last executing test programs: 12.130729369s ago: executing program 0 (id=10077): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) socket$kcm(0xa, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xd, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xaa9a}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa0000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x15}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002f000b08d25a80648c7494f90424fc600b0002", 0x17}], 0x1}, 0x0) r2 = socket$kcm(0x10, 0x400000002, 0x0) close(r2) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="934300005a"], 0xfe33) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)=[{0x0}], 0x1, 0x0, 0x0, 0x10000000}, 0x52cc) (async) socket$kcm(0xa, 0x2, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x8, 0x7}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0xc, 0xd, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xaa9a}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa0000000}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x15}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000d80)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="76ea090000000000009ba56a88ca", 0x0, 0x6400, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002f000b08d25a80648c7494f90424fc600b0002", 0x17}], 0x1}, 0x0) (async) socket$kcm(0x10, 0x400000002, 0x0) (async) close(r2) (async) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="934300005a"], 0xfe33) (async) 12.10887895s ago: executing program 1 (id=10079): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6c0bd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6c9, 0x1, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000400)=@raw=[@generic={0xb7, 0x2, 0x0, 0x0, 0x2}, @generic={0x73, 0xa, 0x2, 0xffc0}, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (fail_nth: 1) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) 8.984083015s ago: executing program 0 (id=10080): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x48510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x806, 0x0, 0x0, 0x8, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230000) perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x8}, 0x90, 0xa4, 0x2, 0x1, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000032000b07d25a806f8c6394f90824fc60", 0x14}], 0x1}, 0x0) syz_clone(0x41200100, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x6, 0xb, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000008018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8dcffffb702000008000000b70300000000000085000000c800000095"], &(0x7f0000000100)='syzkaller\x00', 0x9}, 0x94) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000240)={0x4, 0x80, 0x2, 0x7f, 0xe, 0x8, 0x0, 0x8, 0xc001, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x7ff, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x400, 0x90, 0xffff0001, 0x4, 0x827, 0xb, 0x80, 0x0, 0xe, 0x0, 0x100}) r4 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005}, 0x50) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x7b, 0x0, 0x0, 0x800000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{r6}, &(0x7f0000000400)=0xa1, &(0x7f00000004c0)=r7}, 0x20) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110c230000) close(r3) 8.839402089s ago: executing program 1 (id=10082): perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x60000, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xca, 0x5, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x4612, 0xffffffffffffffff}, 0x114105, 0x6, 0x9, 0x1, 0x0, 0x40000, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r2) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r1], 0x12) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x28, 0x20, 0x0, 0xfffff034}, {0x6, 0x3, 0x0, 0xfffffffc}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000100)=@qipcrtr={0x2a, 0x4, 0x1}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)="27031c00160014000000002f1eafacf706e105000000894f00050003ee0b80558ddbba9b37786fd808252372a31e4939884f0abc3c", 0x35}, {&(0x7f0000001980)="0276dd88a8", 0x5}], 0x2}, 0x24004010) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r6, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)=r8}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r10}, &(0x7f0000000180)=0x20000, &(0x7f00000001c0)=r8}, 0x20) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000042000000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008000000bc09000000000000450901003f20000095000000f9ffffffb6020000000000000b9d94e9e37e4dad000000bf2700000000000107080000fffdffffbfa400000000000007040000f0ffffffc40700000800000018220000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7050000080000004608efff76000000bf9800000000000056090000020000008500000005000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7000000ff00001fbfa300000000000007030000f0ffffff620af0fff8ffffff79a4f0ff000000002d040200000000001d400200000000004704000001ed000062030000000000001d44feff000000007a0a00fe00ffffffc3030000f1000000b5040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebaa2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd5070ce5c24099d3f18079ebbea6f1707207acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b28753531d3f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d156ae8383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15f279b513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aa0000000000000000832371fe5bc621426d1ed0a4a99702cc1b692c3f0b15629eaf4c12a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbad937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594807031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac42738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca9be8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998802008f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91ed92cac7c2ccd17d338bbda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922928e000000ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abb8a9982ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c7636f9d1b88caadef8930fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139566fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb8bc70000a4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe6290421338ef8f6d27117cd1471bf3c0b64416fbbe955da0281e7ef7f7d5176150e86cda98d07f7de2088cb2ffd1d4c71097635c2bb3d9a0b01e757256ee427f0a244d48682bf89e2279b383b616b40f116172bc1b995eb2c1220597af8df52646f1f0cb65cfa7e038e8bb5d4d52b86a61d82dc14a4f5cc7e6061c65ccdbc2afc3f363ecf34ad0b227687c3ea8d63683ddd5914116edd9e075da9e3638647188bc8f95107c9250995eb6cadcd0f65b8504ff10304f2ceba275f9d485ed5554d64005db877f0fbb3beba596684066f132d5077835823592d6d392f5ff62f6f876eb10d8cbf0a73f8421b74c8916e4077b8866c95ad88bc7130244183ed216210f10f69b3e0ee13d06e4eb240cce5ec1c3b1defe4c0f8b83a34ef4f5f8f9ceefb678ad29d3683e3c44a01549e55ffca41c0b06e013f054257646c58b667ec0701004c239589b3e64ef5e1d5ed22b5fd5a90fe3453327c3652d5c9762428f0bd0178d1b80a60f64343ab77d8baa0a388711c8d2d6d3e9049814b15b6ea21387040989d69c3aa27256c55780f33d20823d8e2eb6e56850162969bf4c6c9632a55cf5be00"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) 7.231964843s ago: executing program 2 (id=10088): socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffffff, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socketpair(0x1, 0x1, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bond0\x00', 0x10}) socketpair(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8922, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$unix(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(r8, 0x89e2, &(0x7f0000000140)={r0}) 5.400071543s ago: executing program 2 (id=10090): r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0xfffffff7ffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r2 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r2, 0x0, 0x20000010) 5.342067464s ago: executing program 3 (id=10091): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10004, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00", @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x16, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0x200000000000002, 0x300) perf_event_open(&(0x7f0000000140)={0x1, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x11c02a, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffc}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$inet(r1, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000007880)=[@ip_pktinfo={{0x1c, 0x28f0700, 0x8, {0x0, @empty=0xa0050000}}}, @ip_retopts={{0x14, 0x0, 0x7, {[@ra={0x94, 0x4, 0xe0e0}]}}}], 0x38}, 0x0) socket$kcm(0x21, 0x2, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) socket$kcm(0xa, 0x2, 0x0) socket$kcm(0x11, 0x2, 0x300) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000005"], 0x48) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x81000600, 0x12, 0x0, &(0x7f0000000900)="c1dfb080cd21d308098ee6888100", 0x0, 0xadf0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5.185971039s ago: executing program 2 (id=10092): r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6c0bd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6c9, 0x1, 0x0, 0x0, 0x0, 0xfff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0xcdd, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000400)=@raw=[@generic={0xb7, 0x2, 0x0, 0x0, 0x2}, @generic={0x73, 0xa, 0x2, 0xffc0}, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0x1, 0x2b4}, 0x0, 0x10000, 0x0, 0x0, 0x8, 0x20005, 0x2, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r3, 0xffffffffffffffff}, &(0x7f0000000080), &(0x7f0000000200)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r5, 0xffffffffffffffff}, &(0x7f0000000500)=0x2000000, &(0x7f0000000540)=r4}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r6}, &(0x7f0000000000)=0x2000000, &(0x7f0000000340)=r4}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, [@call={0x85, 0x0, 0x0, 0x2f}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0x0, 0x28, 0xe80, &(0x7f00000002c0)="0000ffffffffa000", &(0x7f0000000300)=""/8, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r8, &(0x7f0000000100)={&(0x7f0000000000)=@l2tp6={0xa, 0x4000, 0x0, @loopback={0xfe80000000000000, 0xac14140c}}, 0x80, 0x0, 0x0, 0x0, 0x0, 0x900}, 0x60) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r9, 0x0, 0xe, 0x0, &(0x7f0000000040)="e0fc547ed387dbe9abc89b6f7bec", 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_QUERY_BPF(0xffffffffffffffff, 0xc008240a, 0x0) 4.972333495s ago: executing program 1 (id=10093): r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x121001, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r3, 0x0, 0x4, 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r4, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f0000000200)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r5}, 0x4) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000), 0xc) sendmsg$inet(r3, 0x0, 0x20040800) socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(0x3) 2.179575361s ago: executing program 1 (id=10094): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34, 0x2, @perf_bp={0x0, 0x7}, 0x8000, 0x5, 0x47a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x8, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0ffc40bffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400210000000404000001000000b7050000220000006a0a00fe00000000850000000b000000b7000000592000009500000000000000a3028cb5af6c8f5d76781dcb7729f0170720596bb3b4d821d976f5843061cc2e3afbae82d7932d192321fa3b3042f100"/172], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0xa002a0, 0xe, 0x18, &(0x7f0000000000)="5ae02efc441a80536af0d1d905c7", &(0x7f0000000040)=""/24, 0x6414}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000f4688d8e5f000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000300)="2e00000011008108090f9becdb4cb9200a4831371400000069bd6efb2502eaf60d000300020400bf050005001201", 0x2e}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x40010040) r4 = socket$kcm(0x2c, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x11b, 0x2, &(0x7f0000000900)=r3, 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000940)=ANY=[], 0x50) 2.178551031s ago: executing program 2 (id=10095): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd6, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8000) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x64099, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b81, 0x2, @perf_config_ext={0xfffffffffffffffd, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x9, 0x9, 0x2, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2000000}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x6, 0x0, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00"/48], 0xfdef) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 2.098950343s ago: executing program 3 (id=10096): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x1, 0x2, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_config_ext={0x9, 0x2}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r0, 0x0, 0x10001) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6401b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0xffffffffffffff00}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYRESHEX=r0], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000680)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="9b0cb39bf267ce9b5ddf3432ca97", 0x0, 0x14, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf}, 0x125, 0x2, 0xfffffffe, 0x0, 0x0, 0x7, 0x9, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x24020054) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x80) write$cgroup_subtree(r2, 0x0, 0xfe33) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x644b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x2}, 0x8004, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) socket$kcm(0x2, 0x5, 0x84) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000080)='mem\x00\x10\x00\x00\x00\x00\x00\x00I\xa2l') r4 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) write$cgroup_subtree(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="b968732c16b8c1935317493a9f849e00b8b8440ae4535943397bd3c67de7962fadd59dade686077a2fbbd0a86930f7155641ad4d2c4d8b7a49465661a0a6a83d8f8ef61a5036855491e6adf9a54c1ea7acf5f6e9438c6487794fcce2c1f607f044c000cad8855797e5a10b79584248c8a2fe1e"], 0x4) r5 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffe1f) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r3}, &(0x7f0000000340), &(0x7f0000000380)=r5}, 0x20) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a8000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) 1.982958756s ago: executing program 0 (id=10097): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket$kcm(0x29, 0x2, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xd}, 0x2008, 0x0, 0x0, 0x5, 0x0, 0x6, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r1, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000040) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r3 = socket$kcm(0x11, 0x3, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r2}, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000580)={r2, 0x0, 0x0}, 0x10) ioctl$TUNSETIFINDEX(0xffffffffffffffff, 0x400454da, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x40810) recvmsg(r5, &(0x7f0000004300)={0x0, 0x0, 0x0}, 0x0) recvmsg$kcm(r5, &(0x7f0000000380)={0x0, 0x61, &(0x7f00000027c0)=[{&(0x7f0000000500)=""/4096, 0x1000}], 0x1}, 0x10100) r6 = socket$kcm(0x10, 0x2, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001340)=ANY=[@ANYBLOB], 0x0}, 0x94) sendmsg$kcm(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001600)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f020033000b35d25a806c8c6f94f90a24fc601000040006000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={r2, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7fff, '\x00', r7, 0xffffffffffffffff, 0x3, 0x2, 0x5}, 0x50) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000000), 0xef) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000380)={r3}) sendmsg$kcm(r3, &(0x7f0000000040)={&(0x7f0000000280)=@sco={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x80, &(0x7f0000000240)=[{&(0x7f0000000480)="620454ff590200000000002f1eafbcf706e12b30087f5c582d26116642c47a5f8786ee601e65ab3c06d4b8bf4a81cb3e247345af215542f41ddf82f618438a34f90186cee8441e2305e495d04ad68ab8fef69df82de6456fbb48b63f60c9c9097be968ea872c4801e5d0711b4373c7224ed7a9cbd49d40f82bdb6afc0036824be26fc96e49a70e90797e6caa1b38ddacb3cb2b3eac7c068a185b644582f25edfa3d6a46e2a894ca809a422a6a29bd7145bb6e7992570484d6a5d0292ea0c3f97b7cbff701684b13c5593262534a7af9eab48f2ca2d74d9a4de33", 0xda}, {&(0x7f0000000840)="294f28dfe56d2c8ba23606bc7ecd1f634665cb5bed07bac5684da6eb21da1d6926910c5a0c653b0106869a8049d2a44ce42557b2e72e2bd367e9d01a5e7380cc4fc8e7c9044cc4115b978ca7427d749beaefdf2e48b369cb169ad7b1ced26bb161297c7e56a3e83e91b379c179017f8b4657d1b22eca6bca33036d33e1a684059c5301001ca6637ac780ab2bcfc22a666cd4e5876f11e9aee4724b7cb59731c97e70ebd7f7483994eb07de2f5d6a9448c3206cff6d290b433f331c2399e99ee3bdecf5689eddc3e54908000000a933bbc47b65ca6e9d7efbee6e3b1dbe87313111e85336d6890002db17751b6044f964dc90ea466f90856112be7f0a54b39a3f66cc4c39544300093158af39cdde429f50d8c7fbc0efaccca18e94b87dc586ee60baa55469755ab00e92b607f2aeee00ad72fb29c1847f85b2f8ec3a34864b18eaaa131a4940c9af11606e5d9360c3f4a2c8308d50c34b1bbaac018469ac346dc2a539e20350297097e7bf21ea0c2a0aa083b2b3543af05c7fb5391a1c81304b520fafb941b2dc3cfb03c3dd8567a459752a5ca573ee7cf4f518af508d141c98dc9914df1521e9ee49decdf2418e7f74adea9fda805bc75906dafd279aee36397966427cdef205c67fbbb3", 0x1cb}, {&(0x7f0000000a40)="0a985d7879f1bb", 0x7}], 0x3}, 0x804) 1.743914022s ago: executing program 3 (id=10098): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x1, 0x2, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_config_ext={0x9, 0x2}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r0, 0x0, 0x10001) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6401b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0xffffffffffffff00}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYRESHEX=r0], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000680)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="9b0cb39bf267ce9b5ddf3432ca97", 0x0, 0x14, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf}, 0x125, 0x2, 0xfffffffe, 0x0, 0x0, 0x7, 0x9, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x24020054) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x80) write$cgroup_subtree(r2, 0x0, 0xfe33) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x644b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x2}, 0x8004, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) socket$kcm(0x2, 0x5, 0x84) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000080)='mem\x00\x10\x00\x00\x00\x00\x00\x00I\xa2l') r4 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) write$cgroup_subtree(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="b968732c16b8c1935317493a9f849e00b8b8440ae4535943397bd3c67de7962fadd59dade686077a2fbbd0a86930f7155641ad4d2c4d8b7a49465661a0a6a83d8f8ef61a5036855491e6adf9a54c1ea7acf5f6e9438c6487794fcce2c1f607f044c000cad8855797e5a10b79584248c8a2fe1e"], 0x4) r5 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffe1f) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r3}, &(0x7f0000000340), &(0x7f0000000380)=r5}, 0x20) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a8000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) 1.402388192s ago: executing program 0 (id=10099): socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffffff, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) socketpair$nbd(0x1, 0x1, 0x0, 0x0) socketpair(0x1, 0x1, 0x1, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bond0\x00', 0x10}) socketpair(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8922, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r5, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$unix(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMCLONE(r8, 0x89e2, &(0x7f0000000140)={r0}) 1.402009592s ago: executing program 3 (id=10100): r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0xfffffff7ffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r2 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r2, 0x0, 0x20000010) 1.356543843s ago: executing program 2 (id=10101): perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x60000, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xca, 0x5, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x4612, 0xffffffffffffffff}, 0x114105, 0x6, 0x9, 0x1, 0x0, 0x40000, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r2) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r1], 0x12) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x28, 0x20, 0x0, 0xfffff034}, {0x6, 0x3, 0x0, 0xfffffffc}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000100)=@qipcrtr={0x2a, 0x4, 0x1}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)="27031c00160014000000002f1eafacf706e105000000894f00050003ee0b80558ddbba9b37786fd808252372a31e4939884f0abc3c", 0x35}, {&(0x7f0000001980)="0276dd88a8", 0x5}], 0x2}, 0x24004010) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r6}, &(0x7f0000000080), &(0x7f0000000200)=r8}, 0x20) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000042000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008000000bc09000000000000450901003f20000095000000f9ffffffb6020000000000000b9d94e9e37e4dad000000bf2700000000000107080000fffdffffbfa400000000000007040000f0ffffffc40700000800000018220000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7050000080000004608efff76000000bf9800000000000056090000020000008500000005000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7000000ff00001fbfa300000000000007030000f0ffffff620af0fff8ffffff79a4f0ff000000002d040200000000001d400200000000004704000001ed000062030000000000001d44feff000000007a0a00fe00ffffffc3030000f1000000b5040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebaa2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd5070ce5c24099d3f18079ebbea6f1707207acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b28753531d3f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d156ae8383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15f279b513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aa0000000000000000832371fe5bc621426d1ed0a4a99702cc1b692c3f0b15629eaf4c12a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbad937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594807031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac42738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca9be8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998802008f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91ed92cac7c2ccd17d338bbda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922928e000000ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abb8a9982ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c7636f9d1b88caadef8930fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139566fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb8bc70000a4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe6290421338ef8f6d27117cd1471bf3c0b64416fbbe955da0281e7ef7f7d5176150e86cda98d07f7de2088cb2ffd1d4c71097635c2bb3d9a0b01e757256ee427f0a244d48682bf89e2279b383b616b40f116172bc1b995eb2c1220597af8df52646f1f0cb65cfa7e038e8bb5d4d52b86a61d82dc14a4f5cc7e6061c65ccdbc2afc3f363ecf34ad0b227687c3ea8d63683ddd5914116edd9e075da9e3638647188bc8f95107c9250995eb6cadcd0f65b8504ff10304f2ceba275f9d485ed5554d64005db877f0fbb3beba596684066f132d5077835823592d6d392f5ff62f6f876eb10d8cbf0a73f8421b74c8916e4077b8866c95ad88bc7130244183ed216210f10f69b3e0ee13d06e4eb240cce5ec1c3b1defe4c0f8b83a34ef4f5f8f9ceefb678ad29d3683e3c44a01549e55ffca41c0b06e013f054257646c58b667ec0701004c239589b3e64ef5e1d5ed22b5fd5a90fe3453327c3652d5c9762428f0bd0178d1b80a60f64343ab77d8baa0a388711c8d2d6d3e9049814b15b6ea21387040989d69c3aa27256c55780f33d20823d8e2eb6e56850162969bf4c6c9632a55cf5be00"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) 1.149094839s ago: executing program 0 (id=10102): r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x121001, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x2, 0x200000000000001, 0x0) setsockopt$sock_attach_bpf(r3, 0x0, 0x4, 0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r4, 0xffffffffffffffff}, &(0x7f0000000280), &(0x7f0000000200)='%ps \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r5}, 0x4) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000), 0xc) sendmsg$inet(r3, 0x0, 0x20040800) socket$kcm(0x11, 0x200000000000002, 0x300) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) close(0x3) 1.130056509s ago: executing program 3 (id=10103): perf_event_open(&(0x7f0000000140)={0x2, 0xfffffffffffffeb4, 0x5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x2, @perf_bp={0x0}, 0x8000, 0x10000, 0x9e0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1c, 0x4, 0x2, 0x0, 0x201, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0xffffffff}, 0x48) 745.97956ms ago: executing program 3 (id=10104): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x28200, 0x0) ioctl$TUNDETACHFILTER(r1, 0x401054d6, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0xd040, 0x10000}, 0x14403, 0xfffc, 0x0, 0x5, 0x582, 0x20005, 0x8, 0x0, 0x0, 0x0, 0x80000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x7, 0x0, 0x1, 0xb7, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4, 0x3}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4d, 0x4d, 0xb, [@datasec={0xe, 0x3, 0x0, 0xf, 0x1, [{0x3, 0x8}, {0x3, 0x7d, 0x7}, {0x2, 0x3, 0x1}], "14"}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x4, 0x3}, @func={0xf, 0x0, 0x0, 0xc, 0x2}]}, {0x0, [0x30, 0x2e, 0x0, 0x5f, 0x0, 0x51, 0x61, 0x61, 0x61]}}, &(0x7f0000000440)=""/64, 0x73, 0x40, 0x1, 0x0, 0x10000}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800"/16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0xa1, &(0x7f00000011c0)=[{&(0x7f0000000080)="5c00000011006bec9e3be35c6e17aa31076b876c0d000000ba090000160af3653c001ac00400020208000200030001002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x2000c090) (fail_nth: 2) r3 = socket$kcm(0x2, 0x3, 0x84) sendmsg$inet(r3, &(0x7f0000001000)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000000400)=[{&(0x7f0000001040)}, {&(0x7f0000000740)="0d113311d7af2c7d0a6b8bcc9ab77974b333be01b290ffa314fa9cb227694f5b326544c9c1d4563f937db955e0373639d6292234c292c5615d82c851b91585b7ad8748faf0d8e5d65994adbb137c7851edbb4a3485ffd64e1caf3117861898d4ba6e04c15a94496cc8c23793136c93ba88db52f098b37fcf3f6c16df2f500f5b2005def16d46d96544649249c26098820ed60c94032f6fc134664ae10a613d15d140a948b4b45471dea34c0f527fca192dfa77f262ec22b914476238014687f231fe251b57f7689e4850e2c1eaf49ad1773a1f971ba9d8a900e5e2121370ebf1a0c8af1eca3921046277767b7740008731fdcffcddbc2cb867ea2959a735c164e4c650454d43dd6034dd22e31d94df846ab6d1b1e7c2463e349ffda978a5e783bdda9e6fafb2ca73fb02ccc54ab9309988741fdfbef9000b605a2d3890468834f7d7f705f8da1905283343b78f30bc48c2c3c351e955823ca8e6e82f695252f0aecc64025cf1e26d4be77f4b4f96d9b45226436aa43cc78afe578fe8c44047eb9f66bfbc3f3daeaadda3c088299586d35c7a868a8122428161cff48106cd5529695a27ba78f1d124cab474705be18a40ad26131f48d25f1e1c7a19e23433ff6d6284cf70278d53d12b41a171ec23143601a31732cf143f386a4fdc49bd8f1c10af3a4a3f2d8afdd131cdee0e6aebfdc1fef1831abaa01741cf774eeed7a043d6368c2fd43371633089fa9fa50c7e41185d32cdbc49c0bec369fdd7ab788bbe8cc87676f8597dc626556bbaef0bcd5e1a43bcc4e2c59f310e1c2bf2fea0f360b33408fb2e1a1024e3d88dff19496f384b0b4ea97c0281904010a7eb34a3d6bec959f6d59a0016d28da834b382e6e2c606236dcd17925b95f667e899a6b59ef20c1a96f0053ffb7c5a07b8ac6f20fa791d15c19b814f049e0b2da6f5799daf4d345aa475766367f99c160e8a08fd7f1e42e5b38eacba4f40eed3fccbfb89f4b644afb1e76eb4913e27e1540e2d4ec8ed8748b4756824a65c933d4120d1c2fc7f343ce0958478a97aa352fc2ddaf917fb2ae7bcce4d6f9d4b32387baff970a701ce01a73937cf0f12f6e41b86a06ea1b971d1ad7f92c0562a7778ec6c060000717217834e25b4b25f06134bbfc29f125c36c7e80e92a13127c70b37da8f1be6a3948593a6693fa07a91b00405d8ea47c88ccd02e7a64e0bd31d115c93f7c0dfe1c51d338b08c9825a29802ba8bc5c4655072da6dd2c27ce6684e1c2dd7dc95dcf90f934ade45fe5377a813975aefe4006ddb535f03db5a82f71f50cc7935c6809c73e705e84a959f70ff71df55ecce6a4a182fe3ef45a506fcd0f49b6eb9e9cbc8cd553481b9162a9086bf31c8cab7b1c3c7f703cd26d96b48dee0771b4a6d2513a37fec94a6649cfdbafc26b17a7bb2adb72477d34a74e4165850f76473f41c116e7adec0bdafae8aff515c781092e2d2f70fefebbd36d0e1cf5a01ea61f142756b8195e1fc400ca73162eb51d3a14a1c8ea2be43d3bbc230c7011273c1c9f035895fa45e8ba5eb8bef0660e952f3327720bd3817d098277b01ee0d8394a4d7752866da8f3258f243150df19ddb87ea24bc2f5de0394870e23a0f723013a226caa72e896e9f986e9aa40a6a4a21cfb6cebbbeb334ed7c0996c827c6790bf2323df6ab44f3aaceef33bbf9f89c915eda91a6e2aa5015a68235006cdb7f6759e734dd5368124d72157933add614947339323746ff9fdba836fc39e5cf85c8727d624f52bdf5ccde7b4c94e8989c0b845dd7ee12c7766f9b37d2a7f2439ce7fa05741e9fd4f7ab3c691261913bc3196802f9513b3a87500913f9760dd837b1248550e837e2b4d83c1f557d16a09424d7ca76597d9eb201b43340754acb32dc6b4b8f4c41806dd5436e70bc83f5f97d968d13cd445f3b58fbb2cba65299edda4412a0b8e9274f01fc3f4485e9e72998f74c4ef3eba0e948797023bb49e04ce901785b59782b77e15f1bdd50bae89c43361ea78e1f0b6f6e0b985cc9d1b35c088c08ff17e615572ef52514a71885552d787aff1e1525b9d45800b0497539749a9f7b2c74ef9326e83b591a47bae8a143dcaa5a1f3b362a9f33da53855175a2aa716c38c57225359e3f2fdf0fc140af79c8e058b5ae5699505fc58a9d5161de529c20c1cef3fb021c0f0c375487583", 0x60b}], 0x2}, 0x0) socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x25, 0x0, 0x2, 0xcf3}, {0x5, 0x0, 0x80}, {0x0, 0x0, 0x0, 0x3}, {0x6, 0x0, 0x0, 0x100b100}]}) 651.924912ms ago: executing program 1 (id=10105): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/13, @ANYRES32=0x0, @ANYRES32], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000d40)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180900000000000000000000000000008500000050"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000}, 0x94) r0 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') 512.674286ms ago: executing program 0 (id=10106): perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000, 0x60000, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0xca, 0x5, 0x0, 0x0, 0x10, 0x0, 0x0, 0xfffffffe, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x4612, 0xffffffffffffffff}, 0x114105, 0x6, 0x9, 0x1, 0x0, 0x40000, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r2) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r1], 0x12) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000080)={0x2, &(0x7f0000000040)=[{0x28, 0x20, 0x0, 0xfffff034}, {0x6, 0x3, 0x0, 0xfffffffc}]}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000100)=@qipcrtr={0x2a, 0x4, 0x1}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)="27031c00160014000000002f1eafacf706e105000000894f00050003ee0b80558ddbba9b37786fd808252372a31e4939884f0abc3c", 0x35}, {&(0x7f0000001980)="0276dd88a8", 0x5}], 0x2}, 0x24004010) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{}, &(0x7f0000000180)=0x20000, &(0x7f00000001c0)=r8}, 0x20) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x11540, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000042000000000000000000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008000000bc09000000000000450901003f20000095000000f9ffffffb6020000000000000b9d94e9e37e4dad000000bf2700000000000107080000fffdffffbfa400000000000007040000f0ffffffc40700000800000018220000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7050000080000004608efff76000000bf9800000000000056090000020000008500000005000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f00000002c0)=ANY=[@ANYBLOB="b7000000ff00001fbfa300000000000007030000f0ffffff620af0fff8ffffff79a4f0ff000000002d040200000000001d400200000000004704000001ed000062030000000000001d44feff000000007a0a00fe00ffffffc3030000f1000000b5040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebaa2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd5070ce5c24099d3f18079ebbea6f1707207acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b28753531d3f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d156ae8383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15f279b513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aa0000000000000000832371fe5bc621426d1ed0a4a99702cc1b692c3f0b15629eaf4c12a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbad937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594807031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac42738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca9be8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998802008f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91ed92cac7c2ccd17d338bbda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922928e000000ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abb8a9982ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c7636f9d1b88caadef8930fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139566fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb8bc70000a4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe6290421338ef8f6d27117cd1471bf3c0b64416fbbe955da0281e7ef7f7d5176150e86cda98d07f7de2088cb2ffd1d4c71097635c2bb3d9a0b01e757256ee427f0a244d48682bf89e2279b383b616b40f116172bc1b995eb2c1220597af8df52646f1f0cb65cfa7e038e8bb5d4d52b86a61d82dc14a4f5cc7e6061c65ccdbc2afc3f363ecf34ad0b227687c3ea8d63683ddd5914116edd9e075da9e3638647188bc8f95107c9250995eb6cadcd0f65b8504ff10304f2ceba275f9d485ed5554d64005db877f0fbb3beba596684066f132d5077835823592d6d392f5ff62f6f876eb10d8cbf0a73f8421b74c8916e4077b8866c95ad88bc7130244183ed216210f10f69b3e0ee13d06e4eb240cce5ec1c3b1defe4c0f8b83a34ef4f5f8f9ceefb678ad29d3683e3c44a01549e55ffca41c0b06e013f054257646c58b667ec0701004c239589b3e64ef5e1d5ed22b5fd5a90fe3453327c3652d5c9762428f0bd0178d1b80a60f64343ab77d8baa0a388711c8d2d6d3e9049814b15b6ea21387040989d69c3aa27256c55780f33d20823d8e2eb6e56850162969bf4c6c9632a55cf5be00"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd64}, 0x48) 69.314868ms ago: executing program 1 (id=10107): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x1, 0x2, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_config_ext={0x9, 0x2}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r0, 0x0, 0x10001) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x6401b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0xffffffffffffff00}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYRESHEX=r0], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x3, 0x5, &(0x7f0000000000)=ANY=[], &(0x7f0000000680)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000500)="9b0cb39bf267ce9b5ddf3432ca97", 0x0, 0x14, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf}, 0x125, 0x2, 0xfffffffe, 0x0, 0x0, 0x7, 0x9, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x24020054) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x80) write$cgroup_subtree(r2, 0x0, 0xfe33) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x644b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x2}, 0x8004, 0xcdd, 0x43a1bd76, 0x4, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) socket$kcm(0x2, 0x5, 0x84) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000080)='mem\x00\x10\x00\x00\x00\x00\x00\x00I\xa2l') r4 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000080)) write$cgroup_subtree(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="b968732c16b8c1935317493a9f849e00b8b8440ae4535943397bd3c67de7962fadd59dade686077a2fbbd0a86930f7155641ad4d2c4d8b7a49465661a0a6a83d8f8ef61a5036855491e6adf9a54c1ea7acf5f6e9438c6487794fcce2c1f607f044c000cad8855797e5a10b79584248c8a2fe1e"], 0x4) r5 = bpf$PROG_LOAD(0x5, 0x0, 0xfffffe1f) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r3}, &(0x7f0000000340), &(0x7f0000000380)=r5}, 0x20) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_user\x00', 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000a8000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) 0s ago: executing program 2 (id=10108): socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0xa, 0x985781883c6ef0dd, 0x3a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) r2 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(r2, &(0x7f00000010c0)={&(0x7f0000000140)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)=[{&(0x7f00000000c0)="654d03cd609b5cf204410a3d69e43dbbc4ff9e5f6bd617ccd306efbd227539741b45447b75cfa9ea4d455c7b9489aec5d710a056dab1e5be950ba7ba3c", 0x3d}], 0x1}, 0x4000040) (fail_nth: 13) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) ioctl$TUNATTACHFILTER(r3, 0x401054d5, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x30, 0xfa, 0x4, 0xfffff008}, {0x6, 0x5, 0xe, 0x7}]}) sendmsg$inet(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e21, @private=0xa010100}, 0x10, &(0x7f0000000700)=[{&(0x7f0000000180)="84", 0x1}], 0x1}, 0x8040) r4 = socket$kcm(0x1e, 0x1, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000008c0), 0x43) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r6 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r6, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r6, &(0x7f0000000040)=ANY=[], 0xfdef) close(r2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) r7 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000440)="5c00000014006b030231a6080c000af32c00000000f800250502000f00e5aa000017d34460bc24eab556bd05251e6182949a2756f475ce36c2d13b48df000000000000ecb8f6ec63c9f4d4938037e786a6d1bdd700e6657594f1817d", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000080)="2e00000010008188040f46ecdb4cb9cca7480ef431000000e3bd6efb010509000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x8000) kernel console output (not intermixed with test programs): ng attributes in process `syz.0.9386'. [ 1553.530271][T31243] netlink: 'syz.0.9386': attribute type 10 has an invalid length. [ 1553.575271][T31243] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1553.602100][T31243] team0: Port device batadv0 added [ 1553.731282][T31255] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.9391'. [ 1553.751007][T31255] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9391'. [ 1554.523262][T31274] netlink: 142592 bytes leftover after parsing attributes in process `syz.1.9394'. [ 1554.538415][T31274] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9394'. [ 1554.653774][T31277] netlink: 'syz.2.9400': attribute type 10 has an invalid length. [ 1554.671096][T31277] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.9400'. [ 1554.857574][T31279] netlink: 'syz.2.9400': attribute type 10 has an invalid length. [ 1555.647208][T31304] netlink: 144316 bytes leftover after parsing attributes in process `syz.3.9408'. [ 1555.658066][T31304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9408'. [ 1555.691877][T31305] netlink: 142592 bytes leftover after parsing attributes in process `syz.2.9409'. [ 1555.711991][T31305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9409'. [ 1557.302682][T31338] syzkaller0: entered promiscuous mode [ 1557.312252][T31338] syzkaller0: entered allmulticast mode [ 1559.470521][T31358] netlink: 'syz.0.9429': attribute type 29 has an invalid length. [ 1559.479856][T31358] netlink: 'syz.0.9429': attribute type 29 has an invalid length. [ 1559.492011][T31358] netlink: 'syz.0.9429': attribute type 29 has an invalid length. [ 1559.501191][T31358] netlink: 'syz.0.9429': attribute type 29 has an invalid length. [ 1559.509960][T31358] netlink: 'syz.0.9429': attribute type 29 has an invalid length. [ 1559.948153][T31376] __nla_validate_parse: 4 callbacks suppressed [ 1559.948171][T31376] netlink: 142592 bytes leftover after parsing attributes in process `syz.3.9436'. [ 1559.972656][T31376] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9436'. [ 1559.997504][T31379] netlink: 'syz.1.9439': attribute type 16 has an invalid length. [ 1560.007908][T31379] netlink: 'syz.1.9439': attribute type 25 has an invalid length. [ 1560.016424][T31379] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9439'. [ 1560.119425][T31383] netlink: 'syz.0.9441': attribute type 10 has an invalid length. [ 1560.128102][T31383] netlink: 9279 bytes leftover after parsing attributes in process `syz.0.9441'. [ 1560.985856][T31402] netlink: 60 bytes leftover after parsing attributes in process `syz.2.9450'. [ 1561.097730][T31405] netlink: 'syz.3.9452': attribute type 29 has an invalid length. [ 1561.124926][T31405] netlink: 'syz.3.9452': attribute type 29 has an invalid length. [ 1561.425757][T31409] FAULT_INJECTION: forcing a failure. [ 1561.425757][T31409] name failslab, interval 1, probability 0, space 0, times 0 [ 1561.478142][T31409] CPU: 0 PID: 31409 Comm: syz.0.9453 Not tainted syzkaller #0 [ 1561.485810][T31409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1561.495942][T31409] Call Trace: [ 1561.499300][T31409] [ 1561.502290][T31409] dump_stack_lvl+0x18c/0x250 [ 1561.507060][T31409] ? show_regs_print_info+0x20/0x20 [ 1561.512332][T31409] ? load_image+0x420/0x420 [ 1561.516918][T31409] ? __might_sleep+0xe0/0xe0 [ 1561.521594][T31409] ? __lock_acquire+0x7d80/0x7d80 [ 1561.526722][T31409] should_fail_ex+0x394/0x4c0 [ 1561.531505][T31409] should_failslab+0x9/0x20 [ 1561.536105][T31409] slab_pre_alloc_hook+0x59/0x300 [ 1561.541228][T31409] ? tomoyo_encode+0x2ad/0x570 [ 1561.546088][T31409] ? tomoyo_encode+0x2ad/0x570 [ 1561.550940][T31409] __kmem_cache_alloc_node+0x53/0x250 [ 1561.556410][T31409] ? tomoyo_encode+0x2ad/0x570 [ 1561.561278][T31409] __kmalloc+0xa7/0x240 [ 1561.565532][T31409] tomoyo_encode+0x2ad/0x570 [ 1561.570230][T31409] tomoyo_realpath_from_path+0x57c/0x5c0 [ 1561.575953][T31409] ? tomoyo_domain+0xd6/0x120 [ 1561.580745][T31409] tomoyo_path_number_perm+0x248/0x5e0 [ 1561.586296][T31409] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1561.592007][T31409] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1561.597565][T31409] ? ksys_write+0x1d2/0x260 [ 1561.602269][T31409] ? __fget_files+0x28/0x460 [ 1561.606985][T31409] security_file_ioctl+0x70/0xa0 [ 1561.612009][T31409] __se_sys_ioctl+0x48/0x170 [ 1561.616691][T31409] do_syscall_64+0x55/0xb0 [ 1561.621194][T31409] ? clear_bhb_loop+0x40/0x90 [ 1561.625946][T31409] ? clear_bhb_loop+0x40/0x90 [ 1561.630720][T31409] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1561.636683][T31409] RIP: 0033:0x7fd7c7b9e159 [ 1561.641172][T31409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1561.660863][T31409] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1561.669376][T31409] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1561.677413][T31409] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000000d [ 1561.685439][T31409] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1561.693468][T31409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1561.701511][T31409] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1561.709600][T31409] [ 1561.904328][T31409] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1561.929286][T31409] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1563.446069][T31435] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.9463'. [ 1563.664157][T31450] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9468'. [ 1565.196561][T31506] FAULT_INJECTION: forcing a failure. [ 1565.196561][T31506] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1565.231401][T31506] CPU: 1 PID: 31506 Comm: syz.0.9487 Not tainted syzkaller #0 [ 1565.239029][T31506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1565.248654][T31510] validate_nla: 2 callbacks suppressed [ 1565.248694][T31510] netlink: 'syz.1.9489': attribute type 1 has an invalid length. [ 1565.249126][T31506] Call Trace: [ 1565.249139][T31506] [ 1565.249149][T31506] dump_stack_lvl+0x18c/0x250 [ 1565.262486][T31510] netlink: 101600 bytes leftover after parsing attributes in process `syz.1.9489'. [ 1565.265682][T31506] ? show_regs_print_info+0x20/0x20 [ 1565.265715][T31506] ? load_image+0x420/0x420 [ 1565.265740][T31506] ? __lock_acquire+0x7d80/0x7d80 [ 1565.265767][T31506] ? snprintf+0xe9/0x140 [ 1565.265789][T31506] should_fail_ex+0x394/0x4c0 [ 1565.306570][T31506] _copy_to_user+0x2f/0xa0 [ 1565.309764][T31510] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.9489'. [ 1565.311028][T31506] simple_read_from_buffer+0xe7/0x150 [ 1565.311062][T31506] proc_fail_nth_read+0x1e8/0x260 [ 1565.311096][T31506] ? proc_fault_inject_write+0x360/0x360 [ 1565.311130][T31506] ? fsnotify_perm+0x271/0x5e0 [ 1565.311157][T31506] ? proc_fault_inject_write+0x360/0x360 [ 1565.311188][T31506] vfs_read+0x298/0x990 [ 1565.311222][T31506] ? kernel_read+0x1e0/0x1e0 [ 1565.311252][T31506] ? __fget_files+0x28/0x460 [ 1565.311281][T31506] ? __fget_files+0x3fc/0x460 [ 1565.311319][T31506] ? __fdget_pos+0x2a3/0x330 [ 1565.311345][T31506] ? ksys_read+0x74/0x260 [ 1565.311376][T31506] ksys_read+0x151/0x260 [ 1565.311407][T31506] ? vfs_write+0x9a0/0x9a0 [ 1565.311440][T31506] ? lockdep_hardirqs_on+0x98/0x150 [ 1565.311474][T31506] do_syscall_64+0x55/0xb0 [ 1565.311497][T31506] ? clear_bhb_loop+0x40/0x90 [ 1565.311522][T31506] ? clear_bhb_loop+0x40/0x90 [ 1565.311548][T31506] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1565.311573][T31506] RIP: 0033:0x7fd7c7b5e98e [ 1565.311592][T31506] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1565.311611][T31506] RSP: 002b:00007fd7c89b9fe8 EFLAGS: 00000246 [ 1565.326726][T31510] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 1565.331307][T31506] ORIG_RAX: 0000000000000000 [ 1565.331320][T31506] RAX: ffffffffffffffda RBX: 00007fd7c89ba6c0 RCX: 00007fd7c7b5e98e [ 1565.331339][T31506] RDX: 000000000000000f RSI: 00007fd7c89ba0a0 RDI: 000000000000000c [ 1565.331355][T31506] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1565.331370][T31506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1565.331385][T31506] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1565.355900][T31510] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 1565.356326][T31506] [ 1565.652156][T31515] FAULT_INJECTION: forcing a failure. [ 1565.652156][T31515] name failslab, interval 1, probability 0, space 0, times 0 [ 1565.693548][T31515] CPU: 1 PID: 31515 Comm: syz.0.9492 Not tainted syzkaller #0 [ 1565.701214][T31515] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1565.711307][T31515] Call Trace: [ 1565.714605][T31515] [ 1565.717565][T31515] dump_stack_lvl+0x18c/0x250 [ 1565.722293][T31515] ? lockdep_hardirqs_on+0x98/0x150 [ 1565.727535][T31515] ? show_regs_print_info+0x20/0x20 [ 1565.732769][T31515] ? __sanitizer_cov_trace_pc+0x4/0x60 [ 1565.738257][T31515] should_fail_ex+0x394/0x4c0 [ 1565.742977][T31515] should_failslab+0x9/0x20 [ 1565.747538][T31515] slab_pre_alloc_hook+0x59/0x300 [ 1565.752642][T31515] ? ip6_setup_cork+0x513/0xff0 [ 1565.757539][T31515] ? ip6_setup_cork+0x513/0xff0 [ 1565.762435][T31515] __kmem_cache_alloc_node+0x53/0x250 [ 1565.767840][T31515] ? ip6_setup_cork+0x513/0xff0 [ 1565.772741][T31515] __kmalloc_node_track_caller+0xa4/0x230 [ 1565.778503][T31515] kmemdup+0x2b/0x70 [ 1565.782438][T31515] ip6_setup_cork+0x513/0xff0 [ 1565.787162][T31515] ip6_append_data+0x21a/0x350 [ 1565.791979][T31515] ? ip_skb_dst_mtu+0x9c0/0x9c0 [ 1565.796861][T31515] l2tp_ip6_sendmsg+0x122c/0x1680 [ 1565.801999][T31515] ? l2tp_ip6_destroy_sock+0x60/0x60 [ 1565.807439][T31515] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 1565.813910][T31515] ? sock_rps_record_flow+0x19/0x3f0 [ 1565.819245][T31515] ? inet_sendmsg+0x7e/0x2a0 [ 1565.823872][T31515] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1565.829191][T31515] ? inet_send_prepare+0x250/0x250 [ 1565.834336][T31515] ____sys_sendmsg+0x61b/0x980 [ 1565.839131][T31515] ? __sys_sendmsg_sock+0x30/0x30 [ 1565.844184][T31515] ? __import_iovec+0x3fa/0x850 [ 1565.849073][T31515] ? import_iovec+0x73/0xa0 [ 1565.853619][T31515] ___sys_sendmsg+0x2a6/0x360 [ 1565.858326][T31515] ? __sys_sendmsg+0x2b0/0x2b0 [ 1565.863129][T31515] ? ktime_get+0x7f/0x280 [ 1565.867512][T31515] __se_sys_sendmsg+0x1d0/0x2c0 [ 1565.872390][T31515] ? perf_trace_preemptirq_template+0x269/0x330 [ 1565.878661][T31515] ? __x64_sys_sendmsg+0x80/0x80 [ 1565.883663][T31515] ? lockdep_hardirqs_on+0x98/0x150 [ 1565.888918][T31515] do_syscall_64+0x55/0xb0 [ 1565.893394][T31515] ? clear_bhb_loop+0x40/0x90 [ 1565.898101][T31515] ? clear_bhb_loop+0x40/0x90 [ 1565.902814][T31515] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1565.908769][T31515] RIP: 0033:0x7fd7c7b9e159 [ 1565.913212][T31515] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1565.932856][T31515] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1565.941285][T31515] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1565.949304][T31515] RDX: 0000000000000000 RSI: 0000200000001180 RDI: 0000000000000005 [ 1565.957303][T31515] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1565.965309][T31515] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1565.973304][T31515] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1565.981331][T31515] [ 1566.239209][T31529] netlink: 'syz.1.9496': attribute type 29 has an invalid length. [ 1566.302655][T31517] syzkaller0: entered promiscuous mode [ 1566.308931][T31517] syzkaller0: entered allmulticast mode [ 1566.321789][T31527] netlink: 'syz.2.9497': attribute type 7 has an invalid length. [ 1566.331267][T31528] netlink: 'syz.2.9497': attribute type 7 has an invalid length. [ 1566.403640][T31529] netlink: 'syz.1.9496': attribute type 29 has an invalid length. [ 1566.427561][T31535] netlink: 'syz.1.9496': attribute type 29 has an invalid length. [ 1568.568642][T31555] žÿ: renamed from team_slave_1 [ 1568.747486][T31570] netlink: 142592 bytes leftover after parsing attributes in process `syz.3.9509'. [ 1568.771323][T31572] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1568.778711][T31572] IPv6: NLM_F_CREATE should be set when creating new route [ 1568.786153][T31572] IPv6: NLM_F_CREATE should be set when creating new route [ 1568.793496][T31572] IPv6: NLM_F_CREATE should be set when creating new route [ 1568.797781][T31570] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9509'. [ 1568.857346][T31569] netlink: 'syz.1.9510': attribute type 9 has an invalid length. [ 1568.869477][T31569] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.9510'. [ 1569.007643][T31583] netlink: 'syz.0.9513': attribute type 29 has an invalid length. [ 1569.017266][T31583] netlink: 'syz.0.9513': attribute type 29 has an invalid length. [ 1569.077930][T31583] netlink: 'syz.0.9513': attribute type 29 has an invalid length. [ 1569.091889][T31574] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.9510'. [ 1569.437940][T31593] netlink: 212912 bytes leftover after parsing attributes in process `syz.0.9518'. [ 1569.448689][T31593] openvswitch: netlink: IP tunnel dst address not specified [ 1569.669358][T31601] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9522'. [ 1569.817916][T31611] netlink: 144316 bytes leftover after parsing attributes in process `syz.1.9520'. [ 1569.828555][T31611] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9520'. [ 1569.962019][T31617] FAULT_INJECTION: forcing a failure. [ 1569.962019][T31617] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1569.975367][T31617] CPU: 1 PID: 31617 Comm: syz.3.9529 Not tainted syzkaller #0 [ 1569.982898][T31617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1569.992991][T31617] Call Trace: [ 1569.996289][T31617] [ 1569.999230][T31617] dump_stack_lvl+0x18c/0x250 [ 1570.003943][T31617] ? show_regs_print_info+0x20/0x20 [ 1570.009188][T31617] ? load_image+0x420/0x420 [ 1570.013736][T31617] ? __might_fault+0xaa/0x120 [ 1570.018464][T31617] ? __lock_acquire+0x7d80/0x7d80 [ 1570.023657][T31617] ? mark_lock+0x94/0x320 [ 1570.028063][T31617] should_fail_ex+0x394/0x4c0 [ 1570.032798][T31617] _copy_from_user+0x2f/0xe0 [ 1570.037428][T31617] get_user_ifreq+0x6b/0x180 [ 1570.042044][T31617] inet_ioctl+0x357/0x560 [ 1570.046422][T31617] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1570.052197][T31617] ? inet_shutdown+0x370/0x370 [ 1570.057002][T31617] ? slab_free_freelist_hook+0x130/0x1a0 [ 1570.062681][T31617] ? tomoyo_path_number_perm+0x4b7/0x5e0 [ 1570.068367][T31617] ? __kmem_cache_free+0xba/0x1f0 [ 1570.073468][T31617] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1570.078991][T31617] sock_do_ioctl+0xfc/0x310 [ 1570.083559][T31617] ? sock_show_fdinfo+0xb0/0xb0 [ 1570.088486][T31617] sock_ioctl+0x5be/0x7e0 [ 1570.092875][T31617] ? sock_poll+0x3e0/0x3e0 [ 1570.097356][T31617] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1570.102332][T31617] ? security_file_ioctl+0x80/0xa0 [ 1570.107470][T31617] ? sock_poll+0x3e0/0x3e0 [ 1570.111933][T31617] __se_sys_ioctl+0xfd/0x170 [ 1570.116573][T31617] do_syscall_64+0x55/0xb0 [ 1570.121025][T31617] ? clear_bhb_loop+0x40/0x90 [ 1570.125729][T31617] ? clear_bhb_loop+0x40/0x90 [ 1570.130444][T31617] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1570.136363][T31617] RIP: 0033:0x7fbbb019e159 [ 1570.140807][T31617] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1570.160434][T31617] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1570.168898][T31617] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1570.176909][T31617] RDX: 0000200000000040 RSI: 000000000000891b RDI: 0000000000000003 [ 1570.184899][T31617] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1570.192912][T31617] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1570.200913][T31617] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1570.208924][T31617] [ 1570.843985][T31635] __nla_validate_parse: 2 callbacks suppressed [ 1570.844004][T31635] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9533'. [ 1570.905439][T31635] bridge0: port 1(bridge_slave_0) entered disabled state [ 1571.334322][T31635] bridge_slave_0 (unregistering): left allmulticast mode [ 1571.399273][T31635] bridge_slave_0 (unregistering): left promiscuous mode [ 1571.453634][T31635] bridge0: port 1(bridge_slave_0) entered disabled state [ 1571.574069][T31640] validate_nla: 3 callbacks suppressed [ 1571.574086][T31640] netlink: 'syz.2.9534': attribute type 17 has an invalid length. [ 1571.594589][T31640] netlink: 'syz.2.9534': attribute type 16 has an invalid length. [ 1571.602607][T31640] netlink: 152 bytes leftover after parsing attributes in process `syz.2.9534'. [ 1572.198478][T31668] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9543'. [ 1572.207945][T31668] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9543'. [ 1573.121875][T31695] netlink: 'syz.3.9555': attribute type 3 has an invalid length. [ 1573.129954][T31695] netlink: 'syz.3.9555': attribute type 1 has an invalid length. [ 1573.137900][T31695] netlink: 181400 bytes leftover after parsing attributes in process `syz.3.9555'. [ 1573.396889][T31706] FAULT_INJECTION: forcing a failure. [ 1573.396889][T31706] name failslab, interval 1, probability 0, space 0, times 0 [ 1573.409920][T31706] CPU: 0 PID: 31706 Comm: syz.3.9559 Not tainted syzkaller #0 [ 1573.417404][T31706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1573.427502][T31706] Call Trace: [ 1573.430820][T31706] [ 1573.433780][T31706] dump_stack_lvl+0x18c/0x250 [ 1573.438513][T31706] ? show_regs_print_info+0x20/0x20 [ 1573.443752][T31706] ? load_image+0x420/0x420 [ 1573.448298][T31706] ? __lock_acquire+0x1262/0x7d80 [ 1573.453382][T31706] should_fail_ex+0x394/0x4c0 [ 1573.458125][T31706] should_failslab+0x9/0x20 [ 1573.462705][T31706] slab_pre_alloc_hook+0x59/0x300 [ 1573.467789][T31706] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1573.473206][T31706] ? ___neigh_create+0x6f4/0x23d0 [ 1573.478277][T31706] ? ___neigh_create+0x6f4/0x23d0 [ 1573.483366][T31706] __kmem_cache_alloc_node+0x53/0x250 [ 1573.488817][T31706] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1573.494240][T31706] ? ___neigh_create+0x6f4/0x23d0 [ 1573.499333][T31706] __kmalloc+0xa7/0x240 [ 1573.503534][T31706] ___neigh_create+0x6f4/0x23d0 [ 1573.508444][T31706] ? __nf_conntrack_confirm+0xb5/0xd50 [ 1573.513956][T31706] ip_neigh_gw4+0x351/0x4d0 [ 1573.518496][T31706] ? ip_finish_output2+0x1260/0x1260 [ 1573.523819][T31706] ? ip_finish_output2+0x45a/0x1260 [ 1573.529058][T31706] ip_finish_output2+0xf99/0x1260 [ 1573.534110][T31706] ? nf_hook+0x314/0x390 [ 1573.538396][T31706] ? nf_hook+0xa2/0x390 [ 1573.542576][T31706] ? __ip_local_out+0x5f0/0x5f0 [ 1573.547458][T31706] ? ip_fragment+0x210/0x210 [ 1573.552072][T31706] ? ip_mc_finish_output+0x260/0x260 [ 1573.557410][T31706] ? ip_skb_dst_mtu+0x586/0x9c0 [ 1573.562283][T31706] ? ip_finish_output+0x3ec/0x4c0 [ 1573.567356][T31706] ip_output+0x2a5/0x3a0 [ 1573.571615][T31706] ? ip_output+0x5a/0x3a0 [ 1573.575980][T31706] iptunnel_xmit+0x4d0/0x910 [ 1573.580641][T31706] ip_tunnel_xmit+0x1d18/0x25b0 [ 1573.585540][T31706] ? ip4_dst_hoplimit+0x2d0/0x2d0 [ 1573.590597][T31706] ? validate_xmit_xfrm+0xbb/0x1340 [ 1573.595888][T31706] ? skb_push+0x8e/0xe0 [ 1573.600085][T31706] ipgre_xmit+0x7eb/0xb70 [ 1573.604439][T31706] dev_hard_start_xmit+0x269/0x790 [ 1573.609592][T31706] ? __dev_queue_xmit+0x275/0x3640 [ 1573.614732][T31706] __dev_queue_xmit+0x198c/0x3640 [ 1573.619799][T31706] ? __dev_queue_xmit+0x275/0x3640 [ 1573.624960][T31706] ? netdev_core_pick_tx+0x370/0x370 [ 1573.630291][T31706] ? pskb_expand_head+0x17a/0x1150 [ 1573.635430][T31706] ? pskb_expand_head+0x17a/0x1150 [ 1573.640573][T31706] ? skb_release_data+0x1de/0x7f0 [ 1573.645635][T31706] ? __bpf_redirect+0x4d1/0xdf0 [ 1573.650523][T31706] __bpf_tx_skb+0x181/0x260 [ 1573.655080][T31706] bpf_clone_redirect+0x315/0x4a0 [ 1573.660144][T31706] bpf_prog_169a6ad24ef2d602+0x5e/0x63 [ 1573.665625][T31706] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1573.671624][T31706] ? __lock_acquire+0x7d80/0x7d80 [ 1573.676672][T31706] ? lock_chain_count+0x20/0x20 [ 1573.681682][T31706] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 1573.687985][T31706] ? lockdep_softirqs_on+0x5b0/0x5b0 [ 1573.693297][T31706] ? ktime_get+0x7f/0x280 [ 1573.697656][T31706] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 1573.703949][T31706] ? ktime_get_real_ts64+0x440/0x440 [ 1573.709272][T31706] ? __x64_sys_bpf+0x7c/0x90 [ 1573.713898][T31706] ? __local_bh_disable_ip+0x108/0x1a0 [ 1573.719484][T31706] ? __cant_sleep+0x220/0x220 [ 1573.724219][T31706] ? read_tsc+0x9/0x20 [ 1573.728366][T31706] ? ktime_get+0x24b/0x280 [ 1573.732823][T31706] ? bpf_test_run+0x174/0x870 [ 1573.737566][T31706] bpf_test_run+0x2df/0x870 [ 1573.742115][T31706] ? bpf_test_run+0x174/0x870 [ 1573.746822][T31706] ? dst_hold+0x70/0x70 [ 1573.751010][T31706] ? eth_get_headlen+0x210/0x210 [ 1573.755975][T31706] ? convert___skb_to_skb+0x3d/0x590 [ 1573.761290][T31706] bpf_prog_test_run_skb+0xdbb/0x18f0 [ 1573.766705][T31706] ? cpu_online+0x60/0x60 [ 1573.771069][T31706] bpf_prog_test_run+0x31f/0x390 [ 1573.776077][T31706] __sys_bpf+0x49d/0x890 [ 1573.780365][T31706] ? bpf_link_show_fdinfo+0x390/0x390 [ 1573.785787][T31706] ? lock_chain_count+0x20/0x20 [ 1573.790698][T31706] __x64_sys_bpf+0x7c/0x90 [ 1573.795142][T31706] do_syscall_64+0x55/0xb0 [ 1573.799587][T31706] ? clear_bhb_loop+0x40/0x90 [ 1573.804320][T31706] ? clear_bhb_loop+0x40/0x90 [ 1573.809021][T31706] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1573.814939][T31706] RIP: 0033:0x7fbbb019e159 [ 1573.819379][T31706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1573.839004][T31706] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1573.847452][T31706] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1573.855448][T31706] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 1573.863450][T31706] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1573.871451][T31706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1573.879452][T31706] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1573.887465][T31706] [ 1574.155811][T31717] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9560'. [ 1574.167389][T31717] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9560'. [ 1574.392375][T31725] netlink: 'syz.2.9566': attribute type 13 has an invalid length. [ 1574.772112][T31741] FAULT_INJECTION: forcing a failure. [ 1574.772112][T31741] name failslab, interval 1, probability 0, space 0, times 0 [ 1574.786359][T31741] CPU: 0 PID: 31741 Comm: syz.2.9572 Not tainted syzkaller #0 [ 1574.793914][T31741] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1574.804041][T31741] Call Trace: [ 1574.807389][T31741] [ 1574.810388][T31741] dump_stack_lvl+0x18c/0x250 [ 1574.815157][T31741] ? show_regs_print_info+0x20/0x20 [ 1574.820447][T31741] ? load_image+0x420/0x420 [ 1574.825035][T31741] ? __might_sleep+0xe0/0xe0 [ 1574.829737][T31741] ? __lock_acquire+0x7d80/0x7d80 [ 1574.834879][T31741] ? trace_contention_end+0x39/0xe0 [ 1574.840187][T31741] should_fail_ex+0x394/0x4c0 [ 1574.844956][T31741] should_failslab+0x9/0x20 [ 1574.849530][T31741] slab_pre_alloc_hook+0x59/0x300 [ 1574.854674][T31741] kmem_cache_alloc+0x5a/0x2c0 [ 1574.859546][T31741] ? skb_clone+0x1eb/0x370 [ 1574.864073][T31741] skb_clone+0x1eb/0x370 [ 1574.868422][T31741] pfkey_sendmsg+0x4e3/0x11a0 [ 1574.873236][T31741] ? pfkey_release+0x340/0x340 [ 1574.878090][T31741] ? aa_sk_perm+0x83c/0x970 [ 1574.882745][T31741] ? aa_sock_msg_perm+0x94/0x150 [ 1574.887769][T31741] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1574.893416][T31741] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1574.898782][T31741] ? security_socket_sendmsg+0x80/0xa0 [ 1574.904357][T31741] ? pfkey_release+0x340/0x340 [ 1574.909223][T31741] ____sys_sendmsg+0x61b/0x980 [ 1574.914132][T31741] ? __asan_memset+0x22/0x40 [ 1574.918821][T31741] ? __sys_sendmsg_sock+0x30/0x30 [ 1574.923912][T31741] ? __import_iovec+0x5f2/0x850 [ 1574.928881][T31741] ? import_iovec+0x73/0xa0 [ 1574.933485][T31741] ___sys_sendmsg+0x2a6/0x360 [ 1574.938270][T31741] ? __sys_sendmsg+0x2b0/0x2b0 [ 1574.943228][T31741] ? __lock_acquire+0x7d80/0x7d80 [ 1574.948451][T31741] __se_sys_sendmsg+0x1d0/0x2c0 [ 1574.953401][T31741] ? __x64_sys_sendmsg+0x80/0x80 [ 1574.958498][T31741] ? lockdep_hardirqs_on+0x98/0x150 [ 1574.963806][T31741] do_syscall_64+0x55/0xb0 [ 1574.968304][T31741] ? clear_bhb_loop+0x40/0x90 [ 1574.973080][T31741] ? clear_bhb_loop+0x40/0x90 [ 1574.977852][T31741] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1574.983832][T31741] RIP: 0033:0x7fa6e759e159 [ 1574.988325][T31741] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1575.008020][T31741] RSP: 002b:00007fa6e8399028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1575.016519][T31741] RAX: ffffffffffffffda RBX: 00007fa6e7825fa0 RCX: 00007fa6e759e159 [ 1575.024594][T31741] RDX: 0000000000000000 RSI: 0000200000003780 RDI: 0000000000000006 [ 1575.032638][T31741] RBP: 00007fa6e8399090 R08: 0000000000000000 R09: 0000000000000000 [ 1575.040678][T31741] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1575.048717][T31741] R13: 00007fa6e7826038 R14: 00007fa6e7825fa0 R15: 00007ffdfe680a88 [ 1575.056819][T31741] [ 1575.181143][T31743] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1575.193433][T31743] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1575.204977][T31743] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1575.212618][T31743] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1575.291212][T31743] team0: Port device batadv0 removed [ 1575.321517][T31749] netlink: 'syz.2.9575': attribute type 11 has an invalid length. [ 1575.331275][T31749] netlink: 168 bytes leftover after parsing attributes in process `syz.2.9575'. [ 1575.730676][T31765] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9581'. [ 1575.797333][T31765] bridge0: port 1(bridge_slave_0) entered disabled state [ 1576.142267][T31765] bridge_slave_0 (unregistering): left allmulticast mode [ 1576.162182][T31765] bridge_slave_0 (unregistering): left promiscuous mode [ 1576.173646][T31765] bridge0: port 1(bridge_slave_0) entered disabled state [ 1576.251067][T31775] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.9586'. [ 1576.503561][T31777] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.9579'. [ 1576.527785][T31777] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 1576.812128][T31798] netlink: 'syz.0.9593': attribute type 29 has an invalid length. [ 1576.821573][T31798] netlink: 'syz.0.9593': attribute type 29 has an invalid length. [ 1576.833445][T31798] netlink: 'syz.0.9593': attribute type 29 has an invalid length. [ 1576.842315][T31798] netlink: 'syz.0.9593': attribute type 29 has an invalid length. [ 1576.854217][T31798] netlink: 'syz.0.9593': attribute type 29 has an invalid length. [ 1576.875640][T31799] veth1_macvtap: entered allmulticast mode [ 1576.912777][T31798] netlink: 'syz.0.9593': attribute type 2 has an invalid length. [ 1576.922055][T31798] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9593'. [ 1577.155877][T31807] FAULT_INJECTION: forcing a failure. [ 1577.155877][T31807] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1577.184646][T31807] CPU: 0 PID: 31807 Comm: syz.3.9597 Not tainted syzkaller #0 [ 1577.192211][T31807] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1577.202325][T31807] Call Trace: [ 1577.205657][T31807] [ 1577.208648][T31807] dump_stack_lvl+0x18c/0x250 [ 1577.213407][T31807] ? show_regs_print_info+0x20/0x20 [ 1577.218680][T31807] ? load_image+0x420/0x420 [ 1577.223253][T31807] ? __might_fault+0xaa/0x120 [ 1577.227993][T31807] ? __lock_acquire+0x7d80/0x7d80 [ 1577.233112][T31807] should_fail_ex+0x394/0x4c0 [ 1577.237932][T31807] _copy_from_user+0x2f/0xe0 [ 1577.242588][T31807] __sys_bpf+0x23e/0x890 [ 1577.246909][T31807] ? bpf_link_show_fdinfo+0x390/0x390 [ 1577.252382][T31807] ? lock_chain_count+0x20/0x20 [ 1577.257335][T31807] __x64_sys_bpf+0x7c/0x90 [ 1577.261842][T31807] do_syscall_64+0x55/0xb0 [ 1577.262583][T31809] netlink: 'syz.0.9598': attribute type 11 has an invalid length. [ 1577.266310][T31807] ? clear_bhb_loop+0x40/0x90 [ 1577.266343][T31807] ? clear_bhb_loop+0x40/0x90 [ 1577.266391][T31807] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1577.266445][T31807] RIP: 0033:0x7fbbb019e159 [ 1577.281223][T31809] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9598'. [ 1577.283663][T31807] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1577.283687][T31807] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1577.283716][T31807] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1577.283735][T31807] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000020 [ 1577.283752][T31807] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1577.355293][T31807] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1577.363324][T31807] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1577.371482][T31807] [ 1578.046719][T31082] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1578.058259][T31082] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1578.069035][T31082] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1578.080806][T31082] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1578.092169][T31082] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1578.100570][T31082] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1578.160398][T31825] bridge_slave_1: left allmulticast mode [ 1578.168188][T31825] bridge_slave_1: left promiscuous mode [ 1578.181526][T31825] bridge0: port 2(bridge_slave_1) entered disabled state [ 1578.390327][T25161] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.529769][T25161] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.621904][T25161] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.728731][T25161] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1578.781351][T31829] chnl_net:caif_netlink_parms(): no params data found [ 1579.069664][T31862] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9613'. [ 1579.118293][T31829] bridge0: port 1(bridge_slave_0) entered blocking state [ 1579.125479][T31862] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9613'. [ 1579.143580][T31829] bridge0: port 1(bridge_slave_0) entered disabled state [ 1579.150893][T31829] bridge_slave_0: entered allmulticast mode [ 1579.159814][T31829] bridge_slave_0: entered promiscuous mode [ 1579.169435][T31829] bridge0: port 2(bridge_slave_1) entered blocking state [ 1579.192469][T31865] FAULT_INJECTION: forcing a failure. [ 1579.192469][T31865] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1579.204038][T31829] bridge0: port 2(bridge_slave_1) entered disabled state [ 1579.212664][T31865] CPU: 1 PID: 31865 Comm: syz.3.9615 Not tainted syzkaller #0 [ 1579.220219][T31865] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1579.230336][T31865] Call Trace: [ 1579.233681][T31865] [ 1579.236701][T31865] dump_stack_lvl+0x18c/0x250 [ 1579.241476][T31865] ? show_regs_print_info+0x20/0x20 [ 1579.246768][T31865] ? load_image+0x420/0x420 [ 1579.251351][T31865] ? __might_fault+0xaa/0x120 [ 1579.256108][T31865] ? __lock_acquire+0x7d80/0x7d80 [ 1579.261215][T31865] should_fail_ex+0x394/0x4c0 [ 1579.266007][T31865] _copy_from_iter+0x1cd/0x1290 [ 1579.270937][T31865] ? __virt_addr_valid+0x10c/0x380 [ 1579.276140][T31865] ? __lock_acquire+0x7d80/0x7d80 [ 1579.281255][T31865] ? copyout_mc+0x70/0x70 [ 1579.285656][T31865] ? __virt_addr_valid+0x10c/0x380 [ 1579.290839][T31865] ? __virt_addr_valid+0x10c/0x380 [ 1579.296043][T31865] ? __virt_addr_valid+0x10c/0x380 [ 1579.301234][T31865] ? __check_object_size+0x4fc/0xa40 [ 1579.306595][T31865] kernfs_fop_write_iter+0x19e/0x520 [ 1579.311977][T31865] vfs_write+0x474/0x9a0 [ 1579.316323][T31865] ? file_end_write+0x250/0x250 [ 1579.321273][T31865] ? __fget_files+0x3fc/0x460 [ 1579.326068][T31865] ? __fdget_pos+0x2a3/0x330 [ 1579.330729][T31865] ? ksys_write+0x74/0x260 [ 1579.335237][T31865] ksys_write+0x151/0x260 [ 1579.339662][T31865] ? __ia32_sys_read+0x90/0x90 [ 1579.344524][T31865] ? lockdep_hardirqs_on+0x98/0x150 [ 1579.349804][T31865] do_syscall_64+0x55/0xb0 [ 1579.354304][T31865] ? clear_bhb_loop+0x40/0x90 [ 1579.359041][T31865] ? clear_bhb_loop+0x40/0x90 [ 1579.363801][T31865] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1579.369757][T31865] RIP: 0033:0x7fbbb019e159 [ 1579.374238][T31865] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1579.393923][T31865] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1579.402409][T31865] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1579.410434][T31865] RDX: 0000000000000012 RSI: 00002000000000c0 RDI: 0000000000000005 [ 1579.418471][T31865] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1579.426492][T31865] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1579.434536][T31865] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1579.442678][T31865] [ 1579.450260][T31829] bridge_slave_1: entered allmulticast mode [ 1579.457986][T31829] bridge_slave_1: entered promiscuous mode [ 1579.489991][T25161] tipc: Left network mode [ 1579.510802][T31829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1579.547250][T31829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1579.741595][T31829] team0: Port device team_slave_0 added [ 1579.816274][T31829] team0: Port device team_slave_1 added [ 1579.949253][T31829] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1579.973178][T31829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1580.029252][T31829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1580.075877][T31829] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1580.083025][T31829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1580.111408][T31829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1580.195845][T31082] Bluetooth: hci2: command tx timeout [ 1580.326387][T31888] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1580.427939][T31885] : port 1(ip6gretap0) entered blocking state [ 1580.444344][T31885] : port 1(ip6gretap0) entered disabled state [ 1580.461701][T31885] ip6gretap0: entered allmulticast mode [ 1580.495686][T31885] ip6gretap0: entered promiscuous mode [ 1580.535271][T31887] ip6gretap0: left allmulticast mode [ 1580.551590][T31887] ip6gretap0: left promiscuous mode [ 1580.569438][T31887] : port 1(ip6gretap0) entered disabled state [ 1580.960409][T31829] hsr_slave_0: entered promiscuous mode [ 1580.974563][T31829] hsr_slave_1: entered promiscuous mode [ 1580.981774][T31829] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1580.989563][T31829] Cannot create hsr debugfs directory [ 1582.057018][T31929] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9626'. [ 1582.076795][T31929] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9626'. [ 1582.120785][T25161] hsr_slave_0: left promiscuous mode [ 1582.129866][T25161] hsr_slave_1: left promiscuous mode [ 1582.136922][T25161] bridge0: port 3(dummy0) entered disabled state [ 1582.150297][T25161] hsr0: left allmulticast mode [ 1582.156232][T25161] bridge0: port 2(hsr0) entered disabled state [ 1582.166784][T25161] bridge_slave_0: left promiscuous mode [ 1582.172594][T25161] bridge0: port 1(bridge_slave_0) entered disabled state [ 1582.201097][T25161] veth0_macvtap: left promiscuous mode [ 1582.207297][T25161] veth1_vlan: left promiscuous mode [ 1582.212676][T25161] veth0_vlan: left promiscuous mode [ 1582.263899][T31082] Bluetooth: hci2: command tx timeout [ 1582.840946][T31939] FAULT_INJECTION: forcing a failure. [ 1582.840946][T31939] name failslab, interval 1, probability 0, space 0, times 0 [ 1582.859678][T31939] CPU: 1 PID: 31939 Comm: syz.0.9631 Not tainted syzkaller #0 [ 1582.867224][T31939] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1582.877326][T31939] Call Trace: [ 1582.880650][T31939] [ 1582.883620][T31939] dump_stack_lvl+0x18c/0x250 [ 1582.888377][T31939] ? show_regs_print_info+0x20/0x20 [ 1582.893636][T31939] ? load_image+0x420/0x420 [ 1582.898206][T31939] ? __lock_acquire+0x7d80/0x7d80 [ 1582.903293][T31939] ? __asan_memset+0x22/0x40 [ 1582.907945][T31939] should_fail_ex+0x394/0x4c0 [ 1582.912686][T31939] should_failslab+0x9/0x20 [ 1582.917268][T31939] slab_pre_alloc_hook+0x59/0x300 [ 1582.922370][T31939] kmem_cache_alloc+0x5a/0x2c0 [ 1582.927185][T31939] ? security_inode_alloc+0x34/0x110 [ 1582.932548][T31939] security_inode_alloc+0x34/0x110 [ 1582.937706][T31939] inode_init_always+0x914/0xc90 [ 1582.942743][T31939] new_inode_pseudo+0x95/0x1d0 [ 1582.947564][T31939] __ns_get_path+0x249/0x5f0 [ 1582.952215][T31939] ns_get_path+0x54/0x90 [ 1582.956520][T31939] proc_ns_get_link+0x16c/0x2d0 [ 1582.961442][T31939] ? proc_ns_instantiate+0xf0/0xf0 [ 1582.966623][T31939] ? bpf_lsm_inode_follow_link+0x9/0x10 [ 1582.972238][T31939] ? security_inode_follow_link+0xb7/0x100 [ 1582.978121][T31939] ? proc_ns_instantiate+0xf0/0xf0 [ 1582.983313][T31939] pick_link+0x666/0xdd0 [ 1582.987622][T31939] step_into+0xc18/0xee0 [ 1582.991921][T31939] ? rcu_read_lock_any_held+0xb4/0x140 [ 1582.997433][T31939] ? rcu_read_lock_bh_held+0x100/0x100 [ 1583.002948][T31939] ? set_root+0x3a0/0x3a0 [ 1583.007325][T31939] ? d_splice_alias+0x114/0x330 [ 1583.012231][T31939] path_openat+0x1656/0x3270 [ 1583.016914][T31939] ? do_filp_open+0x430/0x430 [ 1583.021641][T31939] do_filp_open+0x1f2/0x430 [ 1583.026186][T31939] ? vfs_tmpfile+0x620/0x620 [ 1583.030848][T31939] ? _raw_spin_unlock+0x28/0x40 [ 1583.035717][T31939] ? alloc_fd+0x590/0x640 [ 1583.040093][T31939] do_sys_openat2+0x134/0x1d0 [ 1583.044810][T31939] ? atomic_notifier_call_chain+0x16e/0x180 [ 1583.050762][T31939] ? do_sys_open+0xe0/0xe0 [ 1583.055232][T31939] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1583.061248][T31939] ? srcu_init_notifier_head+0x90/0x90 [ 1583.066731][T31939] ? lock_chain_count+0x20/0x20 [ 1583.071600][T31939] __x64_sys_openat+0x139/0x160 [ 1583.076494][T31939] do_syscall_64+0x55/0xb0 [ 1583.080959][T31939] ? clear_bhb_loop+0x40/0x90 [ 1583.085672][T31939] ? clear_bhb_loop+0x40/0x90 [ 1583.090369][T31939] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1583.096292][T31939] RIP: 0033:0x7fd7c7b5e98e [ 1583.100738][T31939] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1583.120383][T31939] RSP: 002b:00007fd7c89b9ec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1583.128836][T31939] RAX: ffffffffffffffda RBX: 00007fd7c89ba6c0 RCX: 00007fd7c7b5e98e [ 1583.136852][T31939] RDX: 0000000000000002 RSI: 00007fd7c89b9f90 RDI: ffffffffffffff9c [ 1583.144839][T31939] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1583.152836][T31939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1583.160829][T31939] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1583.168854][T31939] [ 1583.193475][T31941] netlink: 'syz.3.9632': attribute type 3 has an invalid length. [ 1583.201460][T31941] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.9632'. [ 1583.372071][T25161] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1583.437130][T25161] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1583.506363][T25161] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1583.805425][T25161] bond0 (unregistering): Released all slaves [ 1583.882878][T31829] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1583.894378][T31829] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1583.905725][T31937] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.9630'. [ 1583.915234][T31937] bridge_slave_1: entered promiscuous mode [ 1583.933542][T31829] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1583.990838][T31829] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1584.268483][T31829] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1584.347626][T31082] Bluetooth: hci2: command tx timeout [ 1584.358051][T31829] 8021q: adding VLAN 0 to HW filter on device team0 [ 1584.388583][T25143] bridge0: port 1(bridge_slave_0) entered blocking state [ 1584.395862][T25143] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1584.431511][T25143] bridge0: port 2(bridge_slave_1) entered blocking state [ 1584.438879][T25143] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1584.504607][T31969] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9638'. [ 1584.523894][T31969] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9638'. [ 1584.815894][T31829] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1584.895302][T31829] veth0_vlan: entered promiscuous mode [ 1584.921670][T31982] netlink: 'syz.1.9640': attribute type 8 has an invalid length. [ 1584.929923][T31982] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.9640'. [ 1584.941854][T31829] veth1_vlan: entered promiscuous mode [ 1585.012827][T31829] veth0_macvtap: entered promiscuous mode [ 1585.030599][T31829] veth1_macvtap: entered promiscuous mode [ 1585.061537][T31829] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1585.085914][T31829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1585.123728][T31829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1585.145703][T31829] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1585.171376][T31829] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1585.205374][T31829] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1585.226025][T31829] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1585.235783][T31829] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1585.516244][T31996] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9643'. [ 1585.638686][T25161] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1585.689474][T25161] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1585.866044][T25143] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1585.883381][T25143] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1586.424572][T31082] Bluetooth: hci2: command tx timeout [ 1589.444304][T32048] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9650'. [ 1589.464860][T32048] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9650'. [ 1589.841297][T32059] syz.3.9654[32059] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1589.841464][T32059] syz.3.9654[32059] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1589.907223][T31082] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 1591.401869][T32069] netlink: 'syz.2.9655': attribute type 10 has an invalid length. [ 1591.537044][T32069] team0: Device ipvlan1 failed to register rx_handler [ 1591.977528][T32085] netlink: 128 bytes leftover after parsing attributes in process `syz.1.9660'. [ 1592.080938][T32085] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1592.126180][T32097] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.9664'. [ 1592.156753][T32091] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.9664'. [ 1592.476077][T32110] syz.1.9669[32110] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1592.476232][T32110] syz.1.9669[32110] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1592.506836][T31082] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 1592.822730][T32115] netlink: 10 bytes leftover after parsing attributes in process `syz.3.9672'. [ 1592.844465][T32118] FAULT_INJECTION: forcing a failure. [ 1592.844465][T32118] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1593.915174][T32118] CPU: 1 PID: 32118 Comm: syz.0.9673 Not tainted syzkaller #0 [ 1593.922846][T32118] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1593.932946][T32118] Call Trace: [ 1593.936279][T32118] [ 1593.939248][T32118] dump_stack_lvl+0x18c/0x250 [ 1593.944032][T32118] ? show_regs_print_info+0x20/0x20 [ 1593.949281][T32118] ? load_image+0x420/0x420 [ 1593.953853][T32118] should_fail_ex+0x394/0x4c0 [ 1593.958621][T32118] copy_to_user_nofault+0x85/0x140 [ 1593.963836][T32118] bpf_prog_19072b5a3fcf5d64+0x40/0x44 [ 1593.969366][T32118] trace_call_bpf+0x333/0x6c0 [ 1593.974100][T32118] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1593.980304][T32118] ? trace_call_bpf+0xc3/0x6c0 [ 1593.985103][T32118] ? lockdep_hardirqs_on+0x98/0x150 [ 1593.990353][T32118] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 1593.996455][T32118] ? perf_swevent_get_recursion_context+0x7d/0x150 [ 1594.003001][T32118] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1594.008647][T32118] perf_trace_lock_acquire+0x342/0x400 [ 1594.014152][T32118] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1594.020776][T32118] ? perf_tp_event+0x13f5/0x1550 [ 1594.025753][T32118] ? perf_trace_run_bpf_submit+0x1c0/0x1c0 [ 1594.031625][T32118] lock_acquire+0x3ef/0x420 [ 1594.036157][T32118] ? __fget_files+0x28/0x460 [ 1594.040795][T32118] ? read_lock_is_recursive+0x20/0x20 [ 1594.046210][T32118] ? __fget_files+0x28/0x460 [ 1594.050831][T32118] __fget_files+0x45/0x460 [ 1594.055269][T32118] ? __fget_files+0x28/0x460 [ 1594.059895][T32118] ? kvm_sched_clock_read+0x11/0x20 [ 1594.065147][T32118] __fdget+0x173/0x210 [ 1594.069259][T32118] ? __se_sys_sendmsg+0xb7/0x2c0 [ 1594.074238][T32118] __se_sys_sendmsg+0xc7/0x2c0 [ 1594.079046][T32118] ? perf_trace_preemptirq_template+0x269/0x330 [ 1594.085348][T32118] ? __x64_sys_sendmsg+0x80/0x80 [ 1594.090331][T32118] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1594.096352][T32118] ? lock_chain_count+0x20/0x20 [ 1594.101226][T32118] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1594.107240][T32118] ? lockdep_hardirqs_on+0x98/0x150 [ 1594.112475][T32118] do_syscall_64+0x55/0xb0 [ 1594.116919][T32118] ? clear_bhb_loop+0x40/0x90 [ 1594.121648][T32118] ? clear_bhb_loop+0x40/0x90 [ 1594.126358][T32118] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1594.132286][T32118] RIP: 0033:0x7fd7c7b9e159 [ 1594.136733][T32118] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1594.156374][T32118] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1594.164818][T32118] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1594.172825][T32118] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000006 [ 1594.180826][T32118] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1594.188832][T32118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1594.196839][T32118] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1594.204850][T32118] [ 1595.512826][T32122] netlink: 'syz.3.9674': attribute type 10 has an invalid length. [ 1595.562415][T32122] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1596.762581][T32164] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.9686'. [ 1596.782839][T32163] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.9686'. [ 1597.231264][T32184] syz.0.9695[32184] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1597.231511][T32184] syz.0.9695[32184] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1597.260163][T31082] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 1597.987770][T32188] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.9696'. [ 1598.195794][T32195] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.9696'. [ 1598.559944][T32203] FAULT_INJECTION: forcing a failure. [ 1598.559944][T32203] name failslab, interval 1, probability 0, space 0, times 0 [ 1598.572879][T32203] CPU: 1 PID: 32203 Comm: syz.2.9699 Not tainted syzkaller #0 [ 1598.580390][T32203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1598.590498][T32203] Call Trace: [ 1598.593817][T32203] [ 1598.596788][T32203] dump_stack_lvl+0x18c/0x250 [ 1598.601590][T32203] ? show_regs_print_info+0x20/0x20 [ 1598.606848][T32203] ? load_image+0x420/0x420 [ 1598.611414][T32203] should_fail_ex+0x394/0x4c0 [ 1598.616155][T32203] should_failslab+0x9/0x20 [ 1598.620724][T32203] slab_pre_alloc_hook+0x59/0x300 [ 1598.625809][T32203] kmem_cache_alloc+0x5a/0x2c0 [ 1598.630629][T32203] ? skb_clone+0x1eb/0x370 [ 1598.635104][T32203] skb_clone+0x1eb/0x370 [ 1598.639423][T32203] bpf_clone_redirect+0x16d/0x4a0 [ 1598.644524][T32203] bpf_prog_c9d58f5b8698340d+0x5e/0x63 [ 1598.650037][T32203] ? perf_trace_preemptirq_template+0xac/0x330 [ 1598.656270][T32203] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1598.662309][T32203] ? lock_chain_count+0x20/0x20 [ 1598.667230][T32203] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1598.673442][T32203] ? __cant_sleep+0x220/0x220 [ 1598.678169][T32203] ? bpf_test_run+0x174/0x870 [ 1598.682901][T32203] ? bpf_test_run+0x174/0x870 [ 1598.687634][T32203] bpf_test_run+0x2df/0x870 [ 1598.692202][T32203] ? bpf_test_run+0x174/0x870 [ 1598.696930][T32203] ? dst_hold+0x70/0x70 [ 1598.701139][T32203] ? eth_get_headlen+0x210/0x210 [ 1598.706136][T32203] bpf_prog_test_run_skb+0xdbb/0x18f0 [ 1598.711597][T32203] ? cpu_online+0x60/0x60 [ 1598.715972][T32203] bpf_prog_test_run+0x31f/0x390 [ 1598.720994][T32203] __sys_bpf+0x49d/0x890 [ 1598.725291][T32203] ? bpf_link_show_fdinfo+0x390/0x390 [ 1598.730737][T32203] ? lock_chain_count+0x20/0x20 [ 1598.735650][T32203] __x64_sys_bpf+0x7c/0x90 [ 1598.740108][T32203] do_syscall_64+0x55/0xb0 [ 1598.744563][T32203] ? clear_bhb_loop+0x40/0x90 [ 1598.749306][T32203] ? clear_bhb_loop+0x40/0x90 [ 1598.754033][T32203] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1598.759983][T32203] RIP: 0033:0x7fd85379e159 [ 1598.764446][T32203] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1598.784106][T32203] RSP: 002b:00007fd854735028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1598.792578][T32203] RAX: ffffffffffffffda RBX: 00007fd853a25fa0 RCX: 00007fd85379e159 [ 1598.800612][T32203] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 1598.808633][T32203] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1598.816650][T32203] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1598.824669][T32203] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1598.832734][T32203] [ 1599.190918][T32180] netlink: 'syz.1.9692': attribute type 10 has an invalid length. [ 1600.469000][T32245] netlink: 'syz.3.9712': attribute type 6 has an invalid length. [ 1600.478136][T32245] netlink: 187932 bytes leftover after parsing attributes in process `syz.3.9712'. [ 1601.386438][T32250] netlink: 'syz.0.9714': attribute type 10 has an invalid length. [ 1601.406477][T32250] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1605.530367][T32307] netlink: 128 bytes leftover after parsing attributes in process `syz.0.9730'. [ 1605.572143][T32307] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1605.777988][T32321] netlink: 144316 bytes leftover after parsing attributes in process `syz.1.9729'. [ 1605.788267][T32321] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9729'. [ 1605.894076][T32328] FAULT_INJECTION: forcing a failure. [ 1605.894076][T32328] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1605.922962][T32328] CPU: 0 PID: 32328 Comm: syz.3.9738 Not tainted syzkaller #0 [ 1605.930492][T32328] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1605.940589][T32328] Call Trace: [ 1605.943914][T32328] [ 1605.946887][T32328] dump_stack_lvl+0x18c/0x250 [ 1605.951625][T32328] ? show_regs_print_info+0x20/0x20 [ 1605.956891][T32328] ? load_image+0x420/0x420 [ 1605.961474][T32328] ? __lock_acquire+0x7d80/0x7d80 [ 1605.966555][T32328] should_fail_ex+0x394/0x4c0 [ 1605.971287][T32328] _copy_from_user+0x2f/0xe0 [ 1605.975930][T32328] __copy_msghdr+0x388/0x560 [ 1605.980577][T32328] ___sys_sendmsg+0x214/0x360 [ 1605.985310][T32328] ? __sys_sendmsg+0x2b0/0x2b0 [ 1605.990171][T32328] __se_sys_sendmsg+0x1d0/0x2c0 [ 1605.995093][T32328] ? __x64_sys_sendmsg+0x80/0x80 [ 1606.000097][T32328] ? syscall_enter_from_user_mode+0x2e/0x80 [ 1606.006051][T32328] do_syscall_64+0x55/0xb0 [ 1606.010517][T32328] ? clear_bhb_loop+0x40/0x90 [ 1606.015237][T32328] ? clear_bhb_loop+0x40/0x90 [ 1606.019961][T32328] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1606.025910][T32328] RIP: 0033:0x7fbbb019e159 [ 1606.030363][T32328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1606.050009][T32328] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1606.058492][T32328] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1606.066505][T32328] RDX: 00000000000080d1 RSI: 0000200000000140 RDI: 0000000000000004 [ 1606.074516][T32328] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1606.082531][T32328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1606.090544][T32328] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1606.098583][T32328] [ 1606.352224][T32339] netlink: 128 bytes leftover after parsing attributes in process `syz.2.9740'. [ 1606.366132][T32339] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1606.440128][T32341] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1606.459037][T32341] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1606.482301][T32341] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1606.490419][T32341] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1606.584245][T32341] team0: Port device batadv0 removed [ 1607.400254][T32368] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.9751'. [ 1607.412572][T32368] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9751'. [ 1607.465108][T32372] netlink: 'syz.1.9754': attribute type 29 has an invalid length. [ 1607.473616][T32372] netlink: 'syz.1.9754': attribute type 29 has an invalid length. [ 1607.482663][T32372] netlink: 'syz.1.9754': attribute type 29 has an invalid length. [ 1607.492976][T32372] netlink: 'syz.1.9754': attribute type 29 has an invalid length. [ 1607.505030][T32372] netlink: 'syz.1.9754': attribute type 29 has an invalid length. [ 1607.660913][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.673744][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.984827][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.004242][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.014761][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.024891][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.038328][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.052247][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.063139][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1608.076591][T32370] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:6596:9ff5:7b00 with DS=0x31 [ 1610.597785][T32390] FAULT_INJECTION: forcing a failure. [ 1610.597785][T32390] name failslab, interval 1, probability 0, space 0, times 0 [ 1610.628877][T32390] CPU: 0 PID: 32390 Comm: syz.3.9760 Not tainted syzkaller #0 [ 1610.636419][T32390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1610.646569][T32390] Call Trace: [ 1610.649888][T32390] [ 1610.652857][T32390] dump_stack_lvl+0x18c/0x250 [ 1610.657587][T32390] ? show_regs_print_info+0x20/0x20 [ 1610.662838][T32390] ? load_image+0x420/0x420 [ 1610.667389][T32390] ? __might_sleep+0xe0/0xe0 [ 1610.672028][T32390] ? __lock_acquire+0x7d80/0x7d80 [ 1610.677106][T32390] should_fail_ex+0x394/0x4c0 [ 1610.678135][T32392] netlink: 164 bytes leftover after parsing attributes in process `syz.0.9762'. [ 1610.681823][T32390] should_failslab+0x9/0x20 [ 1610.681860][T32390] slab_pre_alloc_hook+0x59/0x300 [ 1610.700490][T32390] ? tomoyo_encode+0x2ad/0x570 [ 1610.705310][T32390] ? tomoyo_encode+0x2ad/0x570 [ 1610.710121][T32390] __kmem_cache_alloc_node+0x53/0x250 [ 1610.715552][T32390] ? tomoyo_encode+0x2ad/0x570 [ 1610.720368][T32390] __kmalloc+0xa7/0x240 [ 1610.724599][T32390] tomoyo_encode+0x2ad/0x570 [ 1610.729248][T32390] tomoyo_realpath_from_path+0x57c/0x5c0 [ 1610.734996][T32390] ? tomoyo_domain+0xd6/0x120 [ 1610.739757][T32390] tomoyo_path_number_perm+0x248/0x5e0 [ 1610.745276][T32390] ? tomoyo_path_number_perm+0x217/0x5e0 [ 1610.750975][T32390] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1610.756500][T32390] ? ksys_write+0x1d2/0x260 [ 1610.761099][T32390] ? __fget_files+0x28/0x460 [ 1610.765773][T32390] security_file_ioctl+0x70/0xa0 [ 1610.770767][T32390] __se_sys_ioctl+0x48/0x170 [ 1610.775413][T32390] do_syscall_64+0x55/0xb0 [ 1610.779884][T32390] ? clear_bhb_loop+0x40/0x90 [ 1610.784637][T32390] ? clear_bhb_loop+0x40/0x90 [ 1610.789368][T32390] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1610.795324][T32390] RIP: 0033:0x7fbbb019e159 [ 1610.799783][T32390] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1610.819453][T32390] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1610.827919][T32390] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1610.835943][T32390] RDX: 0000200000000040 RSI: 0000000000008915 RDI: 0000000000000003 [ 1610.843983][T32390] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1610.852000][T32390] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1610.860025][T32390] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1610.868162][T32390] [ 1610.879701][T32390] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1611.162038][T32405] netlink: 'syz.3.9766': attribute type 29 has an invalid length. [ 1611.185282][T32405] netlink: 'syz.3.9766': attribute type 29 has an invalid length. [ 1611.199825][T32405] netlink: 'syz.3.9766': attribute type 29 has an invalid length. [ 1611.214899][T32405] netlink: 'syz.3.9766': attribute type 29 has an invalid length. [ 1611.229093][T32405] netlink: 'syz.3.9766': attribute type 10 has an invalid length. [ 1611.336409][T32405] veth0_vlan: left promiscuous mode [ 1611.401686][T32405] veth0_vlan: entered promiscuous mode [ 1611.479825][T32405] team0: Device veth0_vlan failed to register rx_handler [ 1611.941340][T32413] netlink: 830 bytes leftover after parsing attributes in process `syz.3.9766'. [ 1612.066843][T32427] netlink: 144316 bytes leftover after parsing attributes in process `syz.2.9770'. [ 1612.090074][T32427] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9770'. [ 1612.337229][T32435] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.9775'. [ 1612.879028][T32452] validate_nla: 1 callbacks suppressed [ 1612.879049][T32452] netlink: 'syz.2.9781': attribute type 3 has an invalid length. [ 1612.906006][T32453] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.9780'. [ 1612.929489][T32453] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1612.944317][T32452] netlink: 130984 bytes leftover after parsing attributes in process `syz.2.9781'. [ 1612.959746][T32453] CPU: 1 PID: 32453 Comm: syz.0.9780 Not tainted syzkaller #0 [ 1612.967310][T32453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1612.977418][T32453] Call Trace: [ 1612.980743][T32453] [ 1612.983710][T32453] dump_stack_lvl+0x18c/0x250 [ 1612.988453][T32453] ? show_regs_print_info+0x20/0x20 [ 1612.993709][T32453] ? load_image+0x420/0x420 [ 1612.998276][T32453] sysfs_warn_dup+0x8e/0xa0 [ 1613.002831][T32453] sysfs_do_create_link_sd+0xc0/0x110 [ 1613.008269][T32453] device_add_class_symlinks+0x1cf/0x240 [ 1613.013972][T32453] device_add+0x4f9/0xc40 [ 1613.018350][T32453] wiphy_register+0x1d99/0x2ac0 [ 1613.023258][T32453] ? cfg80211_event_work+0x40/0x40 [ 1613.028402][T32453] ? minstrel_ht_alloc+0x88a/0x990 [ 1613.033558][T32453] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1613.039683][T32453] ieee80211_register_hw+0x2dd8/0x3b30 [ 1613.045209][T32453] ? ieee80211_register_hw+0xf11/0x3b30 [ 1613.050784][T32453] ? ieee80211_tasklet_handler+0x20/0x20 [ 1613.056444][T32453] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1613.062365][T32453] ? __debug_object_init+0xec/0x450 [ 1613.067591][T32453] ? __asan_memset+0x22/0x40 [ 1613.072213][T32453] ? __hrtimer_init+0x189/0x270 [ 1613.077099][T32453] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 1613.082873][T32453] ? mac80211_hwsim_free+0x220/0x220 [ 1613.088186][T32453] ? rcu_is_watching+0x15/0xb0 [ 1613.092984][T32453] ? kstrndup+0xbd/0x140 [ 1613.097267][T32453] hwsim_new_radio_nl+0xdad/0x1a70 [ 1613.102411][T32453] ? __nla_validate+0x50/0x50 [ 1613.107136][T32453] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1613.113506][T32453] ? __nla_parse+0x40/0x50 [ 1613.117980][T32453] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1613.124341][T32453] genl_family_rcv_msg_doit+0x21a/0x310 [ 1613.129920][T32453] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1613.135886][T32453] ? bpf_lsm_capable+0x9/0x10 [ 1613.140606][T32453] ? security_capable+0x89/0xb0 [ 1613.145509][T32453] genl_rcv_msg+0x611/0x7a0 [ 1613.150043][T32453] ? genl_bind+0x360/0x360 [ 1613.154491][T32453] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 1613.160853][T32453] ? perf_trace_lock+0xfc/0x3b0 [ 1613.165743][T32453] ? __kasan_kmalloc_large+0x8b/0xa0 [ 1613.171063][T32453] netlink_rcv_skb+0x235/0x4c0 [ 1613.175872][T32453] ? genl_bind+0x360/0x360 [ 1613.180325][T32453] ? netlink_ack+0x1160/0x1160 [ 1613.185128][T32453] ? __lock_acquire+0x7d80/0x7d80 [ 1613.190204][T32453] ? down_read+0x1ac/0x2e0 [ 1613.194692][T32453] genl_rcv+0x28/0x40 [ 1613.198794][T32453] netlink_unicast+0x7b1/0x930 [ 1613.203689][T32453] netlink_sendmsg+0x8d0/0xbf0 [ 1613.208515][T32453] ? netlink_getsockopt+0x590/0x590 [ 1613.213768][T32453] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1613.219340][T32453] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1613.224656][T32453] ? security_socket_sendmsg+0x80/0xa0 [ 1613.230134][T32453] ? netlink_getsockopt+0x590/0x590 [ 1613.235371][T32453] ____sys_sendmsg+0x61b/0x980 [ 1613.240189][T32453] ? __asan_memset+0x22/0x40 [ 1613.244815][T32453] ? __sys_sendmsg_sock+0x30/0x30 [ 1613.249860][T32453] ? __import_iovec+0x5f2/0x850 [ 1613.254765][T32453] ? import_iovec+0x73/0xa0 [ 1613.259299][T32453] ___sys_sendmsg+0x2a6/0x360 [ 1613.264006][T32453] ? __sys_sendmsg+0x2b0/0x2b0 [ 1613.268823][T32453] ? trace_call_bpf+0xc3/0x6c0 [ 1613.273639][T32453] __se_sys_sendmsg+0x1d0/0x2c0 [ 1613.278520][T32453] ? perf_trace_preemptirq_template+0x269/0x330 [ 1613.284801][T32453] ? __x64_sys_sendmsg+0x80/0x80 [ 1613.289781][T32453] ? lockdep_hardirqs_on+0x98/0x150 [ 1613.295023][T32453] do_syscall_64+0x55/0xb0 [ 1613.299485][T32453] ? clear_bhb_loop+0x40/0x90 [ 1613.304193][T32453] ? clear_bhb_loop+0x40/0x90 [ 1613.308927][T32453] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1613.314849][T32453] RIP: 0033:0x7fd7c7b9e159 [ 1613.319293][T32453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1613.338928][T32453] RSP: 002b:00007fd7c5df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1613.347364][T32453] RAX: ffffffffffffffda RBX: 00007fd7c7e26180 RCX: 00007fd7c7b9e159 [ 1613.355358][T32453] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000d [ 1613.363358][T32453] RBP: 00007fd7c7c35024 R08: 0000000000000000 R09: 0000000000000000 [ 1613.371367][T32453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1613.379356][T32453] R13: 00007fd7c7e26218 R14: 00007fd7c7e26180 R15: 00007fff5f578628 [ 1613.387367][T32453] [ 1613.547784][T32461] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1613.564308][T32461] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1613.585217][T32461] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1613.593472][T32461] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1613.867776][T32469] FAULT_INJECTION: forcing a failure. [ 1613.867776][T32469] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1613.885361][T32469] CPU: 1 PID: 32469 Comm: syz.0.9786 Not tainted syzkaller #0 [ 1613.892915][T32469] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1613.903031][T32469] Call Trace: [ 1613.906412][T32469] [ 1613.909399][T32469] dump_stack_lvl+0x18c/0x250 [ 1613.914157][T32469] ? show_regs_print_info+0x20/0x20 [ 1613.919440][T32469] ? load_image+0x420/0x420 [ 1613.924014][T32469] ? __lock_acquire+0x7d80/0x7d80 [ 1613.929108][T32469] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 1613.934914][T32469] should_fail_ex+0x394/0x4c0 [ 1613.939710][T32469] prepare_alloc_pages+0x1e1/0x5b0 [ 1613.944909][T32469] __alloc_pages+0x134/0x460 [ 1613.949572][T32469] ? zone_statistics+0x170/0x170 [ 1613.954586][T32469] ? do_wp_page+0x733/0x34d0 [ 1613.959242][T32469] ? do_wp_page+0xf17/0x34d0 [ 1613.963908][T32469] ? __lock_acquire+0x7d80/0x7d80 [ 1613.969001][T32469] __folio_alloc+0x10/0x20 [ 1613.973481][T32469] vma_alloc_folio+0x474/0x8f0 [ 1613.978373][T32469] do_wp_page+0x118d/0x34d0 [ 1613.982971][T32469] ? folio_put+0xd0/0xd0 [ 1613.987278][T32469] ? do_raw_spin_lock+0x11f/0x2b0 [ 1613.992381][T32469] ? __rwlock_init+0x150/0x150 [ 1613.997282][T32469] handle_mm_fault+0x1306/0x4a50 [ 1614.002302][T32469] ? handle_mm_fault+0xe6/0x4a50 [ 1614.007340][T32469] ? numa_migrate_prep+0x350/0x350 [ 1614.012558][T32469] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 1614.017921][T32469] do_user_addr_fault+0x736/0x12d0 [ 1614.023139][T32469] exc_page_fault+0x64/0x100 [ 1614.027819][T32469] asm_exc_page_fault+0x26/0x30 [ 1614.032749][T32469] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 1614.038640][T32469] Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01 [ 1614.058324][T32469] RSP: 0018:ffffc9000bce7678 EFLAGS: 00050206 [ 1614.064481][T32469] RAX: ffffffff84315201 RBX: 1ffff9200179cfc7 RCX: 000000000001d6a0 [ 1614.072531][T32469] RDX: 0000000000000000 RSI: ffff888062b45940 RDI: 0000200000006000 [ 1614.080569][T32469] RBP: ffffc9000bce77e0 R08: ffff888062b62fdf R09: 1ffff1100c56c5fb [ 1614.088621][T32469] R10: dffffc0000000000 R11: ffffed100c56c5fc R12: ffff888062b40000 [ 1614.096660][T32469] R13: 0000000000022fe0 R14: 0000000000022fe0 R15: ffffc9000bce7e48 [ 1614.104720][T32469] ? _copy_to_iter+0x1a1/0x1110 [ 1614.109658][T32469] _copy_to_iter+0x24f/0x1110 [ 1614.114415][T32469] ? __virt_addr_valid+0x10c/0x380 [ 1614.119722][T32469] ? __lock_acquire+0x7d80/0x7d80 [ 1614.124830][T32469] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 1614.130788][T32469] ? iov_iter_init+0x1e0/0x1e0 [ 1614.135620][T32469] ? __virt_addr_valid+0x10c/0x380 [ 1614.140802][T32469] ? __virt_addr_valid+0x10c/0x380 [ 1614.146005][T32469] ? __virt_addr_valid+0x10c/0x380 [ 1614.151197][T32469] ? __check_object_size+0x4fc/0xa40 [ 1614.156557][T32469] __skb_datagram_iter+0xdb/0x780 [ 1614.161672][T32469] ? skb_copy_datagram_iter+0x200/0x200 [ 1614.167305][T32469] skb_copy_datagram_iter+0xb1/0x200 [ 1614.172670][T32469] __unix_dgram_recvmsg+0x69f/0xd90 [ 1614.177958][T32469] ? unix_unhash+0x10/0x10 [ 1614.182458][T32469] ? aa_af_perm+0x330/0x330 [ 1614.187047][T32469] ? perf_trace_lock+0x303/0x3b0 [ 1614.192074][T32469] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 1614.197443][T32469] ? security_socket_recvmsg+0x89/0xb0 [ 1614.202991][T32469] ? unix_dgram_recvmsg+0xad/0xd0 [ 1614.208113][T32469] ? unix_dgram_sendmsg+0x16e0/0x16e0 [ 1614.213584][T32469] ____sys_recvmsg+0x2bd/0x5d0 [ 1614.218444][T32469] ? __sys_recvmsg_sock+0x50/0x50 [ 1614.223566][T32469] ? import_iovec+0x73/0xa0 [ 1614.228151][T32469] ___sys_recvmsg+0x214/0x590 [ 1614.232907][T32469] ? __sys_recvmsg+0x2a0/0x2a0 [ 1614.237758][T32469] ? ksys_write+0x1d2/0x260 [ 1614.242336][T32469] ? __fget_files+0x3fc/0x460 [ 1614.247101][T32469] __x64_sys_recvmsg+0x21e/0x2f0 [ 1614.252096][T32469] ? ___sys_recvmsg+0x590/0x590 [ 1614.257036][T32469] ? lockdep_hardirqs_on+0x98/0x150 [ 1614.262358][T32469] do_syscall_64+0x55/0xb0 [ 1614.266833][T32469] ? clear_bhb_loop+0x40/0x90 [ 1614.271664][T32469] ? clear_bhb_loop+0x40/0x90 [ 1614.276410][T32469] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1614.282415][T32469] RIP: 0033:0x7fd7c7b9e159 [ 1614.286890][T32469] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1614.306551][T32469] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1614.315043][T32469] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1614.323063][T32469] RDX: 0000000000000000 RSI: 00002000000004c0 RDI: 0000000000000004 [ 1614.331104][T32469] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1614.339128][T32469] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1614.347149][T32469] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1614.355207][T32469] [ 1614.714649][T32484] netlink: 144316 bytes leftover after parsing attributes in process `syz.2.9789'. [ 1614.730478][T32484] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9789'. [ 1614.786878][T32483] FAULT_INJECTION: forcing a failure. [ 1614.786878][T32483] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1614.813877][T32483] CPU: 0 PID: 32483 Comm: syz.0.9794 Not tainted syzkaller #0 [ 1614.821410][T32483] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1614.831487][T32483] Call Trace: [ 1614.834785][T32483] [ 1614.837740][T32483] dump_stack_lvl+0x18c/0x250 [ 1614.842449][T32483] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1614.848637][T32483] ? show_regs_print_info+0x20/0x20 [ 1614.853876][T32483] ? load_image+0x420/0x420 [ 1614.858413][T32483] should_fail_ex+0x394/0x4c0 [ 1614.863158][T32483] _copy_from_user+0x2f/0xe0 [ 1614.867800][T32483] ___sys_sendmsg+0x1c7/0x360 [ 1614.872505][T32483] ? __sys_sendmsg+0x2b0/0x2b0 [ 1614.877425][T32483] __se_sys_sendmsg+0x1d0/0x2c0 [ 1614.882303][T32483] ? __x64_sys_sendmsg+0x80/0x80 [ 1614.887358][T32483] ? syscall_enter_from_user_mode+0x2e/0x80 [ 1614.893296][T32483] do_syscall_64+0x55/0xb0 [ 1614.897740][T32483] ? clear_bhb_loop+0x40/0x90 [ 1614.902441][T32483] ? clear_bhb_loop+0x40/0x90 [ 1614.907147][T32483] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1614.913095][T32483] RIP: 0033:0x7fd7c7b9e159 [ 1614.917564][T32483] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1614.937185][T32483] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1614.945623][T32483] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1614.953617][T32483] RDX: 0000000000000000 RSI: 0000200000001640 RDI: 0000000000000008 [ 1614.961700][T32483] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1614.969697][T32483] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1614.977690][T32483] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1614.985698][T32483] [ 1615.619556][T32504] netlink: 142592 bytes leftover after parsing attributes in process `syz.0.9797'. [ 1615.693838][T32503] delete_channel: no stack [ 1615.954580][T32517] __nla_validate_parse: 1 callbacks suppressed [ 1615.954601][T32517] netlink: 164 bytes leftover after parsing attributes in process `syz.3.9804'. [ 1616.474488][T32521] netlink: 16255 bytes leftover after parsing attributes in process `syz.0.9806'. [ 1616.551308][T32527] netlink: 144316 bytes leftover after parsing attributes in process `syz.2.9807'. [ 1616.561505][T32527] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9807'. [ 1616.947688][T32537] netlink: 'syz.0.9811': attribute type 10 has an invalid length. [ 1616.988507][T32540] netlink: 'syz.3.9812': attribute type 3 has an invalid length. [ 1616.996576][T32540] netlink: 'syz.3.9812': attribute type 4 has an invalid length. [ 1617.005428][T32540] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9812'. [ 1617.019099][T32540] netlink: 144316 bytes leftover after parsing attributes in process `syz.3.9812'. [ 1617.036807][T32540] netlink: 'syz.3.9812': attribute type 3 has an invalid length. [ 1617.055386][T32542] netlink: 144316 bytes leftover after parsing attributes in process `syz.3.9812'. [ 1617.070148][T32540] netlink: 'syz.3.9812': attribute type 4 has an invalid length. [ 1617.081398][T32540] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9812'. [ 1617.119924][T32537] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1617.348342][T32551] netlink: 'syz.3.9815': attribute type 10 has an invalid length. [ 1617.371557][T32555] netlink: 142592 bytes leftover after parsing attributes in process `syz.0.9814'. [ 1617.403390][T32555] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9814'. [ 1617.436267][T32551] bridge0: port 2(bridge_slave_1) entered disabled state [ 1617.480532][T32551] bridge_slave_1: left allmulticast mode [ 1617.489058][T32551] bridge_slave_1: left promiscuous mode [ 1617.497514][T32551] bridge0: port 2(bridge_slave_1) entered disabled state [ 1618.248519][T32551] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1619.050426][T32578] netlink: 'syz.1.9817': attribute type 1 has an invalid length. [ 1619.508537][T32602] syz.3.9835[32602] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1619.508657][T32602] syz.3.9835[32602] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1619.524938][T31082] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 1620.628210][T32615] net_ratelimit: 1464 callbacks suppressed [ 1620.628240][T32615] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1621.000979][T32630] netlink: 'syz.1.9848': attribute type 29 has an invalid length. [ 1621.011879][T32630] netlink: 'syz.1.9848': attribute type 29 has an invalid length. [ 1621.040684][T32628] FAULT_INJECTION: forcing a failure. [ 1621.040684][T32628] name failslab, interval 1, probability 0, space 0, times 0 [ 1621.053735][T32628] CPU: 1 PID: 32628 Comm: syz.2.9847 Not tainted syzkaller #0 [ 1621.061253][T32628] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1621.071344][T32628] Call Trace: [ 1621.074647][T32628] [ 1621.077598][T32628] dump_stack_lvl+0x18c/0x250 [ 1621.082319][T32628] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1621.088507][T32628] ? show_regs_print_info+0x20/0x20 [ 1621.093730][T32628] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1621.099929][T32628] should_fail_ex+0x394/0x4c0 [ 1621.104637][T32628] should_failslab+0x9/0x20 [ 1621.109163][T32628] slab_pre_alloc_hook+0x59/0x300 [ 1621.114227][T32628] kmem_cache_alloc+0x5a/0x2c0 [ 1621.119032][T32628] ? skb_clone+0x1eb/0x370 [ 1621.123531][T32628] skb_clone+0x1eb/0x370 [ 1621.127811][T32628] bpf_clone_redirect+0x16d/0x4a0 [ 1621.132874][T32628] bpf_prog_ed198f4594f8762b+0x21/0x25 [ 1621.138359][T32628] bpf_test_run+0x2df/0x870 [ 1621.142895][T32628] ? lock_chain_count+0x20/0x20 [ 1621.147775][T32628] ? bpf_test_run+0x174/0x870 [ 1621.152489][T32628] ? dst_hold+0x70/0x70 [ 1621.156681][T32628] ? convert___skb_to_skb+0x3d/0x590 [ 1621.162018][T32628] bpf_prog_test_run_skb+0xdbb/0x18f0 [ 1621.167443][T32628] ? cpu_online+0x60/0x60 [ 1621.171809][T32628] bpf_prog_test_run+0x31f/0x390 [ 1621.176779][T32628] __sys_bpf+0x49d/0x890 [ 1621.181058][T32628] ? bpf_link_show_fdinfo+0x390/0x390 [ 1621.186473][T32628] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1621.192676][T32628] __x64_sys_bpf+0x7c/0x90 [ 1621.197138][T32628] do_syscall_64+0x55/0xb0 [ 1621.201579][T32628] ? clear_bhb_loop+0x40/0x90 [ 1621.206284][T32628] ? clear_bhb_loop+0x40/0x90 [ 1621.210991][T32628] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1621.216912][T32628] RIP: 0033:0x7fd85379e159 [ 1621.221359][T32628] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1621.241002][T32628] RSP: 002b:00007fd854735028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1621.249449][T32628] RAX: ffffffffffffffda RBX: 00007fd853a25fa0 RCX: 00007fd85379e159 [ 1621.257450][T32628] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1621.265459][T32628] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1621.273456][T32628] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1621.281450][T32628] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1621.289462][T32628] [ 1624.880591][T32656] netlink: 'syz.0.9854': attribute type 29 has an invalid length. [ 1624.906101][T32656] netlink: 'syz.0.9854': attribute type 29 has an invalid length. [ 1624.923021][T32656] netlink: 'syz.0.9854': attribute type 29 has an invalid length. [ 1624.934134][T32656] netlink: 'syz.0.9854': attribute type 29 has an invalid length. [ 1624.959614][T32653] netlink: 'syz.0.9854': attribute type 10 has an invalid length. [ 1625.025120][T32653] veth0_vlan: left promiscuous mode [ 1625.049175][T32653] veth0_vlan: entered promiscuous mode [ 1625.087447][T32653] team0: Device veth0_vlan failed to register rx_handler [ 1625.160790][T32661] __nla_validate_parse: 7 callbacks suppressed [ 1625.160830][T32661] netlink: 141864 bytes leftover after parsing attributes in process `syz.2.9857'. [ 1625.178381][T32661] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9857'. [ 1625.203486][T32656] netlink: 'syz.0.9854': attribute type 29 has an invalid length. [ 1625.218916][T32662] netlink: 830 bytes leftover after parsing attributes in process `syz.0.9854'. [ 1625.661905][T32671] netlink: 121460 bytes leftover after parsing attributes in process `syz.0.9860'. [ 1625.673091][T32671] netlink: 21068 bytes leftover after parsing attributes in process `syz.0.9860'. [ 1625.684833][T32671] tipc: Started in network mode [ 1625.690306][T32671] tipc: Node identity b, cluster identity 57 [ 1625.698500][T32671] tipc: Node number set to 11 [ 1625.895050][T32675] netlink: 'syz.3.9858': attribute type 1 has an invalid length. [ 1625.948164][T32675] netlink: 209592 bytes leftover after parsing attributes in process `syz.3.9858'. [ 1626.076467][T32677] netlink: 141864 bytes leftover after parsing attributes in process `syz.2.9862'. [ 1626.093441][T32677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9862'. [ 1626.106553][T32683] netlink: 'syz.0.9864': attribute type 10 has an invalid length. [ 1626.140459][T32673] netlink: 121460 bytes leftover after parsing attributes in process `syz.1.9861'. [ 1626.160135][T32673] netlink: 22808 bytes leftover after parsing attributes in process `syz.1.9861'. [ 1626.408959][T32688] ¥: port 1(team0) entered blocking state [ 1626.438182][T32688] ¥: port 1(team0) entered disabled state [ 1626.475111][T32688] team0: entered allmulticast mode [ 1626.480527][T32688] team_slave_0: entered allmulticast mode [ 1626.509236][T32688] team_slave_1: entered allmulticast mode [ 1626.542202][T32688] team0: entered promiscuous mode [ 1626.563265][T32688] team_slave_0: entered promiscuous mode [ 1626.569752][T32688] team_slave_1: entered promiscuous mode [ 1626.922866][T32707] hsr_slave_0: left promiscuous mode [ 1626.991072][T32707] hsr_slave_1: left promiscuous mode [ 1627.144895][T32715] netlink: 'syz.2.9874': attribute type 1 has an invalid length. [ 1629.553425][T32745] ¥: port 1(team0) entered blocking state [ 1629.559605][T32745] ¥: port 1(team0) entered disabled state [ 1629.565817][T32745] team0: entered allmulticast mode [ 1629.571009][T32745] team_slave_0: entered allmulticast mode [ 1629.577006][T32745] team_slave_1: entered allmulticast mode [ 1629.586152][T32745] team0: entered promiscuous mode [ 1629.591369][T32745] team_slave_0: entered promiscuous mode [ 1629.598310][T32745] team_slave_1: entered promiscuous mode [ 1633.182944][T32758] : renamed from bond_slave_0 (while UP) [ 1633.490113][ T306] __nla_validate_parse: 10 callbacks suppressed [ 1633.490153][ T306] netlink: 142592 bytes leftover after parsing attributes in process `syz.3.9899'. [ 1633.516303][ T306] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9899'. [ 1639.734405][ T324] ¥: port 1(team0) entered blocking state [ 1639.740483][ T324] ¥: port 1(team0) entered disabled state [ 1639.747057][ T324] team0: entered allmulticast mode [ 1639.752338][ T324] team_slave_0: entered allmulticast mode [ 1639.762112][ T324] team_slave_1: entered allmulticast mode [ 1639.771417][ T324] team0: entered promiscuous mode [ 1639.776655][ T324] team_slave_0: entered promiscuous mode [ 1639.782666][ T324] team_slave_1: entered promiscuous mode [ 1639.956795][ T332] netlink: 'syz.0.9909': attribute type 10 has an invalid length. [ 1639.968026][ T332] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9909'. [ 1639.985534][ T332] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1640.003754][ T334] netlink: 56 bytes leftover after parsing attributes in process `syz.1.9908'. [ 1640.066818][T25161] hsr_slave_0: left promiscuous mode [ 1640.101989][T25161] hsr_slave_1: left promiscuous mode [ 1640.252771][T25161] veth1_macvtap: left promiscuous mode [ 1640.259514][T25161] veth0_macvtap: left promiscuous mode [ 1640.272689][T25161] veth1_vlan: left promiscuous mode [ 1640.281275][ T346] netlink: 'syz.0.9913': attribute type 29 has an invalid length. [ 1643.881830][T25161] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1643.932556][T25161] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1643.984768][T25161] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1644.255224][T25161] bond0 (unregistering): Released all slaves [ 1644.300042][ T346] netlink: 'syz.0.9913': attribute type 29 has an invalid length. [ 1644.515456][ T361] netlink: 168 bytes leftover after parsing attributes in process `syz.2.9917'. [ 1644.612682][ T361] netlink: 'syz.2.9917': attribute type 10 has an invalid length. [ 1644.624043][ T365] FAULT_INJECTION: forcing a failure. [ 1644.624043][ T365] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1644.650673][ T365] CPU: 1 PID: 365 Comm: syz.0.9921 Not tainted syzkaller #0 [ 1644.658034][ T365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1644.668132][ T365] Call Trace: [ 1644.671486][ T365] [ 1644.674458][ T365] dump_stack_lvl+0x18c/0x250 [ 1644.679244][ T365] ? show_regs_print_info+0x20/0x20 [ 1644.684484][ T365] ? load_image+0x420/0x420 [ 1644.689031][ T365] ? __lock_acquire+0x7d80/0x7d80 [ 1644.694122][ T365] should_fail_ex+0x394/0x4c0 [ 1644.698868][ T365] prepare_alloc_pages+0x1e1/0x5b0 [ 1644.704040][ T365] __alloc_pages+0x134/0x460 [ 1644.708684][ T365] ? zone_statistics+0x170/0x170 [ 1644.713669][ T365] ? alloc_pages+0x4e1/0x740 [ 1644.718291][ T365] ? do_raw_spin_unlock+0x121/0x230 [ 1644.723542][ T365] __get_free_pages+0xc/0x30 [ 1644.728164][ T365] kasan_populate_vmalloc_pte+0x35/0x100 [ 1644.733835][ T365] __apply_to_page_range+0x860/0xdd0 [ 1644.739184][ T365] ? kasan_populate_vmalloc+0x70/0x70 [ 1644.744591][ T365] ? apply_to_page_range+0x50/0x50 [ 1644.749739][ T365] ? do_raw_spin_unlock+0x121/0x230 [ 1644.754985][ T365] alloc_vmap_area+0x1d26/0x1e50 [ 1644.759976][ T365] ? vm_map_ram+0xcf0/0xcf0 [ 1644.764507][ T365] ? rcu_is_watching+0x15/0xb0 [ 1644.769297][ T365] __get_vm_area_node+0x162/0x370 [ 1644.774406][ T365] __vmalloc_node_range+0x36f/0x1320 [ 1644.779738][ T365] ? reuseport_array_alloc+0x98/0x120 [ 1644.785161][ T365] ? perf_trace_preemptirq_template+0xac/0x330 [ 1644.791361][ T365] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1644.797374][ T365] ? aa_get_newest_label+0xfd/0x5c0 [ 1644.802615][ T365] ? free_vm_area+0x50/0x50 [ 1644.807154][ T365] bpf_map_area_alloc+0xf1/0x110 [ 1644.812139][ T365] ? reuseport_array_alloc+0x98/0x120 [ 1644.817553][ T365] reuseport_array_alloc+0x98/0x120 [ 1644.822793][ T365] map_create+0x877/0x12f0 [ 1644.827262][ T365] __sys_bpf+0x651/0x890 [ 1644.831550][ T365] ? bpf_link_show_fdinfo+0x390/0x390 [ 1644.836980][ T365] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1644.843192][ T365] __x64_sys_bpf+0x7c/0x90 [ 1644.847655][ T365] do_syscall_64+0x55/0xb0 [ 1644.852111][ T365] ? clear_bhb_loop+0x40/0x90 [ 1644.856810][ T365] ? clear_bhb_loop+0x40/0x90 [ 1644.861514][ T365] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1644.867429][ T365] RIP: 0033:0x7fd7c7b9e159 [ 1644.871888][ T365] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1644.891537][ T365] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1644.900377][ T365] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1644.908384][ T365] RDX: 0000000000000050 RSI: 0000200000000300 RDI: 0000000000000000 [ 1644.916384][ T365] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1644.924371][ T365] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1644.932377][ T365] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1644.940381][ T365] [ 1645.207337][ T372] sock: sock_set_timeout: `syz.0.9923' (pid 372) tries to set negative timeout [ 1645.955537][ T361] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1646.153595][ T382] netlink: 'syz.3.9928': attribute type 29 has an invalid length. [ 1646.183682][ T382] netlink: 'syz.3.9928': attribute type 29 has an invalid length. [ 1646.214461][ T382] netlink: 'syz.3.9928': attribute type 29 has an invalid length. [ 1646.405954][T25161] tipc: Left network mode [ 1647.195282][ T401] netlink: 142592 bytes leftover after parsing attributes in process `syz.3.9933'. [ 1647.208865][ T401] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9933'. [ 1647.352686][ T405] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9934'. [ 1647.526894][ T414] netlink: 'syz.3.9937': attribute type 29 has an invalid length. [ 1647.660786][ T408] netlink: 'syz.0.9934': attribute type 10 has an invalid length. [ 1647.798522][ T408] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1647.829010][ T414] netlink: 'syz.3.9937': attribute type 29 has an invalid length. [ 1648.102432][ T417] netlink: 'syz.3.9937': attribute type 29 has an invalid length. [ 1648.467239][ T434] netlink: 142592 bytes leftover after parsing attributes in process `syz.3.9944'. [ 1648.478988][ T434] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9944'. [ 1648.561950][ T439] netlink: 'syz.2.9945': attribute type 21 has an invalid length. [ 1648.642423][T25161] hsr_slave_0: left promiscuous mode [ 1648.685584][ T442] netlink: 142592 bytes leftover after parsing attributes in process `syz.0.9948'. [ 1648.698008][ T442] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9948'. [ 1648.711536][T25161] hsr_slave_1: left promiscuous mode [ 1648.718609][ T446] netlink: 'syz.2.9950': attribute type 29 has an invalid length. [ 1648.746526][T25161] veth1_macvtap: left promiscuous mode [ 1648.752225][T25161] veth0_macvtap: left promiscuous mode [ 1648.758645][T25161] veth1_vlan: left promiscuous mode [ 1648.764206][T25161] veth0_vlan: left promiscuous mode [ 1650.446176][T25161] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1650.498978][T25161] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1650.549039][T25161] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1650.835557][T25161] bond0 (unregistering): Released all slaves [ 1650.879375][ T446] netlink: 'syz.2.9950': attribute type 29 has an invalid length. [ 1650.902976][ T457] netlink: 168 bytes leftover after parsing attributes in process `syz.1.9951'. [ 1650.983924][ T468] FAULT_INJECTION: forcing a failure. [ 1650.983924][ T468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1651.003565][ T459] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1651.022218][ T468] CPU: 0 PID: 468 Comm: syz.2.9953 Not tainted syzkaller #0 [ 1651.029568][ T468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1651.039664][ T468] Call Trace: [ 1651.042975][ T468] [ 1651.045946][ T468] dump_stack_lvl+0x18c/0x250 [ 1651.050687][ T468] ? show_regs_print_info+0x20/0x20 [ 1651.055940][ T468] ? load_image+0x420/0x420 [ 1651.060495][ T468] ? __lock_acquire+0x7d80/0x7d80 [ 1651.065667][ T468] ? snprintf+0xe9/0x140 [ 1651.069962][ T468] should_fail_ex+0x394/0x4c0 [ 1651.074695][ T468] _copy_to_user+0x2f/0xa0 [ 1651.079174][ T468] simple_read_from_buffer+0xe7/0x150 [ 1651.084611][ T468] proc_fail_nth_read+0x1e8/0x260 [ 1651.089707][ T468] ? proc_fault_inject_write+0x360/0x360 [ 1651.095420][ T468] ? fsnotify_perm+0x271/0x5e0 [ 1651.100775][ T468] ? proc_fault_inject_write+0x360/0x360 [ 1651.106476][ T468] vfs_read+0x298/0x990 [ 1651.110693][ T468] ? kernel_read+0x1e0/0x1e0 [ 1651.115377][ T468] ? __fget_files+0x28/0x460 [ 1651.120044][ T468] ? __fget_files+0x3fc/0x460 [ 1651.124800][ T468] ? __fdget_pos+0x2a3/0x330 [ 1651.129436][ T468] ? ksys_read+0x74/0x260 [ 1651.133827][ T468] ksys_read+0x151/0x260 [ 1651.138127][ T468] ? vfs_write+0x9a0/0x9a0 [ 1651.142616][ T468] ? lockdep_hardirqs_on+0x98/0x150 [ 1651.147858][ T468] do_syscall_64+0x55/0xb0 [ 1651.152341][ T468] ? clear_bhb_loop+0x40/0x90 [ 1651.157057][ T468] ? clear_bhb_loop+0x40/0x90 [ 1651.161810][ T468] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1651.167756][ T468] RIP: 0033:0x7fd85375e98e [ 1651.172196][ T468] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1651.191833][ T468] RSP: 002b:00007fd854734fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1651.200285][ T468] RAX: ffffffffffffffda RBX: 00007fd8547356c0 RCX: 00007fd85375e98e [ 1651.208273][ T468] RDX: 000000000000000f RSI: 00007fd8547350a0 RDI: 0000000000000004 [ 1651.216278][ T468] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1651.224376][ T468] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1651.232386][ T468] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1651.240402][ T468] [ 1651.273813][ T464] dummy0: entered promiscuous mode [ 1651.279198][ T464] dummy0: entered allmulticast mode [ 1651.303409][ T464] team0: Port device dummy0 added [ 1651.309142][ T465] validate_nla: 2 callbacks suppressed [ 1651.309157][ T465] netlink: 'syz.0.9952': attribute type 10 has an invalid length. [ 1651.445078][ T474] netlink: 142592 bytes leftover after parsing attributes in process `syz.2.9956'. [ 1651.456029][ T474] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9956'. [ 1651.844065][ T488] netlink: 'syz.0.9962': attribute type 29 has an invalid length. [ 1651.852287][ T488] netlink: 'syz.0.9962': attribute type 29 has an invalid length. [ 1651.861682][ T488] netlink: 'syz.0.9962': attribute type 29 has an invalid length. [ 1652.002924][ T489] netlink: 'syz.3.9963': attribute type 10 has an invalid length. [ 1652.215922][ T489] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1652.338125][ T505] __nla_validate_parse: 1 callbacks suppressed [ 1652.338166][ T505] netlink: 142516 bytes leftover after parsing attributes in process `syz.0.9969'. [ 1652.799096][ T516] netlink: 'syz.2.9973': attribute type 29 has an invalid length. [ 1652.815950][ T516] netlink: 'syz.2.9973': attribute type 29 has an invalid length. [ 1652.825522][ T516] netlink: 'syz.2.9973': attribute type 29 has an invalid length. [ 1652.901367][ T520] netlink: 36 bytes leftover after parsing attributes in process `syz.3.9975'. [ 1655.685696][ T533] FAULT_INJECTION: forcing a failure. [ 1655.685696][ T533] name failslab, interval 1, probability 0, space 0, times 0 [ 1655.733238][ T533] CPU: 1 PID: 533 Comm: syz.2.9978 Not tainted syzkaller #0 [ 1655.740633][ T533] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1655.750725][ T533] Call Trace: [ 1655.754044][ T533] [ 1655.757029][ T533] dump_stack_lvl+0x18c/0x250 [ 1655.761760][ T533] ? show_regs_print_info+0x20/0x20 [ 1655.767010][ T533] ? load_image+0x420/0x420 [ 1655.771562][ T533] ? __lock_acquire+0x7d80/0x7d80 [ 1655.776628][ T533] ? number+0xc9d/0xf00 [ 1655.780868][ T533] should_fail_ex+0x394/0x4c0 [ 1655.785593][ T533] should_failslab+0x9/0x20 [ 1655.790147][ T533] slab_pre_alloc_hook+0x59/0x300 [ 1655.795235][ T533] ? __kthread_create_on_node+0x1b4/0x3d0 [ 1655.800997][ T533] ? __kthread_create_on_node+0x1b4/0x3d0 [ 1655.806761][ T533] __kmem_cache_alloc_node+0x53/0x250 [ 1655.812209][ T533] ? __kthread_create_on_node+0x1b4/0x3d0 [ 1655.817974][ T533] __kmalloc_node_track_caller+0xa4/0x230 [ 1655.823753][ T533] kvasprintf+0xec/0x1a0 [ 1655.828047][ T533] ? bust_spinlocks+0xd0/0xd0 [ 1655.832784][ T533] __kthread_create_on_node+0x1b4/0x3d0 [ 1655.838370][ T533] ? kthread_create_on_node+0x140/0x140 [ 1655.843965][ T533] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1655.849990][ T533] ? rxrpc_direct_abort+0x330/0x330 [ 1655.855240][ T533] ? rxrpc_direct_abort+0x330/0x330 [ 1655.860482][ T533] kthread_create_on_node+0xec/0x140 [ 1655.865813][ T533] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1655.871235][ T533] ? tsk_fork_get_node+0x70/0x70 [ 1655.876234][ T533] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1655.881675][ T533] rxrpc_lookup_local+0x1041/0x1700 [ 1655.886960][ T533] ? rxrpc_local_dont_fragment+0x70/0x70 [ 1655.892675][ T533] ? none_clear+0x10/0x10 [ 1655.897106][ T533] ? rxrpc_client_conn_reap_timeout+0xd0/0xd0 [ 1655.903231][ T533] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1655.908658][ T533] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1655.914084][ T533] ? do_raw_spin_unlock+0x121/0x230 [ 1655.919331][ T533] rxrpc_sendmsg+0x2f3/0x5b0 [ 1655.923962][ T533] ? rxrpc_getsockopt+0x150/0x150 [ 1655.929035][ T533] ____sys_sendmsg+0x61b/0x980 [ 1655.933846][ T533] ? __sys_sendmsg_sock+0x30/0x30 [ 1655.938928][ T533] ? __import_iovec+0x3fa/0x850 [ 1655.943855][ T533] ? import_iovec+0x73/0xa0 [ 1655.948417][ T533] ___sys_sendmsg+0x2a6/0x360 [ 1655.953176][ T533] ? get_pid_task+0x20/0x1e0 [ 1655.957830][ T533] ? __sys_sendmsg+0x2b0/0x2b0 [ 1655.962671][ T533] ? __lock_acquire+0x7d80/0x7d80 [ 1655.967779][ T533] __se_sys_sendmsg+0x1d0/0x2c0 [ 1655.972682][ T533] ? __x64_sys_sendmsg+0x80/0x80 [ 1655.977698][ T533] ? lockdep_hardirqs_on+0x98/0x150 [ 1655.982967][ T533] do_syscall_64+0x55/0xb0 [ 1655.987446][ T533] ? clear_bhb_loop+0x40/0x90 [ 1655.992179][ T533] ? clear_bhb_loop+0x40/0x90 [ 1655.996909][ T533] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1656.002850][ T533] RIP: 0033:0x7fd85379e159 [ 1656.007341][ T533] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1656.026994][ T533] RSP: 002b:00007fd854735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1656.035454][ T533] RAX: ffffffffffffffda RBX: 00007fd853a25fa0 RCX: 00007fd85379e159 [ 1656.043463][ T533] RDX: 0000000000000002 RSI: 0000200000000080 RDI: 0000000000000004 [ 1656.051471][ T533] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1656.059469][ T533] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1656.067469][ T533] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1656.075507][ T533] [ 1656.480204][ T543] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9984'. [ 1656.507233][ T544] netlink: 'syz.2.9983': attribute type 29 has an invalid length. [ 1656.705746][ T544] netlink: 'syz.2.9983': attribute type 29 has an invalid length. [ 1656.717769][ T548] netlink: 'syz.2.9983': attribute type 29 has an invalid length. [ 1656.728672][ T543] netlink: 'syz.0.9984': attribute type 10 has an invalid length. [ 1656.745043][ T5785] Bluetooth: hci3: command 0x0406 tx timeout [ 1656.837889][ T537] netlink: 142516 bytes leftover after parsing attributes in process `syz.1.9980'. [ 1659.562542][ T554] netlink: 'syz.0.9986': attribute type 3 has an invalid length. [ 1659.574742][ T554] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.9986'. [ 1660.071845][ T569] syz.1.9990[569] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1660.072002][ T569] syz.1.9990[569] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1660.092734][T31082] Bluetooth: hci0: Received unexpected HCI Event 0x00 [ 1661.256452][ T575] netlink: 'syz.0.9993': attribute type 29 has an invalid length. [ 1662.319399][ T575] netlink: 'syz.0.9993': attribute type 29 has an invalid length. [ 1664.468346][ T580] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9994'. [ 1664.478978][ T583] netlink: 'syz.0.9994': attribute type 10 has an invalid length. [ 1664.953788][ T589] FAULT_INJECTION: forcing a failure. [ 1664.953788][ T589] name failslab, interval 1, probability 0, space 0, times 0 [ 1664.978331][ T589] CPU: 1 PID: 589 Comm: syz.0.9996 Not tainted syzkaller #0 [ 1664.985695][ T589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1664.995792][ T589] Call Trace: [ 1664.999110][ T589] [ 1665.002079][ T589] dump_stack_lvl+0x18c/0x250 [ 1665.006814][ T589] ? show_regs_print_info+0x20/0x20 [ 1665.012120][ T589] ? load_image+0x420/0x420 [ 1665.016681][ T589] ? __might_sleep+0xe0/0xe0 [ 1665.021335][ T589] ? __lock_acquire+0x7d80/0x7d80 [ 1665.026405][ T589] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1665.032438][ T589] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 1665.039829][ T589] should_fail_ex+0x394/0x4c0 [ 1665.044554][ T589] should_failslab+0x9/0x20 [ 1665.049090][ T589] slab_pre_alloc_hook+0x59/0x300 [ 1665.054167][ T589] ? lockdep_hardirqs_on+0x98/0x150 [ 1665.059407][ T589] ? kvmalloc_node+0x70/0x180 [ 1665.064115][ T589] ? kvmalloc_node+0x70/0x180 [ 1665.068849][ T589] __kmem_cache_alloc_node+0x53/0x250 [ 1665.074273][ T589] ? kvmalloc_node+0x70/0x180 [ 1665.078982][ T589] __kmalloc_node+0xa6/0x240 [ 1665.083617][ T589] kvmalloc_node+0x70/0x180 [ 1665.088153][ T589] alloc_netdev_mqs+0xa5a/0x1040 [ 1665.093140][ T589] ? IP6_ECN_decapsulate+0x1830/0x1830 [ 1665.098652][ T589] ip6_tnl_locate+0x684/0x830 [ 1665.103368][ T589] ? ip6_tnl_parm_from_user+0x340/0x340 [ 1665.108960][ T589] ? __might_fault+0xaa/0x120 [ 1665.113653][ T589] ? __might_fault+0xc6/0x120 [ 1665.118359][ T589] ? __might_fault+0xaa/0x120 [ 1665.123081][ T589] ? ip6_tnl_siocdevprivate+0x5ed/0xab0 [ 1665.128702][ T589] ip6_tnl_siocdevprivate+0x61b/0xab0 [ 1665.134170][ T589] ? ip6_tnl_start_xmit+0x1230/0x1230 [ 1665.139569][ T589] ? dev_ioctl+0x83c/0x1140 [ 1665.144150][ T589] ? dev_ifsioc+0x957/0xc40 [ 1665.148700][ T589] dev_ioctl+0x84c/0x1140 [ 1665.153072][ T589] sock_ioctl+0x74c/0x7e0 [ 1665.157473][ T589] ? sock_poll+0x3e0/0x3e0 [ 1665.161954][ T589] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1665.166917][ T589] ? security_file_ioctl+0x80/0xa0 [ 1665.172073][ T589] ? sock_poll+0x3e0/0x3e0 [ 1665.176509][ T589] __se_sys_ioctl+0xfd/0x170 [ 1665.181118][ T589] do_syscall_64+0x55/0xb0 [ 1665.185555][ T589] ? clear_bhb_loop+0x40/0x90 [ 1665.190272][ T589] ? clear_bhb_loop+0x40/0x90 [ 1665.195007][ T589] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1665.200971][ T589] RIP: 0033:0x7fd7c7b9e159 [ 1665.205415][ T589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1665.225040][ T589] RSP: 002b:00007fd7c89ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1665.233494][ T589] RAX: ffffffffffffffda RBX: 00007fd7c7e25fa0 RCX: 00007fd7c7b9e159 [ 1665.241520][ T589] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000005 [ 1665.249530][ T589] RBP: 00007fd7c89ba090 R08: 0000000000000000 R09: 0000000000000000 [ 1665.257529][ T589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1665.265529][ T589] R13: 00007fd7c7e26038 R14: 00007fd7c7e25fa0 R15: 00007fff5f578628 [ 1665.273531][ T589] [ 1665.413949][ T597] team0: left allmulticast mode [ 1665.418907][ T597] team_slave_0: left allmulticast mode [ 1665.424877][ T597] team_slave_1: left allmulticast mode [ 1665.430437][ T597] dummy0: left allmulticast mode [ 1665.443333][ T597] team0: left promiscuous mode [ 1665.448160][ T597] team_slave_0: left promiscuous mode [ 1665.455508][ T597] team_slave_1: left promiscuous mode [ 1665.461543][ T597] dummy0: left promiscuous mode [ 1665.472941][ T597] ¥: port 1(team0) entered disabled state [ 1665.544402][ T599] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.9999'. [ 1665.700885][ T604] FAULT_INJECTION: forcing a failure. [ 1665.700885][ T604] name failslab, interval 1, probability 0, space 0, times 0 [ 1665.717702][ T604] CPU: 1 PID: 604 Comm: syz.2.10001 Not tainted syzkaller #0 [ 1665.725134][ T604] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1665.735251][ T604] Call Trace: [ 1665.738559][ T604] [ 1665.741511][ T604] dump_stack_lvl+0x18c/0x250 [ 1665.746222][ T604] ? show_regs_print_info+0x20/0x20 [ 1665.751450][ T604] ? load_image+0x420/0x420 [ 1665.755998][ T604] should_fail_ex+0x394/0x4c0 [ 1665.760719][ T604] should_failslab+0x9/0x20 [ 1665.765264][ T604] slab_pre_alloc_hook+0x59/0x300 [ 1665.770344][ T604] kmem_cache_alloc+0x5a/0x2c0 [ 1665.775139][ T604] ? skb_clone+0x1eb/0x370 [ 1665.779592][ T604] skb_clone+0x1eb/0x370 [ 1665.783867][ T604] __netlink_deliver_tap+0x411/0x7f0 [ 1665.789193][ T604] ? netlink_deliver_tap+0x2e/0x1b0 [ 1665.794420][ T604] netlink_deliver_tap+0x19c/0x1b0 [ 1665.799586][ T604] netlink_dump+0x95b/0xec0 [ 1665.804130][ T604] ? netlink_lookup+0x200/0x200 [ 1665.809015][ T604] ? slab_free_freelist_hook+0x130/0x1a0 [ 1665.814682][ T604] ? netlink_recvmsg+0x5e7/0xe60 [ 1665.819644][ T604] ? kmem_cache_free+0xf8/0x290 [ 1665.824544][ T604] netlink_recvmsg+0x693/0xe60 [ 1665.829342][ T604] ? netlink_sendmsg+0xbf0/0xbf0 [ 1665.834328][ T604] ? aa_af_perm+0x330/0x330 [ 1665.838856][ T604] ? __lock_acquire+0x1262/0x7d80 [ 1665.843917][ T604] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 1665.849226][ T604] ? security_socket_recvmsg+0x89/0xb0 [ 1665.854705][ T604] ? netlink_sendmsg+0xbf0/0xbf0 [ 1665.859664][ T604] ____sys_recvmsg+0x2bd/0x5d0 [ 1665.864458][ T604] ? __sys_recvmsg_sock+0x50/0x50 [ 1665.869515][ T604] ? import_iovec+0x73/0xa0 [ 1665.874046][ T604] ___sys_recvmsg+0x214/0x590 [ 1665.878755][ T604] ? __sys_recvmsg+0x2a0/0x2a0 [ 1665.883566][ T604] ? ksys_write+0x1d2/0x260 [ 1665.888196][ T604] ? __fget_files+0x3fc/0x460 [ 1665.892909][ T604] __x64_sys_recvmsg+0x21e/0x2f0 [ 1665.897873][ T604] ? ___sys_recvmsg+0x590/0x590 [ 1665.902750][ T604] ? lockdep_hardirqs_on+0x98/0x150 [ 1665.907973][ T604] do_syscall_64+0x55/0xb0 [ 1665.912401][ T604] ? clear_bhb_loop+0x40/0x90 [ 1665.917098][ T604] ? clear_bhb_loop+0x40/0x90 [ 1665.921793][ T604] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1665.927711][ T604] RIP: 0033:0x7fd85379e159 [ 1665.932146][ T604] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1665.951778][ T604] RSP: 002b:00007fd854735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1665.960241][ T604] RAX: ffffffffffffffda RBX: 00007fd853a25fa0 RCX: 00007fd85379e159 [ 1665.968247][ T604] RDX: 0000000000000100 RSI: 0000200000000080 RDI: 0000000000000003 [ 1665.976252][ T604] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1665.984262][ T604] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1665.992261][ T604] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1666.000275][ T604] [ 1666.365997][T31082] Bluetooth: hci1: command 0x0406 tx timeout [ 1666.728484][ T623] netlink: 168 bytes leftover after parsing attributes in process `syz.1.10006'. [ 1666.800486][ T623] netlink: 'syz.1.10006': attribute type 10 has an invalid length. [ 1666.829916][ T627] netlink: 166900 bytes leftover after parsing attributes in process `syz.3.10008'. [ 1666.878347][ T633] syz.2.10009[633] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1666.878525][ T633] syz.2.10009[633] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1666.953307][ T5785] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 1667.530893][ T639] netlink: 142516 bytes leftover after parsing attributes in process `syz.3.10010'. [ 1668.038586][ T645] FAULT_INJECTION: forcing a failure. [ 1668.038586][ T645] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1668.052010][ T645] CPU: 1 PID: 645 Comm: syz.3.10013 Not tainted syzkaller #0 [ 1668.059437][ T645] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1668.069528][ T645] Call Trace: [ 1668.072839][ T645] [ 1668.075810][ T645] dump_stack_lvl+0x18c/0x250 [ 1668.080544][ T645] ? show_regs_print_info+0x20/0x20 [ 1668.085791][ T645] ? load_image+0x420/0x420 [ 1668.090334][ T645] ? __might_fault+0xaa/0x120 [ 1668.095065][ T645] ? __lock_acquire+0x7d80/0x7d80 [ 1668.100143][ T645] ? unix_ioctl+0x259/0x6b0 [ 1668.104701][ T645] should_fail_ex+0x394/0x4c0 [ 1668.109427][ T645] _copy_from_user+0x2f/0xe0 [ 1668.114067][ T645] sock_do_ioctl+0x190/0x310 [ 1668.118715][ T645] ? sock_show_fdinfo+0xb0/0xb0 [ 1668.123642][ T645] sock_ioctl+0x5be/0x7e0 [ 1668.128035][ T645] ? sock_poll+0x3e0/0x3e0 [ 1668.132528][ T645] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1668.137775][ T645] ? security_file_ioctl+0x80/0xa0 [ 1668.142929][ T645] ? sock_poll+0x3e0/0x3e0 [ 1668.147374][ T645] __se_sys_ioctl+0xfd/0x170 [ 1668.152024][ T645] do_syscall_64+0x55/0xb0 [ 1668.156468][ T645] ? clear_bhb_loop+0x40/0x90 [ 1668.161179][ T645] ? clear_bhb_loop+0x40/0x90 [ 1668.165893][ T645] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1668.171814][ T645] RIP: 0033:0x7fbbb019e159 [ 1668.176260][ T645] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1668.195887][ T645] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1668.204327][ T645] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1668.212318][ T645] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000004 [ 1668.220309][ T645] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1668.228303][ T645] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1668.236314][ T645] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1668.244334][ T645] [ 1668.513640][ T657] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.10017'. [ 1669.091196][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.097930][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.436921][ T673] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.10021'. [ 1669.560148][ T677] netlink: 'syz.3.10023': attribute type 10 has an invalid length. [ 1669.675043][ T682] syz.3.10024[682] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1669.675196][ T682] syz.3.10024[682] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1669.701544][ T681] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.10032'. [ 1669.730336][ T5785] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 1670.479534][ T697] netlink: 'syz.3.10028': attribute type 1 has an invalid length. [ 1670.487787][ T697] netlink: 15970 bytes leftover after parsing attributes in process `syz.3.10028'. [ 1670.499340][ T697] netlink: 'syz.3.10028': attribute type 1 has an invalid length. [ 1670.508533][ T697] netlink: 15970 bytes leftover after parsing attributes in process `syz.3.10028'. [ 1670.625362][ T703] netlink: 'syz.3.10031': attribute type 10 has an invalid length. [ 1670.666915][ T705] netlink: 'syz.0.10033': attribute type 10 has an invalid length. [ 1670.856246][ T711] netlink: 142516 bytes leftover after parsing attributes in process `syz.1.10035'. [ 1671.449175][ T725] FAULT_INJECTION: forcing a failure. [ 1671.449175][ T725] name failslab, interval 1, probability 0, space 0, times 0 [ 1671.462079][ T725] CPU: 0 PID: 725 Comm: syz.3.10043 Not tainted syzkaller #0 [ 1671.470025][ T725] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1671.480119][ T725] Call Trace: [ 1671.483442][ T725] [ 1671.486422][ T725] dump_stack_lvl+0x18c/0x250 [ 1671.491158][ T725] ? show_regs_print_info+0x20/0x20 [ 1671.496408][ T725] ? load_image+0x420/0x420 [ 1671.500958][ T725] ? __might_sleep+0xe0/0xe0 [ 1671.505597][ T725] ? __lock_acquire+0x7d80/0x7d80 [ 1671.510673][ T725] should_fail_ex+0x394/0x4c0 [ 1671.515404][ T725] should_failslab+0x9/0x20 [ 1671.519987][ T725] slab_pre_alloc_hook+0x59/0x300 [ 1671.525081][ T725] ? rtnl_newlink+0x10d/0x2170 [ 1671.529934][ T725] __kmem_cache_alloc_node+0x53/0x250 [ 1671.535369][ T725] ? rtnl_newlink+0x10d/0x2170 [ 1671.540210][ T725] kmalloc_trace+0x2a/0xe0 [ 1671.544688][ T725] rtnl_newlink+0x10d/0x2170 [ 1671.549325][ T725] ? arch_stack_walk+0x160/0x190 [ 1671.554410][ T725] ? verify_lock_unused+0x140/0x140 [ 1671.559669][ T725] ? __mutex_trylock_common+0x160/0x270 [ 1671.565259][ T725] ? rtnl_setlink+0x4e0/0x4e0 [ 1671.569979][ T725] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1671.576187][ T725] ? rcu_is_watching+0x15/0xb0 [ 1671.580998][ T725] ? trace_contention_end+0x39/0xe0 [ 1671.586242][ T725] ? __mutex_lock+0x30d/0xc80 [ 1671.590977][ T725] ? rtnetlink_rcv_msg+0x7ed/0xf90 [ 1671.596138][ T725] ? mutex_lock_nested+0x20/0x20 [ 1671.601142][ T725] ? rtnl_setlink+0x4e0/0x4e0 [ 1671.605865][ T725] rtnetlink_rcv_msg+0x843/0xf90 [ 1671.610879][ T725] ? rtnetlink_rcv_msg+0x220/0xf90 [ 1671.616059][ T725] ? rtnetlink_bind+0x80/0x80 [ 1671.620788][ T725] ? perf_trace_preemptirq_template+0xac/0x330 [ 1671.626996][ T725] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1671.633034][ T725] ? lock_chain_count+0x20/0x20 [ 1671.637958][ T725] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1671.643386][ T725] ? lockdep_hardirqs_on+0x98/0x150 [ 1671.648638][ T725] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1671.654043][ T725] ? _local_bh_enable+0xa0/0xa0 [ 1671.658941][ T725] ? __dev_queue_xmit+0x275/0x3640 [ 1671.664101][ T725] ? __dev_queue_xmit+0x1bc2/0x3640 [ 1671.669390][ T725] ? __dev_queue_xmit+0x275/0x3640 [ 1671.674584][ T725] ? ref_tracker_free+0x686/0x830 [ 1671.679665][ T725] netlink_rcv_skb+0x235/0x4c0 [ 1671.684504][ T725] ? rtnetlink_bind+0x80/0x80 [ 1671.689228][ T725] ? netlink_ack+0x1160/0x1160 [ 1671.694051][ T725] ? __lock_acquire+0x7d80/0x7d80 [ 1671.699130][ T725] ? netlink_deliver_tap+0x2e/0x1b0 [ 1671.704377][ T725] netlink_unicast+0x7b1/0x930 [ 1671.709223][ T725] netlink_sendmsg+0x8d0/0xbf0 [ 1671.714070][ T725] ? netlink_getsockopt+0x590/0x590 [ 1671.719327][ T725] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1671.724915][ T725] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1671.730261][ T725] ? security_socket_sendmsg+0x80/0xa0 [ 1671.735767][ T725] ? netlink_getsockopt+0x590/0x590 [ 1671.741015][ T725] ____sys_sendmsg+0x61b/0x980 [ 1671.745837][ T725] ? __asan_memset+0x22/0x40 [ 1671.750469][ T725] ? __sys_sendmsg_sock+0x30/0x30 [ 1671.755529][ T725] ? __import_iovec+0x5f2/0x850 [ 1671.760444][ T725] ? import_iovec+0x73/0xa0 [ 1671.764997][ T725] ___sys_sendmsg+0x2a6/0x360 [ 1671.769722][ T725] ? get_pid_task+0x20/0x1e0 [ 1671.774360][ T725] ? __sys_sendmsg+0x2b0/0x2b0 [ 1671.779227][ T725] ? __lock_acquire+0x7d80/0x7d80 [ 1671.784351][ T725] __se_sys_sendmsg+0x1d0/0x2c0 [ 1671.789244][ T725] ? __x64_sys_sendmsg+0x80/0x80 [ 1671.794243][ T725] ? lockdep_hardirqs_on+0x98/0x150 [ 1671.799518][ T725] do_syscall_64+0x55/0xb0 [ 1671.803982][ T725] ? clear_bhb_loop+0x40/0x90 [ 1671.808707][ T725] ? clear_bhb_loop+0x40/0x90 [ 1671.813441][ T725] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1671.819398][ T725] RIP: 0033:0x7fbbb019e159 [ 1671.823964][ T725] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1671.843610][ T725] RSP: 002b:00007fbbb0f99028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1671.852068][ T725] RAX: ffffffffffffffda RBX: 00007fbbb0425fa0 RCX: 00007fbbb019e159 [ 1671.860080][ T725] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000003 [ 1671.868087][ T725] RBP: 00007fbbb0f99090 R08: 0000000000000000 R09: 0000000000000000 [ 1671.876088][ T725] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1671.884098][ T725] R13: 00007fbbb0426038 R14: 00007fbbb0425fa0 R15: 00007ffc60166458 [ 1671.892124][ T725] [ 1672.042146][ T729] netlink: 'syz.3.10045': attribute type 10 has an invalid length. [ 1674.453640][ T753] netlink: 142516 bytes leftover after parsing attributes in process `syz.0.10053'. [ 1674.530567][ T757] syz.2.10055[757] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1674.530722][ T757] syz.2.10055[757] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1674.564406][ T5785] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 1674.813822][ T761] netlink: 168 bytes leftover after parsing attributes in process `syz.1.10054'. [ 1674.925338][ T762] netlink: 'syz.1.10054': attribute type 10 has an invalid length. [ 1677.707175][ T767] bond0: mtu less than device minimum [ 1677.747883][ T770] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.10058'. [ 1677.768062][ T771] netlink: 168 bytes leftover after parsing attributes in process `syz.0.10064'. [ 1677.801771][ T771] netlink: 'syz.0.10064': attribute type 10 has an invalid length. [ 1678.699146][ T788] netlink: 'syz.3.10066': attribute type 10 has an invalid length. [ 1678.724563][ T788] netlink: 'syz.3.10066': attribute type 4 has an invalid length. [ 1678.748597][ T788] netlink: 116 bytes leftover after parsing attributes in process `syz.3.10066'. [ 1678.784571][ T787] netlink: 142516 bytes leftover after parsing attributes in process `syz.0.10065'. [ 1678.797626][ T788] team0: left allmulticast mode [ 1678.806505][ T788] team_slave_0: left allmulticast mode [ 1678.818714][ T788] team_slave_1: left allmulticast mode [ 1678.828903][ T788] team0: left promiscuous mode [ 1678.837281][ T788] team_slave_0: left promiscuous mode [ 1678.847270][ T788] team_slave_1: left promiscuous mode [ 1678.860999][ T788] ¥: port 1(team0) entered disabled state [ 1681.173871][ T788] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1681.306872][ T795] syz.3.10069[795] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1681.307031][ T795] syz.3.10069[795] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1681.324500][ T5785] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 1682.146639][ T806] netlink: 142516 bytes leftover after parsing attributes in process `syz.3.10073'. [ 1682.644776][ T821] netlink: 'syz.0.10077': attribute type 2 has an invalid length. [ 1682.697854][ T821] netlink: 17267 bytes leftover after parsing attributes in process `syz.0.10077'. [ 1682.770086][ T824] FAULT_INJECTION: forcing a failure. [ 1682.770086][ T824] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1682.785712][ T824] CPU: 1 PID: 824 Comm: syz.1.10079 Not tainted syzkaller #0 [ 1682.793167][ T824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1682.803269][ T824] Call Trace: [ 1682.806588][ T824] [ 1682.809552][ T824] dump_stack_lvl+0x18c/0x250 [ 1682.814287][ T824] ? show_regs_print_info+0x20/0x20 [ 1682.819544][ T824] ? load_image+0x420/0x420 [ 1682.824102][ T824] ? __might_fault+0xaa/0x120 [ 1682.828833][ T824] ? __lock_acquire+0x7d80/0x7d80 [ 1682.833928][ T824] should_fail_ex+0x394/0x4c0 [ 1682.838664][ T824] _copy_from_user+0x2f/0xe0 [ 1682.843307][ T824] __sys_bpf+0x23e/0x890 [ 1682.847601][ T824] ? bpf_link_show_fdinfo+0x390/0x390 [ 1682.853048][ T824] ? lock_chain_count+0x20/0x20 [ 1682.857992][ T824] __x64_sys_bpf+0x7c/0x90 [ 1682.862458][ T824] do_syscall_64+0x55/0xb0 [ 1682.866925][ T824] ? clear_bhb_loop+0x40/0x90 [ 1682.871651][ T824] ? clear_bhb_loop+0x40/0x90 [ 1682.876382][ T824] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1682.882331][ T824] RIP: 0033:0x7fc79339e159 [ 1682.886788][ T824] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1682.906436][ T824] RSP: 002b:00007fc7915f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1682.914934][ T824] RAX: ffffffffffffffda RBX: 00007fc793626090 RCX: 00007fc79339e159 [ 1682.922948][ T824] RDX: 0000000000000050 RSI: 00002000000002c0 RDI: 000000000000000a [ 1682.930961][ T824] RBP: 00007fc7915f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1682.938985][ T824] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1682.946996][ T824] R13: 00007fc793626128 R14: 00007fc793626090 R15: 00007fff02649d38 [ 1682.955029][ T824] [ 1685.926511][ T837] syz.1.10082[837] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1685.926755][ T837] syz.1.10082[837] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1687.204224][ T848] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.10087'. [ 1687.861272][ T851] syz.3.10089[851] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1687.861556][ T851] syz.3.10089[851] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1687.908773][ T5785] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 1689.189986][ T856] bond0: mtu less than device minimum [ 1692.877664][ T878] netlink: 142516 bytes leftover after parsing attributes in process `syz.0.10097'. [ 1693.325497][ T888] syz.2.10101[888] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1693.325663][ T888] syz.2.10101[888] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1693.347897][ T886] bond0: mtu less than device minimum [ 1693.373265][ T5785] Bluetooth: hci2: Received unexpected HCI Event 0x00 [ 1694.165467][ T898] FAULT_INJECTION: forcing a failure. [ 1694.165467][ T898] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1694.178786][ T898] CPU: 1 PID: 898 Comm: syz.3.10104 Not tainted syzkaller #0 [ 1694.186222][ T898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1694.196327][ T898] Call Trace: [ 1694.199653][ T898] [ 1694.202622][ T898] dump_stack_lvl+0x18c/0x250 [ 1694.207352][ T898] ? trim_init_extable+0x6f0/0x6f0 [ 1694.212522][ T898] ? show_regs_print_info+0x20/0x20 [ 1694.217783][ T898] ? load_image+0x420/0x420 [ 1694.222336][ T898] should_fail_ex+0x394/0x4c0 [ 1694.227048][ T898] copy_to_user_nofault+0x85/0x140 [ 1694.232204][ T898] bpf_prog_19072b5a3fcf5d64+0x40/0x44 [ 1694.237704][ T898] trace_call_bpf+0x333/0x6c0 [ 1694.242409][ T898] ? trace_call_bpf+0xc3/0x6c0 [ 1694.247221][ T898] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1694.253229][ T898] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1694.259845][ T898] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 1694.265939][ T898] ? exc_page_fault+0x8c/0x100 [ 1694.270748][ T898] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1694.276326][ T898] perf_trace_lock_acquire+0x342/0x400 [ 1694.281818][ T898] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1694.288427][ T898] ? mark_lock+0x94/0x320 [ 1694.292797][ T898] lock_acquire+0x3ef/0x420 [ 1694.297327][ T898] ? __might_fault+0xaa/0x120 [ 1694.302032][ T898] ? __might_sleep+0xe0/0xe0 [ 1694.306666][ T898] ? read_lock_is_recursive+0x20/0x20 [ 1694.312089][ T898] ? verify_lock_unused+0x140/0x140 [ 1694.317323][ T898] ? __might_fault+0xaa/0x120 [ 1694.322030][ T898] __might_fault+0xc6/0x120 [ 1694.326561][ T898] ? __might_fault+0xaa/0x120 [ 1694.331275][ T898] _copy_from_user+0x2a/0xe0 [ 1694.335901][ T898] ___sys_sendmsg+0x1c7/0x360 [ 1694.340623][ T898] ? get_pid_task+0x20/0x1e0 [ 1694.345245][ T898] ? __sys_sendmsg+0x2b0/0x2b0 [ 1694.350046][ T898] ? __lock_acquire+0x7d80/0x7d80 [ 1694.355125][ T898] __se_sys_sendmsg+0x1d0/0x2c0 [ 1694.360000][ T898] ? __x64_sys_sendmsg+0x80/0x80 [ 1694.364993][ T898] ? lockdep_hardirqs_on+0x98/0x150 [ 1694.370227][ T898] do_syscall_64+0x55/0xb0 [ 1694.374680][ T898] ? clear_bhb_loop+0x40/0x90 [ 1694.379386][ T898] ? clear_bhb_loop+0x40/0x90 [ 1694.384099][ T898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1694.390039][ T898] RIP: 0033:0x7fbbb019e159 [ 1694.394484][ T898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1694.414112][ T898] RSP: 002b:00007fbbae3f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1694.422551][ T898] RAX: ffffffffffffffda RBX: 00007fbbb0426090 RCX: 00007fbbb019e159 [ 1694.430549][ T898] RDX: 000000002000c090 RSI: 0000200000000040 RDI: 0000000000000007 [ 1694.438547][ T898] RBP: 00007fbbae3f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1694.446543][ T898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1694.454532][ T898] R13: 00007fbbb0426128 R14: 00007fbbb0426090 R15: 00007ffc60166458 [ 1694.462542][ T898] [ 1694.509701][ T901] syz.0.10106[901] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1694.509850][ T901] syz.0.10106[901] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1694.547914][ T5785] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 1694.808299][ T908] FAULT_INJECTION: forcing a failure. [ 1694.808299][ T908] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1694.809591][ T908] [ 1694.809598][ T908] ====================================================== [ 1694.809606][ T908] WARNING: possible circular locking dependency detected [ 1694.809628][ T908] syzkaller #0 Not tainted [ 1694.809638][ T908] ------------------------------------------------------ [ 1694.809644][ T908] syz.2.10108/908 is trying to acquire lock: [ 1694.809655][ T908] ffffffff8d1260a0 (console_owner){-...}-{0:0}, at: console_flush_all+0x10b/0xcf0 [ 1694.809711][ T908] [ 1694.809711][ T908] but task is already holding lock: [ 1694.809718][ T908] ffff8880b8f3c258 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 1694.809771][ T908] [ 1694.809771][ T908] which lock already depends on the new lock. [ 1694.809771][ T908] [ 1694.809778][ T908] [ 1694.809778][ T908] the existing dependency chain (in reverse order) is: [ 1694.809784][ T908] [ 1694.809784][ T908] -> #4 (&rq->__lock){-.-.}-{2:2}: [ 1694.809809][ T908] _raw_spin_lock_nested+0x32/0x50 [ 1694.809831][ T908] raw_spin_rq_lock_nested+0x29/0x130 [ 1694.809859][ T908] task_fork_fair+0x62/0x1f0 [ 1694.809878][ T908] sched_cgroup_fork+0x352/0x3e0 [ 1694.809897][ T908] copy_process+0x21fd/0x3da0 [ 1694.809918][ T908] kernel_clone+0x24b/0x8a0 [ 1694.809946][ T908] user_mode_thread+0x111/0x180 [ 1694.809966][ T908] rest_init+0x27/0x300 [ 1694.809984][ T908] arch_call_rest_init+0xe/0x10 [ 1694.810066][ T908] start_kernel+0x461/0x4e0 [ 1694.810084][ T908] x86_64_start_reservations+0x2a/0x30 [ 1694.810119][ T908] copy_bootdata+0x0/0xd0 [ 1694.810144][ T908] secondary_startup_64_no_verify+0x179/0x17b [ 1694.810181][ T908] [ 1694.810181][ T908] -> #3 (&p->pi_lock){-.-.}-{2:2}: [ 1694.810207][ T908] _raw_spin_lock_irqsave+0xb4/0x100 [ 1694.810224][ T908] try_to_wake_up+0x5b/0x10e0 [ 1694.810242][ T908] __wake_up_common+0x28e/0x4d0 [ 1694.810263][ T908] __wake_up+0x125/0x1a0 [ 1694.810282][ T908] tty_port_default_wakeup+0xa2/0xf0 [ 1694.810322][ T908] serial8250_tx_chars+0x6a2/0x8b0 [ 1694.810346][ T908] serial8250_handle_irq+0x567/0x730 [ 1694.810370][ T908] serial8250_default_handle_irq+0xb8/0x1a0 [ 1694.810396][ T908] serial8250_interrupt+0x9f/0x1c0 [ 1694.810418][ T908] __handle_irq_event_percpu+0x271/0x940 [ 1694.810446][ T908] handle_irq_event+0x8b/0x1e0 [ 1694.810474][ T908] handle_edge_irq+0x246/0xb20 [ 1694.810494][ T908] __common_interrupt+0x13b/0x230 [ 1694.810523][ T908] common_interrupt+0xb4/0xd0 [ 1694.810546][ T908] asm_common_interrupt+0x26/0x40 [ 1694.810568][ T908] pv_native_safe_halt+0xf/0x10 [ 1694.810594][ T908] default_idle+0x13/0x20 [ 1694.810621][ T908] default_idle_call+0x6c/0xa0 [ 1694.810637][ T908] do_idle+0x334/0x5c0 [ 1694.810658][ T908] cpu_startup_entry+0x43/0x60 [ 1694.810680][ T908] start_secondary+0xee/0xf0 [ 1694.810700][ T908] secondary_startup_64_no_verify+0x179/0x17b [ 1694.810726][ T908] [ 1694.810726][ T908] -> #2 (&tty->write_wait){-.-.}-{2:2}: [ 1694.810752][ T908] _raw_spin_lock_irqsave+0xb4/0x100 [ 1694.810770][ T908] __wake_up+0x10b/0x1a0 [ 1694.810790][ T908] tty_port_default_wakeup+0xa2/0xf0 [ 1694.810809][ T908] serial8250_tx_chars+0x6a2/0x8b0 [ 1694.810832][ T908] serial8250_handle_irq+0x567/0x730 [ 1694.810856][ T908] serial8250_default_handle_irq+0xb8/0x1a0 [ 1694.810883][ T908] serial8250_interrupt+0x9f/0x1c0 [ 1694.810905][ T908] __handle_irq_event_percpu+0x271/0x940 [ 1694.810939][ T908] handle_irq_event+0x8b/0x1e0 [ 1694.810967][ T908] handle_edge_irq+0x246/0xb20 [ 1694.810987][ T908] __common_interrupt+0x13b/0x230 [ 1694.811009][ T908] common_interrupt+0xb4/0xd0 [ 1694.811032][ T908] asm_common_interrupt+0x26/0x40 [ 1694.811053][ T908] pv_native_safe_halt+0xf/0x10 [ 1694.811079][ T908] default_idle+0x13/0x20 [ 1694.811106][ T908] default_idle_call+0x6c/0xa0 [ 1694.811122][ T908] do_idle+0x334/0x5c0 [ 1694.811143][ T908] cpu_startup_entry+0x43/0x60 [ 1694.811165][ T908] start_secondary+0xee/0xf0 [ 1694.811184][ T908] secondary_startup_64_no_verify+0x179/0x17b [ 1694.811209][ T908] [ 1694.811209][ T908] -> #1 (&port_lock_key){-.-.}-{2:2}: [ 1694.811234][ T908] _raw_spin_lock_irqsave+0xb4/0x100 [ 1694.811253][ T908] serial8250_console_write+0x181/0x18b0 [ 1694.811277][ T908] console_flush_all+0x6ad/0xcf0 [ 1694.811300][ T908] console_unlock+0xad/0x350 [ 1694.811322][ T908] vprintk_emit+0x497/0x610 [ 1694.811343][ T908] _printk+0xde/0x130 [ 1694.811360][ T908] register_console+0xb96/0xf00 [ 1694.811383][ T908] univ8250_console_init+0x45/0x50 [ 1694.811434][ T908] console_init+0x17b/0x5d0 [ 1694.811459][ T908] start_kernel+0x2c8/0x4e0 [ 1694.811477][ T908] x86_64_start_reservations+0x2a/0x30 [ 1694.811505][ T908] copy_bootdata+0x0/0xd0 [ 1694.811531][ T908] secondary_startup_64_no_verify+0x179/0x17b [ 1694.811557][ T908] [ 1694.811557][ T908] -> #0 (console_owner){-...}-{0:0}: [ 1694.811582][ T908] __lock_acquire+0x37ef/0x7d80 [ 1694.811604][ T908] lock_acquire+0x19e/0x420 [ 1694.811625][ T908] console_flush_all+0x676/0xcf0 [ 1694.811648][ T908] console_unlock+0xad/0x350 [ 1694.811669][ T908] vprintk_emit+0x497/0x610 [ 1694.811691][ T908] _printk+0xde/0x130 [ 1694.811706][ T908] should_fail_ex+0x375/0x4c0 [ 1694.811730][ T908] copy_to_user_nofault+0x85/0x140 [ 1694.811757][ T908] bpf_prog_19072b5a3fcf5d64+0x40/0x44 [ 1694.811776][ T908] trace_call_bpf+0x333/0x6c0 [ 1694.811792][ T908] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1694.811815][ T908] perf_trace_lock_acquire+0x342/0x400 [ 1694.811832][ T908] lock_acquire+0x3ef/0x420 [ 1694.811853][ T908] psi_task_switch+0xff/0x930 [ 1694.811878][ T908] __schedule+0x21d3/0x4660 [ 1694.811902][ T908] preempt_schedule_common+0x82/0xc0 [ 1694.811934][ T908] preempt_schedule+0xc0/0xd0 [ 1694.811958][ T908] preempt_schedule_thunk+0x1a/0x30 [ 1694.811985][ T908] __local_bh_enable_ip+0x14b/0x1c0 [ 1694.812005][ T908] sctp_get_port_local+0xd26/0x15d0 [ 1694.812031][ T908] sctp_do_bind+0x4c0/0x8f0 [ 1694.812056][ T908] sctp_connect_new_asoc+0x26a/0x6a0 [ 1694.812082][ T908] sctp_sendmsg+0x1519/0x27b0 [ 1694.812106][ T908] ____sys_sendmsg+0x61b/0x980 [ 1694.812126][ T908] ___sys_sendmsg+0x2a6/0x360 [ 1694.812146][ T908] __se_sys_sendmsg+0x1d0/0x2c0 [ 1694.812166][ T908] do_syscall_64+0x55/0xb0 [ 1694.812188][ T908] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1694.812210][ T908] [ 1694.812210][ T908] other info that might help us debug this: [ 1694.812210][ T908] [ 1694.812216][ T908] Chain exists of: [ 1694.812216][ T908] console_owner --> &p->pi_lock --> &rq->__lock [ 1694.812216][ T908] [ 1694.812244][ T908] Possible unsafe locking scenario: [ 1694.812244][ T908] [ 1694.812249][ T908] CPU0 CPU1 [ 1694.812254][ T908] ---- ---- [ 1694.812259][ T908] lock(&rq->__lock); [ 1694.812271][ T908] lock(&p->pi_lock); [ 1694.812285][ T908] lock(&rq->__lock); [ 1694.812298][ T908] lock(console_owner); [ 1694.812310][ T908] [ 1694.812310][ T908] *** DEADLOCK *** [ 1694.812310][ T908] [ 1694.812314][ T908] 5 locks held by syz.2.10108/908: [ 1694.812326][ T908] #0: ffff88802fbdb2b0 (sk_lock-AF_INET){+.+.}-{0:0}, at: sctp_sendmsg+0xb62/0x27b0 [ 1694.812380][ T908] #1: ffff8880b8f3c258 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 [ 1694.812435][ T908] #2: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xc3/0x6c0 [ 1694.812479][ T908] #3: ffffffff8d126180 (console_lock){+.+.}-{0:0}, at: _printk+0xde/0x130 [ 1694.812523][ T908] #4: ffffffff8d00d990 (console_srcu){....}-{0:0}, at: console_flush_all+0x10b/0xcf0 [ 1694.812573][ T908] [ 1694.812573][ T908] stack backtrace: [ 1694.812579][ T908] CPU: 1 PID: 908 Comm: syz.2.10108 Not tainted syzkaller #0 [ 1694.812599][ T908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1694.812610][ T908] Call Trace: [ 1694.812618][ T908] [ 1694.812626][ T908] dump_stack_lvl+0x18c/0x250 [ 1694.812651][ T908] ? load_image+0x420/0x420 [ 1694.812671][ T908] ? show_regs_print_info+0x20/0x20 [ 1694.812703][ T908] ? print_circular_bug+0x12b/0x1a0 [ 1694.812733][ T908] check_noncircular+0x2fc/0x400 [ 1694.812764][ T908] ? print_deadlock_bug+0x5d0/0x5d0 [ 1694.812788][ T908] ? lockdep_lock+0xf5/0x230 [ 1694.812824][ T908] __lock_acquire+0x37ef/0x7d80 [ 1694.812872][ T908] ? verify_lock_unused+0x140/0x140 [ 1694.812944][ T908] lock_acquire+0x19e/0x420 [ 1694.812968][ T908] ? console_flush_all+0x10b/0xcf0 [ 1694.813000][ T908] ? __lock_acquire+0x7d80/0x7d80 [ 1694.813023][ T908] ? do_raw_spin_lock+0x11f/0x2b0 [ 1694.813050][ T908] ? read_lock_is_recursive+0x20/0x20 [ 1694.813075][ T908] ? __rwlock_init+0x150/0x150 [ 1694.813121][ T908] ? do_raw_spin_unlock+0x121/0x230 [ 1694.813152][ T908] console_flush_all+0x676/0xcf0 [ 1694.813179][ T908] ? console_flush_all+0x10b/0xcf0 [ 1694.813208][ T908] ? console_flush_all+0x10b/0xcf0 [ 1694.813244][ T908] ? is_console_locked+0x20/0x20 [ 1694.813282][ T908] console_unlock+0xad/0x350 [ 1694.813311][ T908] ? other_cpu_in_panic+0xf0/0xf0 [ 1694.813348][ T908] vprintk_emit+0x497/0x610 [ 1694.813377][ T908] ? printk_sprint+0x460/0x460 [ 1694.813404][ T908] ? perf_trace_lock_acquire+0x1a7/0x400 [ 1694.813436][ T908] _printk+0xde/0x130 [ 1694.813461][ T908] ? load_image+0x420/0x420 [ 1694.813492][ T908] should_fail_ex+0x375/0x4c0 [ 1694.813523][ T908] copy_to_user_nofault+0x85/0x140 [ 1694.813557][ T908] bpf_prog_19072b5a3fcf5d64+0x40/0x44 [ 1694.813581][ T908] trace_call_bpf+0x333/0x6c0 [ 1694.813601][ T908] ? trace_call_bpf+0xc3/0x6c0 [ 1694.813619][ T908] ? __lock_acquire+0x1336/0x7d80 [ 1694.813643][ T908] ? trace_call_bpf+0xc3/0x6c0 [ 1694.813666][ T908] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 1694.813696][ T908] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1694.813727][ T908] perf_trace_lock_acquire+0x342/0x400 [ 1694.813754][ T908] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1694.813777][ T908] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1694.813809][ T908] lock_acquire+0x3ef/0x420 [ 1694.813833][ T908] ? __schedule+0x21d3/0x4660 [ 1694.813867][ T908] ? read_lock_is_recursive+0x20/0x20 [ 1694.813892][ T908] ? __schedule+0x8c8/0x4660 [ 1694.813921][ T908] ? __lock_acquire+0x7d80/0x7d80 [ 1694.813953][ T908] ? local_clock+0x20/0x20 [ 1694.813978][ T908] psi_task_switch+0xff/0x930 [ 1694.814004][ T908] ? __schedule+0x21d3/0x4660 [ 1694.814035][ T908] ? __schedule+0x8c8/0x4660 [ 1694.814061][ T908] ? __schedule+0x21d3/0x4660 [ 1694.814091][ T908] __schedule+0x21d3/0x4660 [ 1694.814129][ T908] ? kasan_set_track+0x4e/0x70 [ 1694.814152][ T908] ? __kasan_slab_alloc+0x6c/0x80 [ 1694.814177][ T908] ? slab_post_alloc_hook+0x6a/0x4d0 [ 1694.814210][ T908] ? sctp_connect_new_asoc+0x26a/0x6a0 [ 1694.814238][ T908] ? sctp_sendmsg+0x1519/0x27b0 [ 1694.814264][ T908] ? ____sys_sendmsg+0x61b/0x980 [ 1694.814286][ T908] ? ___sys_sendmsg+0x2a6/0x360 [ 1694.814308][ T908] ? __se_sys_sendmsg+0x1d0/0x2c0 [ 1694.814330][ T908] ? do_syscall_64+0x55/0xb0 [ 1694.814354][ T908] ? asan.module_dtor+0x20/0x20 [ 1694.814407][ T908] ? preempt_schedule+0xc0/0xd0 [ 1694.814431][ T908] ? sctp_get_port_local+0xd26/0x15d0 [ 1694.814460][ T908] preempt_schedule_common+0x82/0xc0 [ 1694.814489][ T908] preempt_schedule+0xc0/0xd0 [ 1694.814516][ T908] ? schedule_preempt_disabled+0x20/0x20 [ 1694.814542][ T908] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1694.814570][ T908] ? lock_chain_count+0x20/0x20 [ 1694.814595][ T908] preempt_schedule_thunk+0x1a/0x30 [ 1694.814630][ T908] __local_bh_enable_ip+0x14b/0x1c0 [ 1694.814651][ T908] ? _local_bh_enable+0xa0/0xa0 [ 1694.814675][ T908] ? sctp_get_port_local+0xd26/0x15d0 [ 1694.814704][ T908] sctp_get_port_local+0xd26/0x15d0 [ 1694.814742][ T908] ? sctp_do_bind+0x8f0/0x8f0 [ 1694.814765][ T908] ? sctp_bind_addr_match+0x30/0x2a0 [ 1694.814790][ T908] sctp_do_bind+0x4c0/0x8f0 [ 1694.814818][ T908] sctp_connect_new_asoc+0x26a/0x6a0 [ 1694.814842][ T908] ? __sctp_connect+0xd80/0xd80 [ 1694.814862][ T908] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1694.814882][ T908] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 1694.814904][ T908] ? security_sctp_bind_connect+0x89/0xb0 [ 1694.814931][ T908] sctp_sendmsg+0x1519/0x27b0 [ 1694.814960][ T908] ? sctp_getsockopt+0xb60/0xb60 [ 1694.814985][ T908] ? aa_af_perm+0x330/0x330 [ 1694.815009][ T908] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 1694.815037][ T908] ? sock_rps_record_flow+0x19/0x3f0 [ 1694.815062][ T908] ? inet_sendmsg+0xce/0x2a0 [ 1694.815083][ T908] ? inet_send_prepare+0x250/0x250 [ 1694.815106][ T908] ____sys_sendmsg+0x61b/0x980 [ 1694.815128][ T908] ? __asan_memset+0x22/0x40 [ 1694.815150][ T908] ? __sys_sendmsg_sock+0x30/0x30 [ 1694.815166][ T908] ? __import_iovec+0x5f2/0x850 [ 1694.815194][ T908] ? import_iovec+0x73/0xa0 [ 1694.815218][ T908] ___sys_sendmsg+0x2a6/0x360 [ 1694.815235][ T908] ? get_pid_task+0x20/0x1e0 [ 1694.815259][ T908] ? __sys_sendmsg+0x2b0/0x2b0 [ 1694.815290][ T908] ? __lock_acquire+0x7d80/0x7d80 [ 1694.815325][ T908] __se_sys_sendmsg+0x1d0/0x2c0 [ 1694.815345][ T908] ? __x64_sys_sendmsg+0x80/0x80 [ 1694.815373][ T908] ? lockdep_hardirqs_on+0x98/0x150 [ 1694.815398][ T908] do_syscall_64+0x55/0xb0 [ 1694.815415][ T908] ? clear_bhb_loop+0x40/0x90 [ 1694.815435][ T908] ? clear_bhb_loop+0x40/0x90 [ 1694.815455][ T908] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1694.815473][ T908] RIP: 0033:0x7fd85379e159 [ 1694.815487][ T908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1694.815501][ T908] RSP: 002b:00007fd854735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1694.815517][ T908] RAX: ffffffffffffffda RBX: 00007fd853a25fa0 RCX: 00007fd85379e159 [ 1694.815528][ T908] RDX: 0000000004000040 RSI: 00002000000010c0 RDI: 0000000000000005 [ 1694.815539][ T908] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1694.815549][ T908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1694.815559][ T908] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1694.815581][ T908] [ 1696.207931][ T908] CPU: 1 PID: 908 Comm: syz.2.10108 Not tainted syzkaller #0 [ 1696.215309][ T908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1696.225387][ T908] Call Trace: [ 1696.228676][ T908] [ 1696.231620][ T908] dump_stack_lvl+0x18c/0x250 [ 1696.236315][ T908] ? show_regs_print_info+0x20/0x20 [ 1696.241543][ T908] ? load_image+0x420/0x420 [ 1696.246069][ T908] should_fail_ex+0x394/0x4c0 [ 1696.250763][ T908] copy_to_user_nofault+0x85/0x140 [ 1696.255896][ T908] bpf_prog_19072b5a3fcf5d64+0x40/0x44 [ 1696.261364][ T908] trace_call_bpf+0x333/0x6c0 [ 1696.266079][ T908] ? trace_call_bpf+0xc3/0x6c0 [ 1696.270848][ T908] ? __lock_acquire+0x1336/0x7d80 [ 1696.275882][ T908] ? trace_call_bpf+0xc3/0x6c0 [ 1696.280655][ T908] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 1696.286734][ T908] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 1696.292304][ T908] perf_trace_lock_acquire+0x342/0x400 [ 1696.297770][ T908] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1696.304367][ T908] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 1696.310971][ T908] lock_acquire+0x3ef/0x420 [ 1696.315483][ T908] ? __schedule+0x21d3/0x4660 [ 1696.320175][ T908] ? read_lock_is_recursive+0x20/0x20 [ 1696.325551][ T908] ? __schedule+0x8c8/0x4660 [ 1696.330150][ T908] ? __lock_acquire+0x7d80/0x7d80 [ 1696.335183][ T908] ? local_clock+0x20/0x20 [ 1696.339606][ T908] psi_task_switch+0xff/0x930 [ 1696.344303][ T908] ? __schedule+0x21d3/0x4660 [ 1696.348986][ T908] ? __schedule+0x8c8/0x4660 [ 1696.353602][ T908] ? __schedule+0x21d3/0x4660 [ 1696.358291][ T908] __schedule+0x21d3/0x4660 [ 1696.362838][ T908] ? kasan_set_track+0x4e/0x70 [ 1696.367612][ T908] ? __kasan_slab_alloc+0x6c/0x80 [ 1696.372672][ T908] ? slab_post_alloc_hook+0x6a/0x4d0 [ 1696.377991][ T908] ? sctp_connect_new_asoc+0x26a/0x6a0 [ 1696.383467][ T908] ? sctp_sendmsg+0x1519/0x27b0 [ 1696.388333][ T908] ? ____sys_sendmsg+0x61b/0x980 [ 1696.393280][ T908] ? ___sys_sendmsg+0x2a6/0x360 [ 1696.398136][ T908] ? __se_sys_sendmsg+0x1d0/0x2c0 [ 1696.403171][ T908] ? do_syscall_64+0x55/0xb0 [ 1696.407771][ T908] ? asan.module_dtor+0x20/0x20 [ 1696.412648][ T908] ? preempt_schedule+0xc0/0xd0 [ 1696.417501][ T908] ? sctp_get_port_local+0xd26/0x15d0 [ 1696.422881][ T908] preempt_schedule_common+0x82/0xc0 [ 1696.428176][ T908] preempt_schedule+0xc0/0xd0 [ 1696.432947][ T908] ? schedule_preempt_disabled+0x20/0x20 [ 1696.438588][ T908] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1696.444573][ T908] ? lock_chain_count+0x20/0x20 [ 1696.449432][ T908] preempt_schedule_thunk+0x1a/0x30 [ 1696.454657][ T908] __local_bh_enable_ip+0x14b/0x1c0 [ 1696.459857][ T908] ? _local_bh_enable+0xa0/0xa0 [ 1696.464715][ T908] ? sctp_get_port_local+0xd26/0x15d0 [ 1696.470096][ T908] sctp_get_port_local+0xd26/0x15d0 [ 1696.475309][ T908] ? sctp_do_bind+0x8f0/0x8f0 [ 1696.479993][ T908] ? sctp_bind_addr_match+0x30/0x2a0 [ 1696.485303][ T908] sctp_do_bind+0x4c0/0x8f0 [ 1696.489857][ T908] sctp_connect_new_asoc+0x26a/0x6a0 [ 1696.495158][ T908] ? __sctp_connect+0xd80/0xd80 [ 1696.500017][ T908] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1696.505410][ T908] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 1696.510964][ T908] ? security_sctp_bind_connect+0x89/0xb0 [ 1696.516708][ T908] sctp_sendmsg+0x1519/0x27b0 [ 1696.521395][ T908] ? sctp_getsockopt+0xb60/0xb60 [ 1696.526342][ T908] ? aa_af_perm+0x330/0x330 [ 1696.530854][ T908] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 1696.537283][ T908] ? sock_rps_record_flow+0x19/0x3f0 [ 1696.542584][ T908] ? inet_sendmsg+0xce/0x2a0 [ 1696.547199][ T908] ? inet_send_prepare+0x250/0x250 [ 1696.552321][ T908] ____sys_sendmsg+0x61b/0x980 [ 1696.557088][ T908] ? __asan_memset+0x22/0x40 [ 1696.561776][ T908] ? __sys_sendmsg_sock+0x30/0x30 [ 1696.566812][ T908] ? __import_iovec+0x5f2/0x850 [ 1696.571703][ T908] ? import_iovec+0x73/0xa0 [ 1696.576222][ T908] ___sys_sendmsg+0x2a6/0x360 [ 1696.580925][ T908] ? get_pid_task+0x20/0x1e0 [ 1696.585529][ T908] ? __sys_sendmsg+0x2b0/0x2b0 [ 1696.590307][ T908] ? __lock_acquire+0x7d80/0x7d80 [ 1696.595350][ T908] __se_sys_sendmsg+0x1d0/0x2c0 [ 1696.600210][ T908] ? __x64_sys_sendmsg+0x80/0x80 [ 1696.605160][ T908] ? lockdep_hardirqs_on+0x98/0x150 [ 1696.610367][ T908] do_syscall_64+0x55/0xb0 [ 1696.614789][ T908] ? clear_bhb_loop+0x40/0x90 [ 1696.619489][ T908] ? clear_bhb_loop+0x40/0x90 [ 1696.624174][ T908] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1696.630078][ T908] RIP: 0033:0x7fd85379e159 [ 1696.634516][ T908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1696.654146][ T908] RSP: 002b:00007fd854735028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1696.662567][ T908] RAX: ffffffffffffffda RBX: 00007fd853a25fa0 RCX: 00007fd85379e159 [ 1696.670557][ T908] RDX: 0000000004000040 RSI: 00002000000010c0 RDI: 0000000000000005 [ 1696.678530][ T908] RBP: 00007fd854735090 R08: 0000000000000000 R09: 0000000000000000 [ 1696.686502][ T908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1696.694471][ T908] R13: 00007fd853a26038 R14: 00007fd853a25fa0 R15: 00007ffc967ec308 [ 1696.702457][ T908] [ 1697.028743][ T911] netlink: 'syz.2.10108': attribute type 10 has an invalid length. [ 1697.037032][ T911] netlink: 2 bytes leftover after parsing attributes in process `syz.2.10108'. [ 1697.046397][ T911] hsr0: entered promiscuous mode [ 1697.051929][ T911] bridge0: port 3(hsr0) entered blocking state [ 1697.060887][ T911] bridge0: port 3(hsr0) entered disabled state [ 1697.069039][ T911] hsr0: entered allmulticast mode [ 1697.075816][ T911] hsr_slave_0: entered allmulticast mode [ 1697.081542][ T911] hsr_slave_1: entered allmulticast mode [ 1697.090735][ T911] bridge0: port 3(hsr0) entered blocking state [ 1697.097118][ T911] bridge0: port 3(hsr0) entered forwarding state [ 1701.863197][T31082] Bluetooth: hci2: command 0x0406 tx timeout