.0.2472 Not tainted syzkaller #0 [ 512.630926][T13265] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 512.641051][T13265] Call Trace: [ 512.644388][T13265] [ 512.647362][T13265] dump_stack_lvl+0x18c/0x250 [ 512.652182][T13265] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 512.658383][T13265] ? show_regs_print_info+0x20/0x20 [ 512.663630][T13265] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 512.669835][T13265] should_fail_ex+0x39d/0x4d0 [ 512.674554][T13265] should_failslab+0x9/0x20 [ 512.679099][T13265] slab_pre_alloc_hook+0x59/0x310 [ 512.684166][T13265] ? sctp_add_bind_addr+0x8c/0x360 [ 512.689311][T13265] __kmem_cache_alloc_node+0x53/0x250 [ 512.694723][T13265] ? sctp_add_bind_addr+0x8c/0x360 [ 512.699873][T13265] kmalloc_trace+0x2a/0xe0 [ 512.704335][T13265] sctp_add_bind_addr+0x8c/0x360 [ 512.709320][T13265] sctp_copy_local_addr_list+0x315/0x4f0 [ 512.715088][T13265] ? sctp_copy_local_addr_list+0xa5/0x4f0 [ 512.720848][T13265] ? sctp_do_8_2_transport_strike+0x8a0/0x8a0 [ 512.726965][T13265] ? sctp_v4_is_any+0x35/0x60 [ 512.731674][T13265] ? sctp_copy_one_addr+0x8c/0x350 [ 512.736830][T13265] sctp_bind_addr_copy+0xb3/0x3c0 [ 512.741896][T13265] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 512.748267][T13265] sctp_connect_new_asoc+0x2f9/0x6a0 [ 512.753592][T13265] ? __sctp_connect+0xd80/0xd80 [ 512.758479][T13265] ? __local_bh_enable_ip+0x13a/0x1c0 [ 512.763900][T13265] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 512.769482][T13265] ? security_sctp_bind_connect+0x89/0xb0 [ 512.775237][T13265] sctp_sendmsg+0x1575/0x28c0 [ 512.779978][T13265] ? sctp_getsockopt+0xb60/0xb60 [ 512.784962][T13265] ? aa_sk_perm+0x83c/0x970 [ 512.789508][T13265] ? aa_af_perm+0x330/0x330 [ 512.794044][T13265] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 512.800497][T13265] ? sock_rps_record_flow+0x19/0x3f0 [ 512.805909][T13265] ? inet_sendmsg+0xe9/0x2f0 [ 512.810535][T13265] ? inet_send_prepare+0x260/0x260 [ 512.815679][T13265] ____sys_sendmsg+0x5ba/0x960 [ 512.820470][T13265] ? __lock_acquire+0x7d40/0x7d40 [ 512.825536][T13265] ? __asan_memset+0x22/0x40 [ 512.830164][T13265] ? __sys_sendmsg_sock+0x30/0x30 [ 512.835235][T13265] ? __import_iovec+0x5f2/0x850 [ 512.840129][T13265] ? import_iovec+0x73/0xa0 [ 512.844659][T13265] ___sys_sendmsg+0x2a6/0x360 [ 512.849366][T13265] ? get_pid_task+0x20/0x1e0 [ 512.853996][T13265] ? __sys_sendmsg+0x2a0/0x2a0 [ 512.858855][T13265] ? __lock_acquire+0x7d40/0x7d40 [ 512.863940][T13265] __se_sys_sendmsg+0x1c2/0x2b0 [ 512.868825][T13265] ? __x64_sys_sendmsg+0x80/0x80 [ 512.873808][T13265] ? lockdep_hardirqs_on+0x98/0x150 [ 512.879042][T13265] do_syscall_64+0x55/0xa0 [ 512.883494][T13265] ? clear_bhb_loop+0x40/0x90 [ 512.888210][T13265] ? clear_bhb_loop+0x40/0x90 [ 512.892921][T13265] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 512.898841][T13265] RIP: 0033:0x7fe3efb9c799 [ 512.903286][T13265] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.923009][T13265] RSP: 002b:00007fe3f0a76028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 512.931457][T13265] RAX: ffffffffffffffda RBX: 00007fe3efe15fa0 RCX: 00007fe3efb9c799 [ 512.939459][T13265] RDX: 00000000000003e8 RSI: 00002000000004c0 RDI: 0000000000000039 [ 512.947490][T13265] RBP: 00007fe3f0a76090 R08: 0000000000000000 R09: 0000000000000000 [ 512.955504][T13265] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 512.963508][T13265] R13: 00007fe3efe16038 R14: 00007fe3efe15fa0 R15: 00007fffcf4e1e48 [ 512.971528][T13265] [ 513.327090][T13111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 513.432856][T13111] 8021q: adding VLAN 0 to HW filter on device team0 [ 513.546158][T12998] bridge0: port 1(bridge_slave_0) entered blocking state [ 513.553403][T12998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 513.668581][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 513.675824][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 514.420558][T13305] netlink: 'syz.2.2475': attribute type 6 has an invalid length. [ 514.564938][T13111] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 514.875132][T13323] netlink: 'syz.0.2478': attribute type 6 has an invalid length. [ 514.951953][T13111] veth0_vlan: entered promiscuous mode [ 515.254167][T13330] netlink: 'syz.0.2482': attribute type 6 has an invalid length. [ 515.305830][T13111] veth1_vlan: entered promiscuous mode [ 516.168961][T13111] veth0_macvtap: entered promiscuous mode [ 516.198648][T13111] veth1_macvtap: entered promiscuous mode [ 516.385599][T13111] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 516.413807][T13111] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 516.433015][T13111] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 516.445351][T13111] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 516.461321][T13111] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 516.481793][T13111] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 516.509321][T13111] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 516.522047][T13111] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 516.554622][T13111] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 516.595500][T13111] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 516.632498][T13111] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.647577][T13111] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.656373][T13111] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 516.705746][T13111] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 517.077741][ T66] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 517.097398][ T66] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 517.196312][T13376] netlink: 'syz.1.2494': attribute type 6 has an invalid length. [ 517.306963][T13380] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2495'. [ 517.309130][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 517.336867][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 517.438617][ T49] hsr_slave_0: left promiscuous mode [ 517.472993][ T49] hsr_slave_1: left promiscuous mode [ 517.512898][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 517.577592][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 518.216836][ T5780] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 518.225664][ T5780] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 518.237859][ T5780] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 518.248281][ T5780] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 518.256363][ T5780] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 518.264611][ T5780] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 518.400146][ T49] bridge0: port 4(team0) entered disabled state [ 518.445142][ T49] hsr0: left allmulticast mode [ 518.453244][ T49] bridge0: port 3(hsr0) entered disabled state [ 518.466890][ T49] bridge_slave_0: left allmulticast mode [ 518.487988][ T49] bridge_slave_0: left promiscuous mode [ 518.493834][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 520.358014][ T5772] Bluetooth: hci4: command tx timeout [ 521.139242][ T49] geneve1 (unregistering): left promiscuous mode [ 521.145928][ T49] geneve1 (unregistering): left allmulticast mode [ 521.156143][ T49] team0 (unregistering): Port device geneve1 removed [ 521.440148][ T49] team_slave_1 (unregistering): left promiscuous mode [ 521.447070][ T49] team_slave_1 (unregistering): left allmulticast mode [ 521.456066][ T49] team0 (unregistering): Port device team_slave_1 removed [ 521.560504][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 521.617209][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 521.671329][ T49] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 522.062768][ T49] bond0 (unregistering): Released all slaves [ 522.430601][ T5772] Bluetooth: hci4: command tx timeout [ 522.573002][T13394] chnl_net:caif_netlink_parms(): no params data found [ 523.137830][T13394] bridge0: port 1(bridge_slave_0) entered blocking state [ 523.157682][T13394] bridge0: port 1(bridge_slave_0) entered disabled state [ 523.171220][T13394] bridge_slave_0: entered allmulticast mode [ 523.197130][T13394] bridge_slave_0: entered promiscuous mode [ 523.224267][T13394] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.247516][T13394] bridge0: port 2(bridge_slave_1) entered disabled state [ 523.267408][T13394] bridge_slave_1: entered allmulticast mode [ 523.292961][T13394] bridge_slave_1: entered promiscuous mode [ 523.481555][T13394] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 523.536425][T13394] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 523.645731][T13394] team0: Port device team_slave_0 added [ 523.685835][T13394] team0: Port device team_slave_1 added [ 523.777745][T13394] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 523.795018][T13394] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 523.847495][T13394] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 523.871019][T13394] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 523.896889][T13394] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 523.953701][T13394] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 524.079124][T13394] hsr_slave_0: entered promiscuous mode [ 524.098322][T13394] hsr_slave_1: entered promiscuous mode [ 524.117634][T13394] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 524.125344][T13394] Cannot create hsr debugfs directory [ 524.507855][ T5772] Bluetooth: hci4: command tx timeout [ 525.810924][T13394] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 525.845838][T13394] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 525.874650][T13394] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 525.895677][T13394] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 526.095805][T13394] 8021q: adding VLAN 0 to HW filter on device bond0 [ 526.165145][T13394] 8021q: adding VLAN 0 to HW filter on device team0 [ 526.209231][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 526.216498][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 526.308397][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 526.315689][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 526.589328][ T5772] Bluetooth: hci4: command tx timeout [ 526.706919][T13486] FAULT_INJECTION: forcing a failure. [ 526.706919][T13486] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 526.722623][T13486] CPU: 1 PID: 13486 Comm: syz.3.2531 Not tainted syzkaller #0 [ 526.730150][T13486] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 526.740244][T13486] Call Trace: [ 526.743566][T13486] [ 526.746538][T13486] dump_stack_lvl+0x18c/0x250 [ 526.751268][T13486] ? show_regs_print_info+0x20/0x20 [ 526.756518][T13486] ? load_image+0x400/0x400 [ 526.761078][T13486] ? __lock_acquire+0x7d40/0x7d40 [ 526.766148][T13486] ? snprintf+0xe9/0x140 [ 526.770435][T13486] should_fail_ex+0x39d/0x4d0 [ 526.775161][T13486] _copy_to_user+0x2f/0xa0 [ 526.779612][T13486] simple_read_from_buffer+0xe7/0x150 [ 526.785036][T13486] proc_fail_nth_read+0x1e8/0x260 [ 526.790115][T13486] ? proc_fault_inject_write+0x360/0x360 [ 526.795806][T13486] ? fsnotify_perm+0x271/0x5e0 [ 526.800622][T13486] ? proc_fault_inject_write+0x360/0x360 [ 526.806392][T13486] vfs_read+0x28b/0x970 [ 526.810603][T13486] ? kernel_read+0x1e0/0x1e0 [ 526.815226][T13486] ? __fget_files+0x28/0x4b0 [ 526.819852][T13486] ? __fget_files+0x28/0x4b0 [ 526.824484][T13486] ? __fget_files+0x43d/0x4b0 [ 526.829211][T13486] ? __fdget_pos+0x2a3/0x330 [ 526.833844][T13486] ? ksys_read+0x75/0x260 [ 526.838222][T13486] ksys_read+0x150/0x260 [ 526.842568][T13486] ? vfs_write+0x990/0x990 [ 526.847041][T13486] do_syscall_64+0x55/0xa0 [ 526.851509][T13486] ? clear_bhb_loop+0x40/0x90 [ 526.856320][T13486] ? clear_bhb_loop+0x40/0x90 [ 526.861042][T13486] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 526.866976][T13486] RIP: 0033:0x7f2c6595cfce [ 526.871440][T13486] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 526.891106][T13486] RSP: 002b:00007f2c6683cfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 526.899576][T13486] RAX: ffffffffffffffda RBX: 00007f2c6683d6c0 RCX: 00007f2c6595cfce [ 526.907594][T13486] RDX: 000000000000000f RSI: 00007f2c6683d0a0 RDI: 0000000000000005 [ 526.915612][T13486] RBP: 00007f2c6683d090 R08: 0000000000000000 R09: 0000000000000000 [ 526.923803][T13486] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 526.931878][T13486] R13: 00007f2c65c16038 R14: 00007f2c65c15fa0 R15: 00007fffab6e34b8 [ 526.939915][T13486] [ 527.126623][T13490] netlink: 'syz.0.2532': attribute type 10 has an invalid length. [ 527.159137][T13490] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2532'. [ 527.180410][T13490] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 527.202259][T13490] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 527.272586][T13394] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 527.459194][T13394] veth0_vlan: entered promiscuous mode [ 527.515695][T13394] veth1_vlan: entered promiscuous mode [ 527.600895][T13394] veth0_macvtap: entered promiscuous mode [ 527.622654][T13394] veth1_macvtap: entered promiscuous mode [ 527.666462][T13394] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.679716][T13394] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.696689][T13394] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.710733][T13394] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.724091][T13394] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.734849][T13394] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.744788][T13394] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 527.756461][T13394] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.769930][T13394] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 527.782151][T13506] netlink: 'syz.0.2539': attribute type 6 has an invalid length. [ 527.799344][T13394] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 527.815715][T13394] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 527.834866][T13394] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 527.863220][T13394] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.875411][T13394] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.886022][T13394] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.896529][T13394] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.925306][T13508] mac80211_hwsim hwsim125 wlan0: entered allmulticast mode [ 527.963174][T13509] mac80211_hwsim hwsim125 wlan0: entered promiscuous mode [ 528.147078][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 528.189011][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 528.291069][T13511] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2541'. [ 528.330405][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 528.338663][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 528.589079][T13520] netlink: 'syz.1.2498': attribute type 10 has an invalid length. [ 528.812535][T13520] team0 (unregistering): Port device team_slave_0 removed [ 528.853824][T13520] team0 (unregistering): Port device team_slave_1 removed [ 528.953902][T13528] netlink: 'syz.3.2548': attribute type 6 has an invalid length. [ 529.345956][ T51] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 529.358565][ T51] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 529.374886][ T3503] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.385903][ T51] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 529.398608][ T51] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 529.414015][ T51] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 529.427863][ T51] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 529.602162][ T3503] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.701025][ T3503] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 529.866180][ T3503] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.023660][T13534] chnl_net:caif_netlink_parms(): no params data found [ 530.149307][T13561] netlink: 'syz.0.2557': attribute type 6 has an invalid length. [ 530.233405][T13534] bridge0: port 1(bridge_slave_0) entered blocking state [ 530.241159][T13534] bridge0: port 1(bridge_slave_0) entered disabled state [ 530.251184][T13534] bridge_slave_0: entered allmulticast mode [ 530.259190][T13534] bridge_slave_0: entered promiscuous mode [ 530.268903][T13534] bridge0: port 2(bridge_slave_1) entered blocking state [ 530.276265][T13534] bridge0: port 2(bridge_slave_1) entered disabled state [ 530.283851][T13534] bridge_slave_1: entered allmulticast mode [ 530.291785][T13534] bridge_slave_1: entered promiscuous mode [ 530.426998][T13534] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 530.443290][T13534] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 530.531787][T13534] team0: Port device team_slave_0 added [ 530.570307][T13534] team0: Port device team_slave_1 added [ 530.797420][T13534] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 530.806172][T13534] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 530.864898][T13534] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 530.955134][T13534] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 530.996295][T13534] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 531.083072][T13534] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 531.468426][ T51] Bluetooth: hci1: command tx timeout [ 533.548301][ T51] Bluetooth: hci1: command tx timeout [ 534.195740][T13595] netlink: 'syz.3.2566': attribute type 6 has an invalid length. [ 534.411230][ T3503] bridge0: port 4(erspan0) entered disabled state [ 534.484116][ T3503] erspan0 (unregistering): left allmulticast mode [ 534.499893][ T3503] erspan0 (unregistering): left promiscuous mode [ 534.520285][ T3503] bridge0: port 4(erspan0) entered disabled state [ 534.576019][T13534] hsr_slave_0: entered promiscuous mode [ 534.594172][T13534] hsr_slave_1: entered promiscuous mode [ 534.609149][T13534] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 534.617069][T13534] Cannot create hsr debugfs directory [ 535.628209][ T51] Bluetooth: hci1: command tx timeout [ 535.956912][T13534] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 535.988106][T13534] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 536.055816][T13534] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 536.142246][T13534] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 536.161952][T13645] netlink: 'syz.1.2576': attribute type 6 has an invalid length. [ 536.683699][T13534] 8021q: adding VLAN 0 to HW filter on device bond0 [ 536.825300][T13534] 8021q: adding VLAN 0 to HW filter on device team0 [ 536.953846][T12998] bridge0: port 1(bridge_slave_0) entered blocking state [ 536.961219][T12998] bridge0: port 1(bridge_slave_0) entered forwarding state [ 536.998858][T12998] bridge0: port 2(bridge_slave_1) entered blocking state [ 537.006847][T12998] bridge0: port 2(bridge_slave_1) entered forwarding state [ 537.707704][ T51] Bluetooth: hci1: command tx timeout [ 537.809150][T13685] netlink: 'syz.1.2587': attribute type 6 has an invalid length. [ 539.036830][T13534] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 539.256740][ T51] Bluetooth: hci0: unexpected event 0x34 length: 15 > 6 [ 539.546168][T13534] veth0_vlan: entered promiscuous mode [ 539.613675][T13534] veth1_vlan: entered promiscuous mode [ 539.889359][T13727] net veth1_virt_wifi ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 540.004967][T13534] veth0_macvtap: entered promiscuous mode [ 540.064785][T13534] veth1_macvtap: entered promiscuous mode [ 540.251584][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 540.264014][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.294872][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 540.335357][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.356501][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 540.368126][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.378641][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 540.390749][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.401330][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 540.412520][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.438610][T13534] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 540.498905][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 540.533091][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.545432][T13534] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 540.571170][T13534] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 540.601343][T13534] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 540.662076][T13534] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.691634][T13534] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.700837][T13534] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.709713][T13534] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 540.752309][T13749] netlink: 'syz.1.2599': attribute type 6 has an invalid length. [ 541.234287][T13760] netlink: 'syz.0.2602': attribute type 10 has an invalid length. [ 541.264137][T13760] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2602'. [ 541.298442][T13758] netlink: 182876 bytes leftover after parsing attributes in process `syz.1.2601'. [ 541.357549][ T3503] hsr_slave_0: left promiscuous mode [ 544.156407][ T3503] hsr_slave_1: left promiscuous mode [ 544.203686][ T3503] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.213023][ T3503] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 544.241917][ T3503] batman_adv: batadv0: Interface deactivated: vlan1 [ 544.257368][ T3503] batman_adv: batadv0: Removing interface: vlan1 [ 544.265840][ T3503] hsr0: left allmulticast mode [ 544.276390][ T3503] bridge0: port 3(hsr0) entered disabled state [ 544.293408][ T3503] bridge_slave_0: left allmulticast mode [ 544.300149][ T3503] bridge_slave_0: left promiscuous mode [ 544.306093][ T3503] bridge0: port 1(bridge_slave_0) entered disabled state [ 544.337234][ T3503] veth1_macvtap: left promiscuous mode [ 544.343197][ T3503] veth0_macvtap: left promiscuous mode [ 544.351334][ T3503] veth1_vlan: left promiscuous mode [ 544.356971][ T3503] veth0_vlan: left promiscuous mode [ 544.569240][ T3503] team0 (unregistering): Port device geneve1 removed [ 545.178876][ T3503] team0 (unregistering): Port device team_slave_1 removed [ 545.280361][ T3503] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 545.337181][ T3503] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 545.396281][ T3503] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 545.754859][ T3503] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 545.765481][ T3503] bond0 (unregistering): (slave bridge0): last VLAN challenged slave left bond - VLAN blocking is removed [ 545.777228][ T3503] bond0 (unregistering): Released all slaves [ 545.905624][T13760] netlink: 'syz.0.2602': attribute type 10 has an invalid length. [ 545.905631][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 545.905653][T13760] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2602'. [ 545.918033][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 545.970363][T13758] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 546.204322][ T66] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 546.253129][ T66] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 546.494389][T13782] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2546'. [ 549.268433][T13796] netlink: 'syz.0.2609': attribute type 6 has an invalid length. [ 550.575444][T13840] netlink: 'syz.0.2622': attribute type 6 has an invalid length. [ 550.720430][T13824] netlink: 'syz.3.2617': attribute type 4 has an invalid length. [ 550.776128][T13824] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2617'. [ 551.205445][T13824] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 551.869588][T13870] netlink: 'syz.0.2633': attribute type 6 has an invalid length. [ 551.936258][T13868] syzkaller0: entered promiscuous mode [ 552.010711][T13868] syzkaller0: entered allmulticast mode [ 552.442572][T13883] netlink: 'syz.1.2637': attribute type 10 has an invalid length. [ 552.570079][T13885] netlink: 'syz.2.2638': attribute type 10 has an invalid length. [ 552.771213][T13885] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 552.943364][T13885] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 552.990345][T13895] netlink: 'syz.3.2643': attribute type 6 has an invalid length. [ 553.209217][T13900] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2644'. [ 554.280398][T13927] netlink: 'syz.2.2655': attribute type 6 has an invalid length. [ 557.666011][T13947] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2661'. [ 557.684535][T13947] openvswitch: netlink: Flow key attribute not present in set flow. [ 557.804744][T13947] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2661'. [ 558.452622][T13960] netlink: 'syz.0.2665': attribute type 6 has an invalid length. [ 558.885842][T13968] netlink: 'syz.2.2668': attribute type 10 has an invalid length. [ 558.944166][T13977] FAULT_INJECTION: forcing a failure. [ 558.944166][T13977] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 558.985328][T13977] CPU: 0 PID: 13977 Comm: syz.3.2671 Not tainted syzkaller #0 [ 558.992974][T13977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 559.003181][T13977] Call Trace: [ 559.006500][T13977] [ 559.009489][T13977] dump_stack_lvl+0x18c/0x250 [ 559.014248][T13977] ? show_regs_print_info+0x20/0x20 [ 559.019526][T13977] ? load_image+0x400/0x400 [ 559.024095][T13977] ? __lock_acquire+0x7d40/0x7d40 [ 559.029222][T13977] should_fail_ex+0x39d/0x4d0 [ 559.033979][T13977] prepare_alloc_pages+0x1e2/0x5f0 [ 559.039172][T13977] __alloc_pages+0x134/0x460 [ 559.043825][T13977] ? zone_statistics+0x170/0x170 [ 559.048840][T13977] ? alloc_pages+0x4dc/0x740 [ 559.053492][T13977] ? do_raw_spin_unlock+0x121/0x230 [ 559.058771][T13977] __get_free_pages+0xc/0x30 [ 559.063413][T13977] kasan_populate_vmalloc_pte+0x35/0x100 [ 559.069122][T13977] __apply_to_page_range+0x860/0xdd0 [ 559.074498][T13977] ? kasan_populate_vmalloc+0x70/0x70 [ 559.080101][T13977] ? apply_to_page_range+0x50/0x50 [ 559.085292][T13977] ? do_raw_spin_unlock+0x121/0x230 [ 559.090566][T13977] alloc_vmap_area+0x1d0c/0x1e30 [ 559.095705][T13977] ? vm_map_ram+0xcb0/0xcb0 [ 559.100284][T13977] ? rcu_is_watching+0x15/0xb0 [ 559.105127][T13977] __get_vm_area_node+0x162/0x370 [ 559.110324][T13977] __vmalloc_node_range+0x36e/0x1330 [ 559.115676][T13977] ? sock_hash_alloc+0x261/0x4d0 [ 559.120713][T13977] ? free_vm_area+0x50/0x50 [ 559.125276][T13977] ? bpf_map_area_alloc+0x5e/0x110 [ 559.130460][T13977] ? rcu_is_watching+0x15/0xb0 [ 559.135291][T13977] ? bpf_map_area_alloc+0x5e/0x110 [ 559.140481][T13977] bpf_map_area_alloc+0xf1/0x110 [ 559.145490][T13977] ? sock_hash_alloc+0x261/0x4d0 [ 559.150492][T13977] sock_hash_alloc+0x261/0x4d0 [ 559.155372][T13977] map_create+0x877/0x12f0 [ 559.159843][T13977] ? bpf_lsm_bpf+0x9/0x10 [ 559.164237][T13977] __sys_bpf+0x651/0x890 [ 559.168539][T13977] ? bpf_link_show_fdinfo+0x390/0x390 [ 559.173985][T13977] ? lock_chain_count+0x20/0x20 [ 559.178907][T13977] __x64_sys_bpf+0x7c/0x90 [ 559.183385][T13977] do_syscall_64+0x55/0xa0 [ 559.187869][T13977] ? clear_bhb_loop+0x40/0x90 [ 559.192612][T13977] ? clear_bhb_loop+0x40/0x90 [ 559.197348][T13977] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 559.203301][T13977] RIP: 0033:0x7f2c6599c799 [ 559.207763][T13977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 559.227431][T13977] RSP: 002b:00007f2c6683d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 559.235900][T13977] RAX: ffffffffffffffda RBX: 00007f2c65c15fa0 RCX: 00007f2c6599c799 [ 559.243947][T13977] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 0000000000000000 [ 559.251980][T13977] RBP: 00007f2c6683d090 R08: 0000000000000000 R09: 0000000000000000 [ 559.260017][T13977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 559.268049][T13977] R13: 00007f2c65c16038 R14: 00007f2c65c15fa0 R15: 00007fffab6e34b8 [ 559.276127][T13977] [ 559.280144][T13968] team0: Port device geneve1 added [ 559.349314][T13968] syz.2.2668 (13968) used greatest stack depth: 17704 bytes left [ 559.371096][T13981] netlink: 'syz.0.2672': attribute type 33 has an invalid length. [ 559.388352][T13981] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2672'. [ 559.582240][T13986] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2675'. [ 559.597633][T13986] batadv_slave_1: entered promiscuous mode [ 559.807838][T13994] netlink: 'syz.1.2678': attribute type 6 has an invalid length. [ 559.820352][T13991] netlink: 135856 bytes leftover after parsing attributes in process `syz.2.2677'. [ 559.846852][T13991] netlink: 8442 bytes leftover after parsing attributes in process `syz.2.2677'. [ 560.762945][T14026] netlink: 'syz.2.2691': attribute type 6 has an invalid length. [ 560.843767][T14023] netlink: 180 bytes leftover after parsing attributes in process `syz.0.2690'. [ 561.206981][T14031] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2693'. [ 562.222324][T14053] netlink: 'syz.1.2703': attribute type 6 has an invalid length. [ 563.149947][T14076] netlink: 'syz.3.2713': attribute type 6 has an invalid length. [ 563.713979][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.720870][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 564.556079][T14113] netlink: 'syz.3.2725': attribute type 33 has an invalid length. [ 564.564493][T14113] netlink: 164 bytes leftover after parsing attributes in process `syz.3.2725'. [ 564.755101][T14115] netlink: 'syz.1.2726': attribute type 3 has an invalid length. [ 564.763523][T14115] netlink: 'syz.1.2726': attribute type 1 has an invalid length. [ 564.772316][T14115] netlink: 181400 bytes leftover after parsing attributes in process `syz.1.2726'. [ 567.725523][T14126] netlink: 10 bytes leftover after parsing attributes in process `syz.1.2729'. [ 567.919229][T14134] pim6reg1: tun_chr_ioctl cmd 1074025677 [ 567.943700][T14134] pim6reg1: linktype set to 774 [ 568.353988][T14143] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2736'. [ 568.368005][T14143] openvswitch: netlink: Flow key attribute not present in set flow. [ 568.446780][T14143] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2736'. [ 568.623917][T14145] netlink: 'syz.3.2737': attribute type 6 has an invalid length. [ 569.710532][T14180] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2750'. [ 569.728030][T14181] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2750'. [ 569.752267][T14180] openvswitch: netlink: Flow key attribute not present in set flow. [ 569.782384][T14183] netlink: 'syz.1.2751': attribute type 6 has an invalid length. [ 570.960202][T14208] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2761'. [ 570.970173][T14208] openvswitch: netlink: Flow key attribute not present in set flow. [ 571.059242][T14208] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2761'. [ 571.371737][T14215] netlink: 'syz.0.2762': attribute type 6 has an invalid length. [ 572.698930][T14247] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2774'. [ 572.715776][T14247] openvswitch: netlink: Flow key attribute not present in set flow. [ 572.786312][T14250] netlink: 'syz.2.2775': attribute type 6 has an invalid length. [ 572.839750][T14247] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2774'. [ 574.133808][T14273] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2785'. [ 574.148435][T14276] netlink: 'syz.3.2784': attribute type 6 has an invalid length. [ 574.162226][T14273] openvswitch: netlink: Flow key attribute not present in set flow. [ 574.220523][T14278] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2785'. [ 574.941707][T14300] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2792'. [ 574.957636][T14300] openvswitch: netlink: Flow key attribute not present in set flow. [ 575.011552][T14300] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2792'. [ 575.967280][T14312] netlink: 'syz.3.2797': attribute type 6 has an invalid length. [ 576.111996][T14316] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2798'. [ 576.137668][T14316] openvswitch: netlink: Flow key attribute not present in set flow. [ 576.227963][T14316] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2798'. [ 576.721965][T14327] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2803'. [ 576.731913][T14327] openvswitch: netlink: Flow key attribute not present in set flow. [ 576.802425][T14327] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2803'. [ 579.824972][T14341] netlink: 'syz.2.2809': attribute type 6 has an invalid length. [ 580.499422][T14344] netlink: 'syz.1.2808': attribute type 10 has an invalid length. [ 580.630673][T14365] netlink: 144 bytes leftover after parsing attributes in process `syz.2.2815'. [ 580.776347][T14367] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2816'. [ 580.803540][T14371] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2816'. [ 580.813410][T14367] openvswitch: netlink: Flow key attribute not present in set flow. [ 580.984589][T14376] netlink: 'syz.2.2819': attribute type 6 has an invalid length. [ 581.383628][T14385] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2830'. [ 581.427646][T14385] openvswitch: netlink: Flow key attribute not present in set flow. [ 581.530302][T14389] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2830'. [ 582.363355][T14402] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2826'. [ 584.528046][T14407] netlink: 'syz.3.2831': attribute type 6 has an invalid length. [ 585.303482][T14412] netlink: 'syz.2.2829': attribute type 10 has an invalid length. [ 585.332580][T14412] team0: Device ipvlan1 failed to register rx_handler [ 585.458307][T14426] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2835'. [ 585.488390][T14426] openvswitch: netlink: Flow key attribute not present in set flow. [ 585.605771][T14428] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2835'. [ 585.932561][ T51] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4 [ 586.184986][T14445] netlink: 'syz.2.2841': attribute type 6 has an invalid length. [ 586.582756][T14455] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2846'. [ 586.661926][T14455] openvswitch: netlink: Flow key attribute not present in set flow. [ 586.812131][T14455] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2846'. [ 587.431618][T14459] netlink: 'syz.3.2848': attribute type 10 has an invalid length. [ 587.630744][T14459] team0: Device ipvlan1 failed to register rx_handler [ 587.948955][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 589.559150][ T5772] Bluetooth: hci4: unexpected event 0x08 length: 15 > 4 [ 590.458082][T14480] netlink: 'syz.2.2855': attribute type 6 has an invalid length. [ 590.688462][T14488] netlink: 'syz.1.2857': attribute type 10 has an invalid length. [ 590.717814][T14488] netlink: 55 bytes leftover after parsing attributes in process `syz.1.2857'. [ 590.909615][T14487] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2858'. [ 590.946127][T14487] openvswitch: netlink: Flow key attribute not present in set flow. [ 590.962030][T14492] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2858'. [ 591.616057][ T5772] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4 [ 591.632279][ T5772] Bluetooth: hci4: command 0x0406 tx timeout [ 592.162669][T14515] netlink: 'syz.2.2867': attribute type 6 has an invalid length. [ 593.513220][ T51] Bluetooth: hci4: unexpected event 0x08 length: 15 > 4 [ 595.824069][T14536] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2873'. [ 595.847211][T14536] openvswitch: netlink: Flow key attribute not present in set flow. [ 595.907377][T14536] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2873'. [ 595.978084][T14542] netlink: 'syz.0.2875': attribute type 10 has an invalid length. [ 596.017758][T14542] netlink: 55 bytes leftover after parsing attributes in process `syz.0.2875'. [ 597.035073][T14557] FAULT_INJECTION: forcing a failure. [ 597.035073][T14557] name failslab, interval 1, probability 0, space 0, times 0 [ 597.077863][T14557] CPU: 1 PID: 14557 Comm: syz.3.2879 Not tainted syzkaller #0 [ 597.085418][T14557] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 597.095565][T14557] Call Trace: [ 597.098899][T14557] [ 597.101881][T14557] dump_stack_lvl+0x18c/0x250 [ 597.106638][T14557] ? show_regs_print_info+0x20/0x20 [ 597.111908][T14557] ? load_image+0x400/0x400 [ 597.116481][T14557] ? __might_sleep+0xe0/0xe0 [ 597.121129][T14557] ? __lock_acquire+0x7d40/0x7d40 [ 597.126229][T14557] should_fail_ex+0x39d/0x4d0 [ 597.131000][T14557] should_failslab+0x9/0x20 [ 597.135576][T14557] slab_pre_alloc_hook+0x59/0x310 [ 597.140689][T14557] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.146468][T14557] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.152250][T14557] __kmem_cache_alloc_node+0x53/0x250 [ 597.157721][T14557] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.163516][T14557] __kmalloc+0xa4/0x230 [ 597.167747][T14557] tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.173372][T14557] tomoyo_path_number_perm+0x248/0x620 [ 597.178904][T14557] ? tomoyo_path_number_perm+0x217/0x620 [ 597.184619][T14557] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 597.190133][T14557] ? ksys_write+0x1c4/0x260 [ 597.194738][T14557] ? __fget_files+0x28/0x4b0 [ 597.199395][T14557] ? __fget_files+0x28/0x4b0 [ 597.204033][T14557] security_file_ioctl+0x70/0xa0 [ 597.209019][T14557] __se_sys_ioctl+0x48/0x170 [ 597.213929][T14557] do_syscall_64+0x55/0xa0 [ 597.218409][T14557] ? clear_bhb_loop+0x40/0x90 [ 597.223165][T14557] ? clear_bhb_loop+0x40/0x90 [ 597.227973][T14557] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 597.233909][T14557] RIP: 0033:0x7f2c6599c799 [ 597.238361][T14557] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 597.258096][T14557] RSP: 002b:00007f2c6683d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 597.266579][T14557] RAX: ffffffffffffffda RBX: 00007f2c65c15fa0 RCX: 00007f2c6599c799 [ 597.274722][T14557] RDX: 0000000000000000 RSI: 0000000000005411 RDI: 0000000000000005 [ 597.282758][T14557] RBP: 00007f2c6683d090 R08: 0000000000000000 R09: 0000000000000000 [ 597.290863][T14557] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 597.298902][T14557] R13: 00007f2c65c16038 R14: 00007f2c65c15fa0 R15: 00007fffab6e34b8 [ 597.306940][T14557] [ 597.328777][T14557] ERROR: Out of memory at tomoyo_realpath_from_path. [ 597.347330][ T51] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4 [ 597.686003][T14568] netlink: 'syz.2.2884': attribute type 6 has an invalid length. [ 597.805345][T14571] FAULT_INJECTION: forcing a failure. [ 597.805345][T14571] name failslab, interval 1, probability 0, space 0, times 0 [ 597.844568][T14571] CPU: 0 PID: 14571 Comm: syz.0.2885 Not tainted syzkaller #0 [ 597.852134][T14571] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 597.862246][T14571] Call Trace: [ 597.865603][T14571] [ 597.868593][T14571] dump_stack_lvl+0x18c/0x250 [ 597.873340][T14571] ? show_regs_print_info+0x20/0x20 [ 597.878598][T14571] ? load_image+0x400/0x400 [ 597.883160][T14571] ? __might_sleep+0xe0/0xe0 [ 597.887827][T14571] ? __lock_acquire+0x7d40/0x7d40 [ 597.892910][T14571] should_fail_ex+0x39d/0x4d0 [ 597.897655][T14571] should_failslab+0x9/0x20 [ 597.902215][T14571] slab_pre_alloc_hook+0x59/0x310 [ 597.907298][T14571] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 597.913338][T14571] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.919206][T14571] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.925070][T14571] __kmem_cache_alloc_node+0x53/0x250 [ 597.930505][T14571] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.936280][T14571] __kmalloc+0xa4/0x230 [ 597.940505][T14571] tomoyo_realpath_from_path+0xe3/0x5d0 [ 597.946117][T14571] tomoyo_path_number_perm+0x248/0x620 [ 597.951640][T14571] ? tomoyo_path_number_perm+0x217/0x620 [ 597.957336][T14571] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 597.962860][T14571] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 597.968924][T14571] ? __fget_files+0x28/0x4b0 [ 597.973572][T14571] ? __fget_files+0x28/0x4b0 [ 597.978227][T14571] security_file_ioctl+0x70/0xa0 [ 597.983227][T14571] __se_sys_ioctl+0x48/0x170 [ 597.987888][T14571] do_syscall_64+0x55/0xa0 [ 597.992363][T14571] ? clear_bhb_loop+0x40/0x90 [ 597.997091][T14571] ? clear_bhb_loop+0x40/0x90 [ 598.001824][T14571] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 598.007859][T14571] RIP: 0033:0x7fe3efb9c799 [ 598.012321][T14571] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 598.031990][T14571] RSP: 002b:00007fe3f0a76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 598.040458][T14571] RAX: ffffffffffffffda RBX: 00007fe3efe15fa0 RCX: 00007fe3efb9c799 [ 598.048483][T14571] RDX: 0000200000000180 RSI: 0000000040047451 RDI: 0000000000000003 [ 598.056693][T14571] RBP: 00007fe3f0a76090 R08: 0000000000000000 R09: 0000000000000000 [ 598.064723][T14571] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 598.072747][T14571] R13: 00007fe3efe16038 R14: 00007fe3efe15fa0 R15: 00007fffcf4e1e48 [ 598.080794][T14571] [ 598.148034][T14571] ERROR: Out of memory at tomoyo_realpath_from_path. [ 598.376926][T14576] netlink: 'syz.1.2887': attribute type 11 has an invalid length. [ 598.497960][T14579] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2888'. [ 598.524443][T14579] openvswitch: netlink: Flow key attribute not present in set flow. [ 598.569326][T14580] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2888'. [ 599.076657][T14588] netlink: 'syz.2.2889': attribute type 10 has an invalid length. [ 599.208067][T14588] netlink: 55 bytes leftover after parsing attributes in process `syz.2.2889'. [ 600.989387][T14605] netlink: 'syz.3.2896': attribute type 6 has an invalid length. [ 601.594049][T14615] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2898'. [ 601.616771][T14615] openvswitch: netlink: Flow key attribute not present in set flow. [ 601.953025][T14616] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2898'. [ 602.648315][T14620] netlink: 156 bytes leftover after parsing attributes in process `syz.0.2900'. [ 602.718929][T14622] netlink: 'syz.0.2900': attribute type 29 has an invalid length. [ 602.967597][T14622] netlink: 'syz.0.2900': attribute type 29 has an invalid length. [ 603.007647][T14623] netlink: 'syz.0.2900': attribute type 29 has an invalid length. [ 603.770837][T14642] netlink: 'syz.1.2915': attribute type 6 has an invalid length. [ 606.245296][T14667] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2911'. [ 606.296189][T14658] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2911'. [ 606.322967][T14658] openvswitch: netlink: Flow key attribute not present in set flow. [ 606.829169][ T5772] Bluetooth: hci3: command 0x0406 tx timeout [ 606.898700][T14678] netlink: 'syz.3.2918': attribute type 6 has an invalid length. [ 608.154562][T14694] netlink: 'syz.3.2924': attribute type 10 has an invalid length. [ 608.206159][T14694] netlink: 55 bytes leftover after parsing attributes in process `syz.3.2924'. [ 611.061652][T14720] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2931'. [ 611.085885][T14717] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2931'. [ 611.120185][T14717] openvswitch: netlink: Flow key attribute not present in set flow. [ 611.541035][T14730] netlink: 'syz.1.2933': attribute type 6 has an invalid length. [ 612.300275][T14746] netlink: 'syz.2.2939': attribute type 10 has an invalid length. [ 612.319567][T14746] netlink: 55 bytes leftover after parsing attributes in process `syz.2.2939'. [ 612.338158][T14745] netlink: 'syz.0.2945': attribute type 6 has an invalid length. [ 613.969945][T14764] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2944'. [ 614.711952][T14761] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2944'. [ 615.786386][T14780] netlink: 'syz.2.2950': attribute type 6 has an invalid length. [ 616.367152][T14796] netlink: 209592 bytes leftover after parsing attributes in process `syz.2.2957'. [ 616.408881][T14792] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2955'. [ 616.426258][T14792] openvswitch: netlink: Flow key attribute not present in set flow. [ 616.517916][T14798] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2958'. [ 616.518310][T14792] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2955'. [ 616.550441][T14798] openvswitch: netlink: Flow key attribute not present in set flow. [ 617.104707][T14800] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2958'. [ 617.912138][T14818] netlink: 'syz.2.2965': attribute type 6 has an invalid length. [ 618.379403][T14831] netlink: 'syz.2.2969': attribute type 10 has an invalid length. [ 618.397925][T14831] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2969'. [ 618.581450][T14832] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2968'. [ 618.623529][T14833] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.2968'. [ 618.672834][T14832] openvswitch: netlink: Flow key attribute not present in set flow. [ 619.806761][T14853] netlink: 'syz.2.2978': attribute type 6 has an invalid length. [ 621.684611][T14874] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2985'. [ 621.724824][T14871] netlink: 'syz.0.2984': attribute type 10 has an invalid length. [ 621.744927][T14874] openvswitch: netlink: Flow key attribute not present in set flow. [ 621.944914][T14874] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2985'. [ 622.630422][T14884] netlink: 'syz.2.2989': attribute type 6 has an invalid length. [ 623.119308][T14897] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3000'. [ 623.157952][T14897] openvswitch: netlink: Flow key attribute not present in set flow. [ 623.209773][T14898] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.3000'. [ 624.574506][T14920] netlink: 'syz.2.3002': attribute type 6 has an invalid length. [ 625.167111][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 625.174829][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.542457][ T5772] Bluetooth: hci4: unexpected event 0x08 length: 15 > 4 [ 625.871884][ T5772] Bluetooth: hci4: unexpected event 0x07 length: 15 < 255 [ 626.368022][T14945] netlink: 'syz.2.3012': attribute type 6 has an invalid length. [ 626.874331][ T5772] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4 [ 627.230659][ T5772] Bluetooth: hci0: command 0x0406 tx timeout [ 627.546651][T14960] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.3017'. [ 627.629697][T14960] openvswitch: netlink: Flow key attribute not present in set flow. [ 627.916675][T14960] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.3017'. [ 628.265648][T14973] netlink: 'syz.1.3024': attribute type 6 has an invalid length. [ 628.563824][ T51] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4 [ 628.580102][T14980] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3026'. [ 628.664873][T14985] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.3026'. [ 628.730929][T14980] openvswitch: netlink: Flow key attribute not present in set flow. [ 630.630371][T15013] netlink: 'syz.0.3038': attribute type 6 has an invalid length. [ 630.851090][T15018] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3039'. [ 630.937021][T15018] openvswitch: netlink: Flow key attribute not present in set flow. [ 631.071776][T15024] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.3039'. [ 632.444729][T15049] netlink: 'syz.3.3051': attribute type 6 has an invalid length. [ 633.580674][T15073] IPv6: Can't replace route, no match found [ 634.974537][T15093] netlink: 'syz.1.3068': attribute type 6 has an invalid length. [ 635.473969][T15105] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3072'. [ 635.569113][T15105] IPv6: Can't replace route, no match found [ 636.011784][T15107] netlink: 'syz.2.3073': attribute type 10 has an invalid length. [ 636.081517][T15107] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3073'. [ 636.257635][T15116] netlink: 'syz.0.3076': attribute type 10 has an invalid length. [ 636.266033][T15116] netlink: 55 bytes leftover after parsing attributes in process `syz.0.3076'. [ 636.618730][ T51] Bluetooth: hci0: unexpected event 0x08 length: 15 > 4 [ 637.581332][T15136] netlink: 'syz.3.3084': attribute type 11 has an invalid length. [ 638.667924][ T5772] Bluetooth: hci0: command 0x0406 tx timeout [ 639.384833][ T51] Bluetooth: hci0: unexpected event 0x08 length: 15 > 4 [ 639.988580][ T3480] hsr_slave_0: left promiscuous mode [ 640.111637][ T3480] hsr_slave_1: left promiscuous mode [ 640.240432][ T3480] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 640.267597][ T3480] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 641.057321][ T3480] veth1_macvtap: left promiscuous mode [ 641.077618][ T3480] veth0_macvtap: left promiscuous mode [ 642.587611][ T51] Bluetooth: hci4: command 0x0406 tx timeout [ 644.115158][ T5772] Bluetooth: hci3: unexpected event 0x08 length: 15 > 4 [ 646.067092][ T3480] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 646.111777][ T3480] bond_slave_1 (unregistering): left promiscuous mode [ 646.197854][ T51] Bluetooth: hci3: command 0x0406 tx timeout [ 646.376128][ T3480] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 646.408160][ T3480] bond_slave_0 (unregistering): left promiscuous mode [ 646.596089][ T3480] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 646.628167][ T3480] bridge_slave_1 (unregistering): left promiscuous mode [ 646.923015][ T3480] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 646.932049][ T3480] batadv0 (unregistering): left promiscuous mode [ 647.013307][ T3480] bond0 (unregistering): Released all slaves [ 647.087182][T15192] netlink: 'syz.1.3101': attribute type 6 has an invalid length. [ 647.128671][T15206] netlink: 65051 bytes leftover after parsing attributes in process `syz.0.3105'. [ 647.622911][T15218] netlink: 'syz.2.3109': attribute type 28 has an invalid length. [ 647.679190][ T5772] Bluetooth: hci3: unexpected event 0x08 length: 15 > 4 [ 647.684471][T15218] netlink: 'syz.2.3109': attribute type 29 has an invalid length. [ 647.798594][T15218] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3109'. [ 650.682440][T15230] FAULT_INJECTION: forcing a failure. [ 650.682440][T15230] name failslab, interval 1, probability 0, space 0, times 0 [ 650.695540][T15230] CPU: 0 PID: 15230 Comm: syz.0.3112 Not tainted syzkaller #0 [ 650.703053][T15230] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 650.713166][T15230] Call Trace: [ 650.716481][T15230] [ 650.719458][T15230] dump_stack_lvl+0x18c/0x250 [ 650.724198][T15230] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 650.730394][T15230] ? show_regs_print_info+0x20/0x20 [ 650.735632][T15230] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 650.741827][T15230] should_fail_ex+0x39d/0x4d0 [ 650.746549][T15230] should_failslab+0x9/0x20 [ 650.751098][T15230] slab_pre_alloc_hook+0x59/0x310 [ 650.756182][T15230] ? verify_lock_unused+0x140/0x140 [ 650.761445][T15230] kmem_cache_alloc+0x5a/0x2d0 [ 650.766250][T15230] ? skb_clone+0x1eb/0x370 [ 650.770706][T15230] skb_clone+0x1eb/0x370 [ 650.774987][T15230] bpf_clone_redirect+0x167/0x4a0 [ 650.780060][T15230] bpf_prog_c6f54bbad6dab1ee+0x5e/0x63 [ 650.785554][T15230] ? __static_call_text_end+0x109d70/0x109d70 [ 650.791657][T15230] ? lockdep_hardirqs_on+0x98/0x150 [ 650.796887][T15230] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 650.803086][T15230] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 650.809362][T15230] ? lockdep_softirqs_on+0x580/0x580 [ 650.814715][T15230] ? seqcount_lockdep_reader_access+0x19a/0x1d0 [ 650.821017][T15230] ? ktime_get_real_ts64+0x440/0x440 [ 650.826352][T15230] ? __local_bh_disable_ip+0x108/0x1a0 [ 650.831905][T15230] ? __cant_sleep+0x220/0x220 [ 650.836622][T15230] ? read_tsc+0x9/0x20 [ 650.840726][T15230] ? ktime_get+0x24b/0x280 [ 650.845177][T15230] ? bpf_test_run+0x174/0x870 [ 650.849887][T15230] bpf_test_run+0x2df/0x870 [ 650.854434][T15230] ? bpf_test_run+0x174/0x870 [ 650.859143][T15230] ? convert___skb_to_skb+0x590/0x590 [ 650.864546][T15230] ? eth_get_headlen+0x210/0x210 [ 650.869517][T15230] ? slab_build_skb+0x25f/0x3f0 [ 650.874416][T15230] ? convert___skb_to_skb+0x3d/0x590 [ 650.879734][T15230] bpf_prog_test_run_skb+0xad2/0x12b0 [ 650.885145][T15230] ? cpu_online+0x60/0x60 [ 650.889508][T15230] bpf_prog_test_run+0x321/0x390 [ 650.894479][T15230] __sys_bpf+0x49d/0x890 [ 650.898755][T15230] ? bpf_link_show_fdinfo+0x390/0x390 [ 650.904213][T15230] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 650.910496][T15230] __x64_sys_bpf+0x7c/0x90 [ 650.914986][T15230] do_syscall_64+0x55/0xa0 [ 650.919433][T15230] ? clear_bhb_loop+0x40/0x90 [ 650.924143][T15230] ? clear_bhb_loop+0x40/0x90 [ 650.928861][T15230] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 650.934777][T15230] RIP: 0033:0x7fe3efb9c799 [ 650.939220][T15230] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 650.958848][T15230] RSP: 002b:00007fe3f0a76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 650.967290][T15230] RAX: ffffffffffffffda RBX: 00007fe3efe15fa0 RCX: 00007fe3efb9c799 [ 650.975292][T15230] RDX: 0000000000000050 RSI: 0000200000001a00 RDI: 000000000000000a [ 650.983294][T15230] RBP: 00007fe3f0a76090 R08: 0000000000000000 R09: 0000000000000000 [ 650.991321][T15230] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 650.999324][T15230] R13: 00007fe3efe16038 R14: 00007fe3efe15fa0 R15: 00007fffcf4e1e48 [ 651.007332][T15230] [ 651.418210][T15229] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 651.517193][T15236] can: request_module (can-proto-0) failed. [ 652.070294][T15248] netlink: 'syz.2.3118': attribute type 6 has an invalid length. [ 652.834692][T15254] netlink: 'syz.1.3119': attribute type 10 has an invalid length. [ 652.864235][T15254] netlink: 2 bytes leftover after parsing attributes in process `syz.1.3119'. [ 652.887597][T15254] hsr0: entered promiscuous mode [ 652.894137][T15254] bridge0: port 3(hsr0) entered blocking state [ 652.901030][T15254] bridge0: port 3(hsr0) entered disabled state [ 652.917677][T15254] hsr0: entered allmulticast mode [ 652.923413][T15254] hsr_slave_0: entered allmulticast mode [ 652.947872][T15254] hsr_slave_1: entered allmulticast mode [ 652.971598][T15254] bridge0: port 3(hsr0) entered blocking state [ 652.977970][T15254] bridge0: port 3(hsr0) entered forwarding state [ 653.094581][ T5772] Bluetooth: hci3: unexpected event 0x08 length: 15 > 4 [ 653.147846][ T5772] Bluetooth: hci1: command 0x0406 tx timeout [ 653.281064][T15268] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3123'. [ 653.317707][T15268] openvswitch: netlink: Flow key attribute not present in set flow. [ 653.381333][T15268] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.3123'. [ 654.227105][T15286] netlink: 'syz.3.3130': attribute type 6 has an invalid length. [ 654.609668][ T5772] Bluetooth: hci0: unexpected event 0x08 length: 15 > 4 [ 654.917707][T15303] netlink: 'syz.3.3137': attribute type 10 has an invalid length. [ 654.947578][T15303] netlink: 55 bytes leftover after parsing attributes in process `syz.3.3137'. [ 655.017736][T15302] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3136'. [ 655.040049][T15305] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.3136'. [ 655.155276][T15302] openvswitch: netlink: Flow key attribute not present in set flow. [ 655.482671][T15318] netlink: 'syz.2.3141': attribute type 6 has an invalid length. [ 655.602295][T15314] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3140'. [ 655.796286][T15314] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3140'. [ 655.834527][T15288] netlink: 'syz.0.3131': attribute type 4 has an invalid length. [ 655.868105][T15288] netlink: 152 bytes leftover after parsing attributes in process `syz.0.3131'. [ 656.055931][T15288] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 656.247933][ T5772] Bluetooth: hci1: unexpected event 0x08 length: 15 > 4 [ 657.026277][T15341] netlink: 'syz.3.3149': attribute type 28 has an invalid length. [ 657.067819][T15341] netlink: 'syz.3.3149': attribute type 29 has an invalid length. [ 657.089631][T15343] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3150'. [ 657.108118][T15343] openvswitch: netlink: Flow key attribute not present in set flow. [ 657.812006][T15356] netlink: 'syz.0.3153': attribute type 6 has an invalid length. [ 658.167998][ T5772] Bluetooth: hci4: unexpected event 0x08 length: 15 > 4 [ 658.520568][T15376] FAULT_INJECTION: forcing a failure. [ 658.520568][T15376] name failslab, interval 1, probability 0, space 0, times 0 [ 658.548100][T15376] CPU: 1 PID: 15376 Comm: syz.2.3163 Not tainted syzkaller #0 [ 658.555644][T15376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 658.565749][T15376] Call Trace: [ 658.569060][T15376] [ 658.572018][T15376] dump_stack_lvl+0x18c/0x250 [ 658.576743][T15376] ? show_regs_print_info+0x20/0x20 [ 658.581979][T15376] ? lockdep_hardirqs_on+0x98/0x150 [ 658.587229][T15376] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 658.593430][T15376] should_fail_ex+0x39d/0x4d0 [ 658.598184][T15376] should_failslab+0x9/0x20 [ 658.602726][T15376] slab_pre_alloc_hook+0x59/0x310 [ 658.607788][T15376] ? ftrace_profile_set_filter+0x10e/0x200 [ 658.613633][T15376] __kmem_cache_alloc_node+0x53/0x250 [ 658.619046][T15376] ? ftrace_profile_set_filter+0x10e/0x200 [ 658.624892][T15376] kmalloc_trace+0x2a/0xe0 [ 658.629346][T15376] ftrace_profile_set_filter+0x10e/0x200 [ 658.635021][T15376] perf_ioctl+0xa9a/0x24a0 [ 658.639482][T15376] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 658.644987][T15376] ? perf_poll+0x1b0/0x1b0 [ 658.649471][T15376] ? __fget_files+0x28/0x4b0 [ 658.654099][T15376] ? __fget_files+0x28/0x4b0 [ 658.658749][T15376] ? bpf_lsm_file_ioctl+0x9/0x10 [ 658.663719][T15376] ? security_file_ioctl+0x80/0xa0 [ 658.668872][T15376] ? perf_poll+0x1b0/0x1b0 [ 658.673329][T15376] __se_sys_ioctl+0xfd/0x170 [ 658.677955][T15376] do_syscall_64+0x55/0xa0 [ 658.682455][T15376] ? clear_bhb_loop+0x40/0x90 [ 658.687166][T15376] ? clear_bhb_loop+0x40/0x90 [ 658.691878][T15376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 658.697804][T15376] RIP: 0033:0x7ff45a19c799 [ 658.702265][T15376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 658.721921][T15376] RSP: 002b:00007ff45b067028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 658.730371][T15376] RAX: ffffffffffffffda RBX: 00007ff45a415fa0 RCX: 00007ff45a19c799 [ 658.738420][T15376] RDX: 0000200000000040 RSI: 0000000040082406 RDI: 0000000000000004 [ 658.746428][T15376] RBP: 00007ff45b067090 R08: 0000000000000000 R09: 0000000000000000 [ 658.754434][T15376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 658.762442][T15376] R13: 00007ff45a416038 R14: 00007ff45a415fa0 R15: 00007ffc13f06de8 [ 658.770460][T15376] [ 658.982415][T15380] __nla_validate_parse: 2 callbacks suppressed [ 658.982454][T15380] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3165'. [ 659.027612][T15380] openvswitch: netlink: Flow key attribute not present in set flow. [ 659.084208][T15380] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.3165'. [ 659.167165][ T5772] Bluetooth: hci3: unexpected event 0x08 length: 15 > 4 [ 659.217781][T15390] netlink: 'syz.2.3167': attribute type 6 has an invalid length. [ 659.751071][T15406] netlink: 14 bytes leftover after parsing attributes in process `syz.2.3175'. [ 659.767720][T15406] netlink: get zone limit has 4 unknown bytes [ 659.778984][T15404] netlink: 'syz.0.3172': attribute type 10 has an invalid length. [ 659.802393][T15404] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3172'. [ 659.827552][T15404] hsr0: entered promiscuous mode [ 659.838433][T15404] bridge0: port 3(hsr0) entered blocking state [ 659.844885][T15404] bridge0: port 3(hsr0) entered disabled state [ 659.864490][T15404] hsr0: entered allmulticast mode [ 659.878091][T15404] hsr_slave_0: entered allmulticast mode [ 659.884751][T15404] hsr_slave_1: entered allmulticast mode [ 659.893482][T15404] bridge0: port 3(hsr0) entered blocking state [ 659.899874][T15404] bridge0: port 3(hsr0) entered forwarding state [ 660.125192][ T5772] Bluetooth: hci3: unexpected event 0x08 length: 15 > 4 [ 660.318075][T15418] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.3180'. [ 660.340215][T15418] openvswitch: netlink: Flow key attribute not present in set flow. [ 660.350319][T15423] netlink: 'syz.0.3182': attribute type 6 has an invalid length. [ 660.402873][T15418] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.3180'. [ 660.760537][T15430] FAULT_INJECTION: forcing a failure. [ 660.760537][T15430] name failslab, interval 1, probability 0, space 0, times 0 [ 660.841026][T15434] netlink: 'syz.1.3185': attribute type 28 has an invalid length. [ 660.853019][T15430] CPU: 0 PID: 15430 Comm: syz.0.3186 Not tainted syzkaller #0 [ 660.860550][T15430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 660.870658][T15430] Call Trace: [ 660.873961][T15430] [ 660.876920][T15430] dump_stack_lvl+0x18c/0x250 [ 660.881652][T15430] ? show_regs_print_info+0x20/0x20 [ 660.886898][T15430] ? load_image+0x400/0x400 [ 660.891486][T15430] ? __might_sleep+0xe0/0xe0 [ 660.896114][T15430] ? __lock_acquire+0x7d40/0x7d40 [ 660.901180][T15430] should_fail_ex+0x39d/0x4d0 [ 660.905903][T15430] should_failslab+0x9/0x20 [ 660.910447][T15430] slab_pre_alloc_hook+0x59/0x310 [ 660.915517][T15430] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 660.921790][T15430] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 660.928062][T15430] __kmem_cache_alloc_node+0x53/0x250 [ 660.933485][T15430] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 660.939855][T15430] __kmalloc+0xa4/0x230 [ 660.944045][T15430] ? netlink_lookup+0x30/0x200 [ 660.948844][T15430] genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 660.954960][T15430] genl_start+0x180/0x6b0 [ 660.959313][T15430] ? netlink_lookup+0x30/0x200 [ 660.964221][T15430] __netlink_dump_start+0x4a9/0x810 [ 660.969550][T15430] genl_family_rcv_msg_dumpit+0x214/0x310 [ 660.975311][T15430] ? genl_rcv_msg+0x7a0/0x7a0 [ 660.980026][T15430] ? genl_get_cmd+0x692/0x920 [ 660.984742][T15430] ? genl_family_rcv_msg_doit+0x310/0x310 [ 660.990499][T15430] ? genl_start+0x6b0/0x6b0 [ 660.995041][T15430] ? genl_dumpit+0x1a0/0x1a0 [ 660.999682][T15430] genl_rcv_msg+0x5e5/0x7a0 [ 661.004230][T15430] ? genl_bind+0x360/0x360 [ 661.008676][T15430] ? ethnl_default_doit+0xb80/0xb80 [ 661.014002][T15430] ? ethnl_default_start+0x560/0x560 [ 661.019344][T15430] ? ethnl_default_dumpit+0x8a0/0x8a0 [ 661.024753][T15430] ? perf_trace_preemptirq_template+0x269/0x330 [ 661.031036][T15430] ? rcu_read_unlock_special+0xf7/0x4d0 [ 661.036623][T15430] netlink_rcv_skb+0x241/0x4d0 [ 661.041435][T15430] ? genl_bind+0x360/0x360 [ 661.045878][T15430] ? netlink_ack+0x1180/0x1180 [ 661.050686][T15430] ? __lock_acquire+0x7d40/0x7d40 [ 661.055746][T15430] ? down_read+0x1ac/0x2e0 [ 661.060196][T15430] genl_rcv+0x28/0x40 [ 661.064223][T15430] netlink_unicast+0x751/0x8d0 [ 661.069077][T15430] netlink_sendmsg+0x8d0/0xbf0 [ 661.073892][T15430] ? netlink_getsockopt+0x590/0x590 [ 661.079128][T15430] ? aa_sock_msg_perm+0x94/0x150 [ 661.084100][T15430] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 661.089696][T15430] ? security_socket_sendmsg+0x80/0xa0 [ 661.095206][T15430] ? netlink_getsockopt+0x590/0x590 [ 661.100463][T15430] ____sys_sendmsg+0x5ba/0x960 [ 661.105612][T15430] ? __asan_memset+0x22/0x40 [ 661.110282][T15430] ? __sys_sendmsg_sock+0x30/0x30 [ 661.115355][T15430] ? __import_iovec+0x3fa/0x850 [ 661.120843][T15430] ? import_iovec+0x73/0xa0 [ 661.125388][T15430] ___sys_sendmsg+0x2a6/0x360 [ 661.130116][T15430] ? __sys_sendmsg+0x2a0/0x2a0 [ 661.134926][T15430] ? trace_call_bpf+0xc3/0x6c0 [ 661.139728][T15430] ? seqcount_lockdep_reader_access+0x17b/0x1d0 [ 661.146251][T15430] __se_sys_sendmsg+0x1c2/0x2b0 [ 661.151170][T15430] ? __x64_sys_sendmsg+0x80/0x80 [ 661.156162][T15430] ? lockdep_hardirqs_on+0x98/0x150 [ 661.161492][T15430] do_syscall_64+0x55/0xa0 [ 661.165957][T15430] ? clear_bhb_loop+0x40/0x90 [ 661.170668][T15430] ? clear_bhb_loop+0x40/0x90 [ 661.175390][T15430] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 661.181315][T15430] RIP: 0033:0x7fe3efb9c799 [ 661.185760][T15430] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 661.205402][T15430] RSP: 002b:00007fe3f0a76028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 661.214296][T15430] RAX: ffffffffffffffda RBX: 00007fe3efe15fa0 RCX: 00007fe3efb9c799 [ 661.222329][T15430] RDX: 0000000000040050 RSI: 0000200000000000 RDI: 0000000000000007 [ 661.230342][T15430] RBP: 00007fe3f0a76090 R08: 0000000000000000 R09: 0000000000000000 [ 661.238341][T15430] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 661.246348][T15430] R13: 00007fe3efe16038 R14: 00007fe3efe15fa0 R15: 00007fffcf4e1e48 [ 661.254364][T15430] [ 661.277494][T15434] netlink: 'syz.1.3185': attribute type 29 has an invalid length. [ 661.367801][T15434] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3185'. [ 663.753786][T15436] ------------[ cut here ]------------ [ 663.759478][T15436] WARNING: CPU: 0 PID: 15436 at kernel/events/core.c:6806 perf_pending_task+0x35c/0x470 [ 663.769415][T15436] Modules linked in: [ 663.773358][T15436] CPU: 0 PID: 15436 Comm: syz.1.3185 Not tainted syzkaller #0 [ 663.781221][T15436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 663.791508][T15436] RIP: 0010:perf_pending_task+0x35c/0x470 [ 663.797299][T15436] Code: ff 84 db 75 14 e8 74 e0 d5 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 60 e0 d5 ff e8 7b 61 4f ff eb e5 e8 54 e0 d5 ff <0f> 0b e9 f3 fe ff ff e8 48 e0 d5 ff 48 c7 c7 70 f3 1c 8d 4c 89 f6 [ 663.817132][T15436] RSP: 0018:ffffc900039f79c0 EFLAGS: 00010293 [ 663.823488][T15436] RAX: ffffffff81b13c0c RBX: ffff88804f1a0a80 RCX: ffff888021318000 [ 663.831673][T15436] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 663.839832][T15436] RBP: 0000000000000001 R08: ffffffff8e8aeeef R09: 1ffffffff1d15ddd [ 663.847998][T15436] R10: dffffc0000000000 R11: fffffbfff1d15dde R12: ffff888021318000 [ 663.856022][T15436] R13: ffff88805d8a7d30 R14: ffff88804f1a0840 R15: 1ffff11009e34108 [ 663.864147][T15436] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 663.873512][T15436] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 663.880408][T15436] CR2: 000056389e98e270 CR3: 000000004f5b6000 CR4: 00000000003506f0 [ 663.888518][T15436] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 663.896548][T15436] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 663.904838][T15436] Call Trace: [ 663.908293][T15436] [ 663.911273][T15436] task_work_run+0x1d4/0x260 [ 663.915927][T15436] ? task_work_cancel+0x220/0x220 [ 663.921065][T15436] do_exit+0x95a/0x2460 [ 663.925290][T15436] ? lock_chain_count+0x20/0x20 [ 663.930259][T15436] ? put_task_struct+0xc0/0xc0 [ 663.935090][T15436] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 663.941345][T15436] ? lockdep_hardirqs_on+0x98/0x150 [ 663.946605][T15436] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 663.952878][T15436] do_group_exit+0x21b/0x2d0 [ 663.957596][T15436] ? _raw_spin_unlock_irq+0x29/0x50 [ 663.962901][T15436] get_signal+0x12fc/0x13f0 [ 663.967513][T15436] arch_do_signal_or_restart+0xc2/0x800 [ 663.973134][T15436] ? __ia32_sys_get_robust_list+0x110/0x110 [ 663.979364][T15436] ? blkcg_maybe_throttle_current+0x19f/0xa90 [ 663.985495][T15436] ? get_sigframe_size+0x20/0x20 [ 663.990877][T15436] ? exit_to_user_mode_loop+0x3b/0x110 [ 663.996403][T15436] exit_to_user_mode_loop+0x70/0x110 [ 664.001797][T15436] exit_to_user_mode_prepare+0xee/0x180 [ 664.007448][T15436] syscall_exit_to_user_mode+0x1a/0x50 [ 664.012964][T15436] do_syscall_64+0x61/0xa0 [ 664.017487][T15436] ? clear_bhb_loop+0x40/0x90 [ 664.022221][T15436] ? clear_bhb_loop+0x40/0x90 [ 664.026955][T15436] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 664.033113][T15436] RIP: 0033:0x7fae30d9c799 [ 664.037612][T15436] Code: Unable to access opcode bytes at 0x7fae30d9c76f. [ 664.044690][T15436] RSP: 002b:00007fae31c2a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 664.053205][T15436] RAX: fffffffffffffe00 RBX: 00007fae31016188 RCX: 00007fae30d9c799 [ 664.061279][T15436] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fae31016188 [ 664.069339][T15436] RBP: 00007fae31016180 R08: 0000000000000000 R09: 0000000000000000 [ 664.077369][T15436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 664.085789][T15436] R13: 00007fae31016218 R14: 00007fff2afb73a0 R15: 00007fff2afb7488 [ 664.094150][T15436] [ 664.097235][T15436] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 664.104558][T15436] CPU: 0 PID: 15436 Comm: syz.1.3185 Not tainted syzkaller #0 [ 664.112058][T15436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 664.122183][T15436] Call Trace: [ 664.125503][T15436] [ 664.128474][T15436] dump_stack_lvl+0x18c/0x250 [ 664.133214][T15436] ? show_regs_print_info+0x20/0x20 [ 664.138462][T15436] ? load_image+0x400/0x400 [ 664.143029][T15436] panic+0x2dc/0x730 [ 664.146975][T15436] ? bpf_jit_dump+0xd0/0xd0 [ 664.151548][T15436] __warn+0x2e0/0x470 [ 664.155576][T15436] ? perf_pending_task+0x35c/0x470 [ 664.160849][T15436] ? perf_pending_task+0x35c/0x470 [ 664.166027][T15436] report_bug+0x2be/0x4f0 [ 664.170397][T15436] ? perf_pending_task+0x35c/0x470 [ 664.175590][T15436] ? perf_pending_task+0x35c/0x470 [ 664.180756][T15436] ? perf_pending_task+0x35e/0x470 [ 664.186007][T15436] handle_bug+0xcf/0x120 [ 664.190308][T15436] exc_invalid_op+0x1a/0x50 [ 664.194869][T15436] asm_exc_invalid_op+0x1a/0x20 [ 664.199770][T15436] RIP: 0010:perf_pending_task+0x35c/0x470 [ 664.205543][T15436] Code: ff 84 db 75 14 e8 74 e0 d5 ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 60 e0 d5 ff e8 7b 61 4f ff eb e5 e8 54 e0 d5 ff <0f> 0b e9 f3 fe ff ff e8 48 e0 d5 ff 48 c7 c7 70 f3 1c 8d 4c 89 f6 [ 664.225205][T15436] RSP: 0018:ffffc900039f79c0 EFLAGS: 00010293 [ 664.231332][T15436] RAX: ffffffff81b13c0c RBX: ffff88804f1a0a80 RCX: ffff888021318000 [ 664.239355][T15436] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 664.247379][T15436] RBP: 0000000000000001 R08: ffffffff8e8aeeef R09: 1ffffffff1d15ddd [ 664.255398][T15436] R10: dffffc0000000000 R11: fffffbfff1d15dde R12: ffff888021318000 [ 664.263423][T15436] R13: ffff88805d8a7d30 R14: ffff88804f1a0840 R15: 1ffff11009e34108 [ 664.271458][T15436] ? perf_pending_task+0x35c/0x470 [ 664.276647][T15436] task_work_run+0x1d4/0x260 [ 664.281302][T15436] ? task_work_cancel+0x220/0x220 [ 664.286390][T15436] do_exit+0x95a/0x2460 [ 664.290612][T15436] ? lock_chain_count+0x20/0x20 [ 664.295521][T15436] ? put_task_struct+0xc0/0xc0 [ 664.300354][T15436] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 664.306564][T15436] ? lockdep_hardirqs_on+0x98/0x150 [ 664.311811][T15436] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 664.318031][T15436] do_group_exit+0x21b/0x2d0 [ 664.322681][T15436] ? _raw_spin_unlock_irq+0x29/0x50 [ 664.327931][T15436] get_signal+0x12fc/0x13f0 [ 664.332504][T15436] arch_do_signal_or_restart+0xc2/0x800 [ 664.338104][T15436] ? __ia32_sys_get_robust_list+0x110/0x110 [ 664.344040][T15436] ? blkcg_maybe_throttle_current+0x19f/0xa90 [ 664.350175][T15436] ? get_sigframe_size+0x20/0x20 [ 664.355189][T15436] ? exit_to_user_mode_loop+0x3b/0x110 [ 664.360704][T15436] exit_to_user_mode_loop+0x70/0x110 [ 664.366039][T15436] exit_to_user_mode_prepare+0xee/0x180 [ 664.371641][T15436] syscall_exit_to_user_mode+0x1a/0x50 [ 664.377156][T15436] do_syscall_64+0x61/0xa0 [ 664.381623][T15436] ? clear_bhb_loop+0x40/0x90 [ 664.386345][T15436] ? clear_bhb_loop+0x40/0x90 [ 664.391077][T15436] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 664.397017][T15436] RIP: 0033:0x7fae30d9c799 [ 664.401476][T15436] Code: Unable to access opcode bytes at 0x7fae30d9c76f. [ 664.408532][T15436] RSP: 002b:00007fae31c2a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 664.416996][T15436] RAX: fffffffffffffe00 RBX: 00007fae31016188 RCX: 00007fae30d9c799 [ 664.425012][T15436] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fae31016188 [ 664.433026][T15436] RBP: 00007fae31016180 R08: 0000000000000000 R09: 0000000000000000 [ 664.441035][T15436] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 664.449042][T15436] R13: 00007fae31016218 R14: 00007fff2afb73a0 R15: 00007fff2afb7488 [ 664.457073][T15436] [ 664.460718][T15436] Kernel Offset: disabled [ 664.465074][T15436] Rebooting in 86400 seconds..