last executing test programs: 21.233233392s ago: executing program 4 (id=21035): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x111002, 0x0) socket$kcm(0x2, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x3, 0x2) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000080000000200000000000000", @ANYRES32=r2], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8916, &(0x7f0000000000)={r2}) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8936, &(0x7f0000000000)={r2}) 20.86492987s ago: executing program 4 (id=21039): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r0, 0x0, 0x2, 0x0) openat$cgroup_freezer_state(r0, 0x0, 0x2, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3e, '\x00', 0x0, 0x2}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e0800000709000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32, @ANYBLOB], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'\x00', 0x6132}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0xac63, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0xf, 0x2, 0xff, 0x0, 0x0, 0x2, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x5, 0xdf1d, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 20.360535861s ago: executing program 4 (id=21041): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000680)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d35, 0x1c092, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, @perf_config_ext={0xb3e, 0xfffffffffffffff8}, 0x840, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xb, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000ffffffff2e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000018000000b70000000000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xfeff, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48) 19.348731103s ago: executing program 4 (id=21046): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f92a24fc60", 0x14}], 0x3}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500"], 0x0}, 0x94) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x9) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffffe8) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x3, 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000001580)={0x0, 0x0, 0x0}, 0x0) (fail_nth: 2) 18.497551892s ago: executing program 4 (id=21049): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x29, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) r3 = socket$kcm(0x2, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$inet(r3, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000040)={r3, r2}) sendmsg$kcm(r1, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000880)="1a", 0x100000}], 0x1}, 0x0) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80005d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfff, 0xffffffffffffff90}, 0x0, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000200000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3a, 0x10, &(0x7f0000000340), 0xd58495bc, 0x0, 0xffffffffffffffff, 0xffffffffffffff5b}, 0x42) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000c40)="63eced8e46dc3f2ddf33c9e9b986", 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x50) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x4}, 0x50) perf_event_open(&(0x7f0000000480)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80001}, 0x0, 0x3, 0xffffffffffffffff, 0x8) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$kcm(r3, &(0x7f0000000380)={0x0, 0x0, 0x0}, 0x20010) sendmsg$kcm(r3, &(0x7f00000005c0)={&(0x7f0000000180)=@llc={0x1a, 0x3, 0x9, 0x20, 0x2, 0x7f, @broadcast}, 0x80, &(0x7f00000003c0)}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000480)=ANY=[], 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth0_to_hsr\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b"], 0x50) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8946, &(0x7f0000000080)) close(r1) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="36400000260091"], 0xfe33) 15.713216274s ago: executing program 4 (id=21055): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0xa, 0x5, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x6, 0x0, 0x3, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x1, @perf_bp={0x0, 0x1}, 0x21, 0x4, 0x0, 0x4, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, 0x0, 0xfe33) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd, 0x40000000}, 0x10c002, 0xac5d, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6143, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x800}, 0x0, 0xffefffffffffffff, r1, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={0x0, &(0x7f0000000580)=""/229, 0x0, 0xe5, 0x1}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000006c0)={0x4, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x0, 0x1}, 0x48) socketpair(0x1, 0x1, 0x0, 0x0) r3 = socket$kcm(0x21, 0x2, 0x2) setsockopt$sock_attach_bpf(r3, 0x1, 0x7, &(0x7f0000000040), 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8946, &(0x7f0000000080)) syz_clone(0x40a00480, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r4) r6 = perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x20, 0x12506, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x8000000000000001, 0x8}, 0x7602, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x27, 0x2, 0x0, 0x0, 0x0, 0x1, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x7ff, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0xf, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xbf21, 0x0, 0x0, 0x0, 0x3}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x1, 0x0, 0x0, 0x41000}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) close(r6) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r7}, &(0x7f0000000080), &(0x7f0000000240)=r8}, 0x20) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r9, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 2.594966643s ago: executing program 1 (id=21131): close(0xffffffffffffffff) r0 = socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) socketpair(0x6, 0x800, 0x8, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000100)={r2, &(0x7f0000000040), 0x0, 0x4000}, 0x20) r3 = socket$kcm(0x10, 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x76, &(0x7f0000000380)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x40, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0xdc, 0x8, 0x0, 0x0}}, 0x10) close(0xffffffffffffffff) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, 0x0, &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) recvmsg$unix(0xffffffffffffffff, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x10}}], 0x10}, 0x1c0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYRES8=r5], 0x9a) sendmsg$inet(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000280)=[{0x0}, {0x0}], 0x2, &(0x7f0000000a40)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @local, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @ip_retopts={{0x10}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xffff}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x8}}], 0x80}, 0x850) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007044f16c01b1fbfd00000000000a008af65f0df9928941994cc8c173fac5688671085a86d143c59fed0e57feb97f422c51d8e63b4ed9e295df3ccd1a55752dfc2f32f14b6c8f0e7413c3e9caaad30dcb412d0f54623f388bb2c63d2b1f7d83cd0cc021867bb4aee9967a6ee83e1b18fd8beca7d7eddcd96634"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x7, '\x00', r4, r6, 0x0, 0x4, 0x3}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001e80)={0x0, 0x0, &(0x7f0000001e40)=[{0x0}, {&(0x7f0000001c40)="16a96e378ce83b099d181d5a475f987ac7d4c709d72e15337f95990a6e60a814a1165f11ded69b0d5ec0e5f8b8623fe022dfb012a17e612baf4d41016d40067d0020a8df8d2cf303570f807ebcbe337791272d3365a16fb323b1be36bfefbbaea683be04d4dfa6b03e66f68ec62ab1595927c7337f400fafed4931face8a9a3088cc1bccea681ca96bda8f58190d560102", 0x91}, {&(0x7f0000001d00)="ed4db3ed244804701578c63809ca404dd04966febecc1f6aea77d9b7256eaae8cd5bdee37e40a48e581de93b75a3df82c5522ff234ce9e47ca2c487097505d01bcf21cc5a76bf4cc3f0e40d3c98b25c56972530bd0aa69bfab26eb1671b9e86eb2aa35", 0x63}], 0x3}, 0x4000000) sendmsg$inet(r0, &(0x7f00000003c0)={&(0x7f0000000240)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000280)}], 0x1, &(0x7f0000000380)}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) 2.184544303s ago: executing program 1 (id=21135): r0 = gettid() r1 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000000)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000040)=r0, 0x12) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) r3 = openat$cgroup(r2, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) openat$cgroup_netprio_ifpriomap(r3, &(0x7f0000000100), 0x2, 0x0) openat$cgroup_procs(r3, &(0x7f0000000140)='tasks\x00', 0x2, 0x0) r4 = gettid() r5 = bpf$ITER_CREATE(0x21, &(0x7f0000000180), 0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000200)={r4, r5, 0x0, 0x2, &(0x7f00000001c0)='-\x00', 0x0}, 0x30) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x400) r7 = openat$cgroup_ro(r5, &(0x7f0000000240)='blkio.bfq.io_service_bytes_recursive\x00', 0x0, 0x0) write$cgroup_type(r7, &(0x7f0000000280), 0x9) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000003c0)={@fallback=r2, 0x2e, 0x0, 0x0, &(0x7f00000002c0)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x0, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0], 0x0}, 0x40) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000004c0)={r5, 0x58, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000400)={@ifindex=r10, r7, 0x9, 0x1, r5, @void, @value=r7, @void, @void, r9}, 0x20) write$cgroup_freezer_state(r7, &(0x7f0000000500)='FROZEN\x00', 0x7) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x40082406, &(0x7f0000000540)='-\x00') sendmsg$tipc(r8, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000580)="8872afbb1a76648102d3a55345f244d2fb7a30ac29cf96628a43ee79f71756e0cb74377f0249f222c9cd245ea3532102e87a5a6753c17069c82289df475dd0dbe7f56437d8a5534d8ea9e1d86da19f10bf07624ac31fb28b1e6176ae2326d66dd95e93c0acb8515bac96aba1814a4aaa650283ec40c3c3ce538040e7d10d5fe436de67fc520f1129acf43859aefa05a05ad4a7964fdae4c01bf67401c5e52ff5feb4efa14de728c24703f9b7a03e2508a7ce80eb61fda08972994c5155c83e39f154366cd85553acfe4c6a920ae34d1a38b22c6610ca7d7d2bbbefe79644635590cb9a", 0xe3}, {&(0x7f0000000680)="fbcb065e0e23affc9ebfdb9180657973082c2fe4e1", 0x15}, {&(0x7f00000006c0)="58b11fb89254ecb853ebd796c2af27d365ac12e870df8c8fc3e82570b07bd7539d614dd601ac66e7bc9cb1c8571ab78c7b15bef8b817d3e1f46350a60d5e77c0741f5db4cc24ce472cd4a9243adca8466312322be5d71d688041cb2f01d401ea6f90974a1246f221578b7ca6b622add9514eee1fb89febcac28cc336a6332bf468523f1a520f7e2125b2a7fd8ee1497f34cbe5d48ebbf945ac35c7e97e2dce768ec3a44de19286a86c9d0b709f72639aa656342c91b606cef979f0", 0xbb}, {&(0x7f0000000780)="3968ec5f83fa2c136885a03f3ae73f8b03b27260d163aa9e3e33fb562f7b71c39b3c96ecd3cbe5336c0fe961ff73a67097ecf4be464226432783720fbad196519e16f9557a4724e791cfd0f6aa47", 0x4e}, {&(0x7f0000000800)="ab2fb3ece28f72f27f4e5338e93dcf0a106468d3a8181efae9b252114e8c43f555647e7a5b62da218c1db2edba95ee6f334c7aa5b0370c67d667f91ff8fe9c5841c817e059397e489b8c85e13475dc17cc2aec84e2e6ff4d81e98314718347c746bc6b0ac7f73b168884e1ce6a20ad3a03b91cc2259ebbe9deec8c59e79449874df751cc9982a6d0ef8beed530ddd53e1a5b1bc0490c66614c933adfa9c1ebce6e864dcb0797a4b2", 0xa8}, {&(0x7f00000008c0)="fe811fc2983a077fb5c7ec3d6e572aa6109b1ae8998412526207e76dd62c54f4bf7bce10996297a83f395ffdad505ca84b68d420bda0ddf0c07a61340d50d0045874756c56c6e1f27236e3732b4f46b913b4893790c41ea123fa3286e53158438ff69880f3e7e52107234e67c7462b4ca0a37b48b3582a9d1b000e28e97767de0e0135238759aaf54914fc", 0x8b}], 0x6, &(0x7f0000000a00)="2411fbde45eb0df3280c2515b07f700297de00be8b57b1f2e8cf72ad25369b86641ba4e39daf7c783cd5f5c1738e116a0ff3c5ec5a9b64a809410c745e23d32536a92684d83ab61877157a3d729cdd423c3367450b09fb", 0x57, 0x40080}, 0x1000c800) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000b00)={0x40, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000ac0)={@fallback=r8, r7, 0x26, 0x2020, 0x0, @void, @void, @value=r11, @void, r9}, 0x20) r12 = openat$cgroup_ro(r8, &(0x7f0000000b40)='cpuacct.usage_sys\x00', 0x0, 0x0) recvmsg$kcm(r8, &(0x7f0000000d40)={&(0x7f0000000b80)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000c00)=""/112, 0x70}], 0x1, &(0x7f0000000cc0)=""/97, 0x61}, 0x40000040) r14 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000f40)={&(0x7f0000000d80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x12c, 0x12c, 0x5, [@enum={0x8, 0x2, 0x0, 0x6, 0x4, [{0x6, 0x5}, {0xb, 0x9}]}, @int={0x2, 0x0, 0x0, 0x1, 0x0, 0x69, 0x0, 0x7c, 0x4}, @var={0x10, 0x0, 0x0, 0xe, 0x2, 0x1}, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x7, [{0x2, 0x0, 0x5}]}, @decl_tag={0xb, 0x0, 0x0, 0x11, 0x1, 0xa}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0x6, 0x1}]}, @union={0x9, 0x7, 0x0, 0x5, 0x0, 0x727, [{0x9, 0x5, 0xfffffff5}, {0xa, 0x2, 0xc}, {0x5, 0x1, 0xe}, {0x7, 0x2, 0x4}, {0x9, 0x5, 0x4}, {0x2, 0x1, 0x10001}, {0x8, 0x3, 0x1}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x1, 0x3}}, @union={0x7, 0x4, 0x0, 0x5, 0x1, 0x0, [{0x0, 0x0, 0x800}, {0xa, 0x3, 0x800}, {0xe, 0x1, 0xfffff800}, {0xb, 0x1, 0x7}]}]}, {0x0, [0x30, 0x2e, 0x2e]}}, &(0x7f0000000f00)=""/59, 0x149, 0x3b, 0x1, 0xb0a7}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000f80)=@base={0x5, 0x5, 0x400, 0x5, 0x1810c, r5, 0x3, '\x00', r13, r14, 0x5, 0x3, 0x3, 0x0, @value=r12, @void, @value=r5}, 0x50) r15 = openat$cgroup(r12, &(0x7f0000001040)='syz1\x00', 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000001000)={@cgroup=r15, r8, 0x2, 0x24, 0x0, @void, @void, @void, @value=r6, r9}, 0x20) write$cgroup_pid(r8, &(0x7f0000001080)=r4, 0x12) perf_event_open$cgroup(&(0x7f00000010c0)={0x2, 0x80, 0x81, 0x1, 0x3, 0xd, 0x0, 0x5, 0x80820, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0xeb4, 0x0, @perf_config_ext={0x5, 0x2}, 0x10, 0xca57, 0x3, 0x9, 0x0, 0x2, 0x4, 0x0, 0xfffff4c2, 0x0, 0x7ff}, r7, 0x5, r7, 0x1) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r8, 0x4008240b, &(0x7f0000001140)={0x4, 0x80, 0x4, 0x4, 0x1, 0x2f, 0x0, 0x9, 0x126, 0x2, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x3, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x2, 0x0, @perf_config_ext={0x3, 0x8}, 0x5802, 0xd6, 0xfffffffb, 0x1, 0x6edb00000000000, 0x5, 0xd20, 0x0, 0x973}) 2.092705574s ago: executing program 0 (id=21137): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x2, 0x3, 0x2) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000080000000200000000000000", @ANYRES32=r2], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8916, &(0x7f0000000000)={r2}) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8936, &(0x7f0000000000)={r2}) 2.072669965s ago: executing program 1 (id=21138): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r0, 0x0, 0x2, 0x0) openat$cgroup_freezer_state(r0, 0x0, 0x2, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3e, '\x00', 0x0, 0x2}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e0800000709000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b70400000000040085"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'\x00', 0x6132}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0xac63, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0xf, 0x2, 0xff, 0x0, 0x0, 0x2, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x5, 0xdf1d, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 2.010250847s ago: executing program 3 (id=21139): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)="d8000000100081046881f782db44b904021d080b01000000e8fe55a11800150006001400030011120800040043000000a8001600a400014020000600fef65cf07db3d1a4693dffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a9d7c7c097a196e6f66112c88ac417898516277ce06bbace80177ccbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d0080000000000000b57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c", 0xd8}], 0x1}, 0x0) 1.87515767s ago: executing program 0 (id=21141): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa88"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) r1 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x8901, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x40047438, 0x110c23003f) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200"], 0xcfa4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000080)=r1}, 0x20) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={0x0, 0x0, 0x4008, r0}, 0x18) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@base={0x14, 0x4, 0x8, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000200)={r5, &(0x7f0000000000), 0x0}, 0x20) r6 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000012000000000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r6}, 0x94) r7 = socket$kcm(0x2, 0x200000000000001, 0x0) sendmsg$inet(r7, &(0x7f0000000080)={&(0x7f0000000100)={0x2, 0x0, @dev}, 0x1, 0x0}, 0x30004081) socket$kcm(0x29, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000900)={r1, 0xe0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000580)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, &(0x7f00000005c0)=[0x0, 0x0, 0x0], &(0x7f00000006c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xaa, &(0x7f0000000700)=[{}, {}], 0x10, 0x10, &(0x7f0000000740), &(0x7f0000000780), 0x8, 0xa6, 0x8, 0x8, &(0x7f00000007c0)}}, 0x10) r9 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r9, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)}, 0x8c54) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340), 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r10}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0xbc}, [@ldst={0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x18000000}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b708000f000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r11, r10}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x19, 0x1c, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffa, 0x0, 0x0, 0x0, 0x1ff}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x8001}, @printk={@p, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x783d}}, @cb_func={0x18, 0x1}, @map_fd={0x18, 0x3, 0x1, 0x0, r4}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}]}, &(0x7f0000000400)='syzkaller\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @cgroup_sockopt=0x15, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r8, 0xffffffffffffffff, 0x3, &(0x7f00000009c0)=[0xffffffffffffffff, 0x1, 0x1], &(0x7f0000000a00)=[{0x5, 0x3, 0x8}, {0x0, 0x3, 0x10, 0x2}, {0x2, 0x4, 0xe, 0x2bbdd10dd6218d23}], 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040033, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x46a, 0x1, @perf_bp={0x0}, 0x81, 0x3, 0x0, 0x0, 0x1, 0x200}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 1.767200562s ago: executing program 3 (id=21142): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x2, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x10, 0x2, 0x4) r0 = socket$kcm(0xa, 0x1, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000080000000200000000000000", @ANYRES32=r1], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 1.766373962s ago: executing program 1 (id=21143): r0 = socket$kcm(0xa, 0x2, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xc2ba}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cgroup.controllers\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x4020940d, &(0x7f00000005c0)=0x80000000000004) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8916, &(0x7f00000000c0)={'veth0_to_batadv\x00', @random="0200c100d8f1"}) socket$kcm(0xa, 0x5, 0x0) socket$kcm(0xa, 0x5, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x0, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_config_ext, 0x10c002, 0x89}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="1700000014006ba9de280a5f768e7e001037310a0a876c", 0x17}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f00000001c0)={r6, r1}) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=[@cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}], 0x50}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_to_bond\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8946, &(0x7f0000000080)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1c, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x4e21, @rand_addr=0x64010101}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e068000000110000000000000029000000ad000000fc000000000000001400000000000000000000000200000004000000000000001c000000000000000000000008"], 0x68}, 0x1000) 1.694255094s ago: executing program 2 (id=21144): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000100)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x3b}]}, &(0x7f0000000200)='GPL\x00', 0x7, 0xa4, &(0x7f0000000000)=""/164, 0x0, 0x48000000}, 0x94) 1.693935423s ago: executing program 0 (id=21145): bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="180000000000d000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000000500000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0x12, 0x0, &(0x7f0000000080)="dc188619b95d02ff4284860188a86a4e0800", 0x0, 0x8001ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.568543876s ago: executing program 3 (id=21146): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x18, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1803000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b5020000000000008500000087000000bc0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x6, 0x1003, &(0x7f0000000880)=""/4099, 0x41000, 0x9}, 0x90) r1 = socket$kcm(0xa, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10d, 0xf, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x86bf2056334f3ae6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r2 = socket$kcm(0xa, 0x1, 0x0) socket$kcm(0x11, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffa}, 0x10c002, 0xac5d, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={0x0, 0x0}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110c230000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) sendmsg$kcm(r2, 0x0, 0x20000001) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@datasec={0x2, 0x1, 0x0, 0xf, 0x1, [{0x3, 0x101}], 'H'}, @datasec={0x0, 0x0, 0x0, 0xf, 0x3, [], "7472e9"}]}, {0x0, [0x0, 0x2e]}}, &(0x7f00000003c0)=""/4096, 0x44, 0x1000, 0x1}, 0x20) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0xa, 0x3, 0x3a) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002ec0), 0x48) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000100)="2e000000380005ffd25a80698c63940d0300fc602f0000000b000200001ec0003715de60cfd9a1af05d81d00d1bd", 0x2e}], 0x1, 0x0, 0x0, 0x39c}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xfe1b) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, 0x0, 0x44004) socket$kcm(0x10, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000440)="b8d3d8e48974aae5039847936746be1d81a34f9b68100dbf05177b2436f9d642df271fd6b9aa6701365ffc723899ad120c5a54b1f6fcf2fbb053e277a04d3f44e3f9bafec64080f64f103ee1de769e5e9dd8cbb68869a662eaad499c52a16f40cb3a1f6f3d5f8df14c53b2e6b5397f7806b6ff846de37a34c8342b9ac5a51eacf8a09cede8676044eafd3d79", 0x8c}], 0x1, 0x0, 0x0, 0x400c800}, 0x4000000) close(r7) 1.501262487s ago: executing program 2 (id=21147): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e22, @dev}}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000ac0)="f4", 0x1}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000000040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b57000000860f5878c37ffe36e1165814d435be5b317c6c8189587d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988ab013f40afe403041323110f62055394412158e7a3adb148d641aa40d4ab077fe34232aa8b31851466d0998a61d7da0c86d70000001010"], 0x10b8, 0xfffd}, 0xff00) 1.278489732s ago: executing program 2 (id=21148): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[], 0x50) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0xd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_subtree(r1, 0x0, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) write$cgroup_subtree(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, 0x0) r3 = socket$kcm(0x1e, 0x1, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff1100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x8, 0x4}, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x702, 0x36, 0x0, &(0x7f0000001080)="e460334470b8d480eb00c15286dd08d8829f5fb5e2eb3b56fddaa2b27da9d81c20bfde92a3cd98f29389530882794568195b29c77653", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$kcm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)="6700000011008188040f56ecdb4cb9cca7480ef435000000e3bd6efb440009000e002e0010000000ba80013ffa85f59a0000005a8c3774fa0af3dc59a933c1e6a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f", 0x67}], 0x1}, 0x24004004) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000000300000000000000730131fcffff3eef9f8e000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000}, 0x48) r6 = openat$cgroup_int(r1, &(0x7f00000001c0)='io.weight\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f00000002c0)=0x7, 0x12) 804.214803ms ago: executing program 0 (id=21149): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x2, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="611230000000000061134c0000000000bf2000000000000016000200071b48013c030000000000009500000000000000bc26000000000000bf67000000000000150200000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050800000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00'}, 0x48) (async) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110c230000) (async) ioctl$TUNSETOFFLOAD(r0, 0x40047451, 0xf0ff1f00000000) 759.122214ms ago: executing program 2 (id=21150): r0 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8916, &(0x7f0000000000)={'veth1_to_bridge\x00', @random="02000400ac14"}) socket$kcm(0x2c, 0x3, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000300000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xd, &(0x7f0000000380)=ANY=[@ANYBLOB="180000001700000000000000ff000000850000006d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000002007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008002010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x36, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000340)={r2}, 0xc) recvmsg(0xffffffffffffffff, 0x0, 0x0) socket$kcm(0x2c, 0x3, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000b000140020003600e41b0000900ac0000001101a80016000b00014002000000035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x40841, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$inet(0xffffffffffffffff, 0x0, 0x4000000) perf_event_open(&(0x7f0000000480)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0}, 0x0, 0x4, 0xee5b, 0x0, 0x0, 0x3}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x400042, 0x0) socket$kcm(0xa, 0x5, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000380), 0x6c0ec0, 0x0) socket$kcm(0x21, 0x2, 0x2) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0xa4, 0x589, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x1, 0x0, 0x4, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1204e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, @perf_config_ext, 0x10c002, 0x1, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)) socket$kcm(0x10, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x200002, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000004000000ff0f000005"], 0x48) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)) 706.994425ms ago: executing program 1 (id=21151): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x111002, 0x0) socket$kcm(0x2, 0x3, 0x2) r1 = socket$kcm(0xa, 0x1, 0x0) r2 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000080000000200000000000000", @ANYRES32=r2], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8916, &(0x7f0000000000)={r2}) socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8936, &(0x7f0000000000)={r2}) 664.750456ms ago: executing program 32 (id=21055): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$kcm(0xa, 0x5, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1d, 0x1, 0x0, 0x6, 0x0, 0x3, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x1, @perf_bp={0x0, 0x1}, 0x21, 0x4, 0x0, 0x4, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r0, 0x0, 0xfe33) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffd, 0x40000000}, 0x10c002, 0xac5d, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000a00)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6143, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x1, @perf_config_ext={0x8, 0x6}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x800}, 0x0, 0xffefffffffffffff, r1, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={0x0, &(0x7f0000000580)=""/229, 0x0, 0xe5, 0x1}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000006c0)={0x4, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x0, 0x1}, 0x48) socketpair(0x1, 0x1, 0x0, 0x0) r3 = socket$kcm(0x21, 0x2, 0x2) setsockopt$sock_attach_bpf(r3, 0x1, 0x7, &(0x7f0000000040), 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8946, &(0x7f0000000080)) syz_clone(0x40a00480, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r4) r6 = perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x20, 0x12506, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0x8000000000000001, 0x8}, 0x7602, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x27, 0x2, 0x0, 0x0, 0x0, 0x1, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xc}, 0x0, 0x0, 0x7ff, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0xf, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xbf21, 0x0, 0x0, 0x0, 0x3}, {}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x1, 0x0, 0x0, 0x41000}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) close(r6) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r7}, &(0x7f0000000080), &(0x7f0000000240)=r8}, 0x20) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r9, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 637.974397ms ago: executing program 3 (id=21153): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_freezer_state(r0, 0x0, 0x2, 0x0) openat$cgroup_freezer_state(r0, 0x0, 0x2, 0x0) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3e, '\x00', 0x0, 0x2}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e0800000709000000000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b70400000000040085"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r2) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20f42, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000140)={'\x00', 0x6132}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0xac63, 0x0, 0x0, 0x41100}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0xf, 0x2, 0xff, 0x0, 0x0, 0x2, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x5, 0xdf1d, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) 607.150518ms ago: executing program 0 (id=21154): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5931, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x202, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20010007}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x2, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x2, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x4}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0xa1}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 435.134631ms ago: executing program 1 (id=21155): sendmsg$inet(0xffffffffffffffff, &(0x7f0000002480)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x41, 0x0, 0x11}, 0x0) r0 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000002, 0x0, 0x0, 0x7}]}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180400850000005500"/25], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x64, &(0x7f0000000000)=r3, 0x10) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) r4 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0}, 0x40040d4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x0, 0x1}, 0x201, 0x0, 0xc2ba, 0x0, 0x4000000, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r8 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="5400020029000b05d25a806f8c6394f90424fc602f0011002e2f0100053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) setsockopt$sock_attach_bpf(r4, 0x84, 0x64, &(0x7f0000000000)=r7, 0x10) sendmsg$inet(r4, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0xb0, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) close(0x3) 319.216253ms ago: executing program 3 (id=21156): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x2, 0x3, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x3, 0x2) socket$kcm(0x10, 0x2, 0x4) r0 = socket$kcm(0xa, 0x1, 0x0) r1 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1000000004000000080000000200000000000000", @ANYRES32=r1], 0x50) ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x8916, &(0x7f0000000000)={r1}) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8936, &(0x7f0000000000)={r1}) 318.595884ms ago: executing program 2 (id=21157): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c000000ffffffff01"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) 45.94308ms ago: executing program 2 (id=21158): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, &(0x7f0000000080)=[0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x64, &(0x7f0000000100)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x2c, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000340)=r1) (async) ioctl$TUNSETIFINDEX(r0, 0x400454da, &(0x7f0000000340)=r1) socket$kcm(0x29, 0x5, 0x0) (async) r2 = socket$kcm(0x29, 0x5, 0x0) recvmsg$kcm(r2, &(0x7f00000018c0)={&(0x7f0000000380)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000001780)=[{&(0x7f0000000400)=""/154, 0x9a}, {&(0x7f00000004c0)=""/138, 0x8a}, {&(0x7f0000000580)=""/116, 0x74}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/43, 0x2b}, {&(0x7f0000001640)=""/155, 0x9b}, {&(0x7f0000001700)=""/90, 0x5a}], 0x7, &(0x7f0000001800)=""/132, 0x84}, 0x1) r3 = getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001940)={r3, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000001900)='/dev/net/tun\x00'}, 0x30) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001980)='./cgroup.net/syz0\x00', 0x200002, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f00000019c0), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001a00)={0xffffffffffffffff}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001e80)={0x18, 0x16, &(0x7f0000001bc0)=@raw=[@map_fd={0x18, 0x3, 0x1, 0x0, 0x1}, @alu={0x7, 0x1, 0xc, 0x0, 0x1, 0xffffffffffffffc0, 0xab2f5f28b5a5a1a9}, @map_fd={0x18, 0xa, 0x1, 0x0, r5}, @map_fd={0x18, 0x3, 0x1, 0x0, 0x1}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x10001}}, @exit, @map_idx={0x18, 0xb, 0x5, 0x0, 0xd}, @map_idx={0x18, 0x1, 0x5, 0x0, 0xf}, @map_val={0x18, 0x2, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}], &(0x7f0000001c80)='syzkaller\x00', 0x8, 0x83, &(0x7f0000001cc0)=""/131, 0x41000, 0x4, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001d80)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000001dc0)={0x4, 0x5, 0x4416, 0xa591}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000001e00)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000001e40)=[{0x0, 0x1, 0x0, 0x7}, {0x4, 0x1, 0x9}, {0x1, 0x3, 0xc, 0x6}, {0x3, 0x4, 0xe, 0x6}], 0x10, 0x3}, 0x94) (async) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001e80)={0x18, 0x16, &(0x7f0000001bc0)=@raw=[@map_fd={0x18, 0x3, 0x1, 0x0, 0x1}, @alu={0x7, 0x1, 0xc, 0x0, 0x1, 0xffffffffffffffc0, 0xab2f5f28b5a5a1a9}, @map_fd={0x18, 0xa, 0x1, 0x0, r5}, @map_fd={0x18, 0x3, 0x1, 0x0, 0x1}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x10001}}, @exit, @map_idx={0x18, 0xb, 0x5, 0x0, 0xd}, @map_idx={0x18, 0x1, 0x5, 0x0, 0xf}, @map_val={0x18, 0x2, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}], &(0x7f0000001c80)='syzkaller\x00', 0x8, 0x83, &(0x7f0000001cc0)=""/131, 0x41000, 0x4, '\x00', 0x0, 0x0, r4, 0x8, &(0x7f0000001d80)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000001dc0)={0x4, 0x5, 0x4416, 0xa591}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000001e00)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000001e40)=[{0x0, 0x1, 0x0, 0x7}, {0x4, 0x1, 0x9}, {0x1, 0x3, 0xc, 0x6}, {0x3, 0x4, 0xe, 0x6}], 0x10, 0x3}, 0x94) r8 = ioctl$TUNGETDEVNETNS(r0, 0x54e3, 0x0) sendmsg$unix(r6, &(0x7f0000001f80)={&(0x7f0000001a40)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001b80)=[{&(0x7f0000001ac0)="88ac267de653aeed3499f2b4502f1ae8a64234d663820517e7aa61e9d4eb8dfd3ccd8304021dab4ccdc22b9477430f822163cf93cb6eebf23c6261772556223b0cda2ca57f61d23db32ce8b86f5324d53ad45251f9cae3256a3d95a29155c23f9fd4cb1cba694a5b7f910d9599c6ce874666fb8526da41bb9efcd5a9020bdf43fe22178a3019b30a720a1ca6ae81caa090790d4190d628b996dd91d82838eedeef19a2417c", 0xa5}], 0x1, &(0x7f0000001f40)=[@rights={{0x24, 0x1, 0x1, [r4, r7, r0, r8, r2]}}], 0x28, 0x40}, 0x4811) (async) sendmsg$unix(r6, &(0x7f0000001f80)={&(0x7f0000001a40)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000001b80)=[{&(0x7f0000001ac0)="88ac267de653aeed3499f2b4502f1ae8a64234d663820517e7aa61e9d4eb8dfd3ccd8304021dab4ccdc22b9477430f822163cf93cb6eebf23c6261772556223b0cda2ca57f61d23db32ce8b86f5324d53ad45251f9cae3256a3d95a29155c23f9fd4cb1cba694a5b7f910d9599c6ce874666fb8526da41bb9efcd5a9020bdf43fe22178a3019b30a720a1ca6ae81caa090790d4190d628b996dd91d82838eedeef19a2417c", 0xa5}], 0x1, &(0x7f0000001f40)=[@rights={{0x24, 0x1, 0x1, [r4, r7, r0, r8, r2]}}], 0x28, 0x40}, 0x4811) openat$cgroup_netprio_ifpriomap(r4, &(0x7f0000001fc0), 0x2, 0x0) (async) r9 = openat$cgroup_netprio_ifpriomap(r4, &(0x7f0000001fc0), 0x2, 0x0) write$cgroup_netprio_ifpriomap(r9, &(0x7f0000002000)={'veth1_to_team', 0x32, 0x39}, 0x10) mkdirat$cgroup(r4, &(0x7f0000002040)='syz0\x00', 0x1ff) (async) mkdirat$cgroup(r4, &(0x7f0000002040)='syz0\x00', 0x1ff) mkdirat$cgroup(r4, &(0x7f0000002080)='syz1\x00', 0x1ff) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f00000020c0)={'syzkaller1\x00'}) ioctl$TUNSETDEBUG(r0, 0x400454c9, &(0x7f0000002100)=0x8d) (async) ioctl$TUNSETDEBUG(r0, 0x400454c9, &(0x7f0000002100)=0x8d) perf_event_open(&(0x7f0000002180)={0x1, 0x80, 0x71, 0xa, 0x3, 0x77, 0x0, 0x5, 0x1000, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x4, 0x7, @perf_bp={&(0x7f0000002140), 0x5}, 0x10400, 0x3, 0x10000, 0x4, 0xc4, 0xfffffff9, 0x2, 0x0, 0x1, 0x0, 0x8000}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x0) (async) r10 = perf_event_open(&(0x7f0000002180)={0x1, 0x80, 0x71, 0xa, 0x3, 0x77, 0x0, 0x5, 0x1000, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x4, 0x7, @perf_bp={&(0x7f0000002140), 0x5}, 0x10400, 0x3, 0x10000, 0x4, 0xc4, 0xfffffff9, 0x2, 0x0, 0x1, 0x0, 0x8000}, 0xffffffffffffffff, 0x8, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000002240)={r3, r10, 0x0, 0x13, &(0x7f0000002200)='net_prio.ifpriomap\x00'}, 0x30) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002280)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xcf, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x5}, 0x50) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000002300)=@base={0x1d, 0x1ff, 0x4, 0x3, 0x0, r11, 0xe, '\x00', r1, 0xffffffffffffffff, 0x0, 0x1}, 0x50) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000002380)='syz1\x00', 0x1ff) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000002600)={r12, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002680)={0x11, 0x28, &(0x7f00000023c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xffffff7c, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}, @printk={@lx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @jmp={0x5, 0x1, 0x2, 0x2, 0x1, 0xfffffffffffffff8, 0x10}, @jmp={0x5, 0x0, 0x4, 0x6, 0x9, 0x0, 0x1}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r10}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @jmp={0x5, 0x0, 0x1, 0x7, 0x9, 0x2}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x5}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x9df}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000002500)='GPL\x00', 0xc9ba, 0x4a, &(0x7f0000002540)=""/74, 0x40f00, 0x4a, '\x00', r1, 0x0, 0xffffffffffffffff, 0x8, &(0x7f00000025c0)={0xa, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002640)=[r11, r11, r12, r8, r13, r12, r11, r11, 0xffffffffffffffff, r12], 0x0, 0x10, 0x7ff}, 0x94) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002740)={0x3, 0x4, 0x4, 0xa, 0x0, r12, 0x7, '\x00', r1, r4, 0x4, 0x5, 0x5}, 0x50) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002740)={0x3, 0x4, 0x4, 0xa, 0x0, r12, 0x7, '\x00', r1, r4, 0x4, 0x5, 0x5}, 0x50) write$cgroup_subtree(r5, &(0x7f00000027c0)={[{0x2b, 'cpuacct'}, {0x2b, 'perf_event'}, {0x2b, 'net_cls'}, {0x0, 'rlimit'}, {0x2b, 'blkio'}, {0x2d, 'pids'}, {0x2d, 'rlimit'}, {0x2d, 'rdma'}, {0x2b, 'cpuacct'}]}, 0x4a) sendmsg$kcm(r2, &(0x7f0000003140)={&(0x7f0000002840)=@ieee802154={0x24, @none={0x0, 0xffff}}, 0x80, &(0x7f0000002f00)=[{&(0x7f00000028c0)="d2c9ba373023dbfc4fab567098e7a2dba6ad634f5be25b7bb2d75eda3719445f1ac678b3cb47a8931af7bdf05bd1cb2b4d65d08c32a0883b23429d478dabf6b8812f2c", 0x43}, {&(0x7f0000002940)="e386a66b205e236ba2fccd3fa782a25bde7f3f81025271e4ffdbe86cca35126a9ef7806b5a1a79896c48385389d86c84abc8ad24c1daf2d1e3971e70d0a70ece883d8edbdb7232e6c45e90685d7bf85535aebc9200b1958430d773da9dea3f26f5580952a1d8329d8c88661341544d5f557f0f1ff5b54fd492e3786c0b5e726e82", 0x81}, {&(0x7f0000002a00)="55ff61323df801cb4e24ec3c0d875763ad8fe20e79f625bb238b44ac483917b032207dce93b63236f2e304bc284702cc30dbfe878657d5fbcc90899e26e23e8728780867a50e345cd7f07be265fba25f31bf003caf2cfe5f96ecfd25c7fc7fa3043137adf1c321e27c663a7e83132725ee46030fa51db043de49c57e747ff8cdce8360081752475408561b6f4979ba3279c5ce48de33ad5a7d921645a566a51541fd4043e686c73f0368feb7d003a75c9fd0d558e569e4d5312ee3a4902d2cc9786d56a5095e0bdddcde0d48241463aed1b9e88d9cd459148063d797aabbf22d744bbc756da89982a465689e41c19023f9d69eda32", 0xf5}, {&(0x7f0000002b00)="d3a2bb327af2171d730e39936474588c663425e01237eb9624", 0x19}, {&(0x7f0000002b40)="a3d146f799c97f3ae82d970a1d15a331df38e50aed86fe6337b7c0144c1b2d6cdfbdebb18fcbde3e3b42557e54d56854a50118826e2b06dceb9e444be7ce36b1e7e19d1917540bf53883b4bda3ec76099c0ed3786c03118c010ab8ecf9c10594b7bbcd91670c13d66a55a1d9e6e0f64d891e3c612f101ba50f68cdd388f73bcc4ce91c018c3879f66c982410a212ac702484e010aad87472c1583d03ef781784a2004c3ff2ceb0a64bebfa644cfba1a18333ceb56264ce6cdfb370c91105194d5d8b8e38c33b", 0xc6}, {&(0x7f0000002c40)="cb7f840df5258b896913019623bfb616ea3df480e630bc51551464b7b7d00796c12deb3d735f0a226b1e1bf2402667fa2816d8f766e01d2a82e429337502ae1da013c60956c8cb253439a472911fb4e8a5c098bbb399d309531282f42cadf4bb400a62ed7fb9baf546d02d05dc2a34be4a614a34a4a9fa381d6e24e1e09a89909b93994a490073a9e9adeb3d0391187c90e6624d85fbf000c1caf703b1b05ac618bbea0c7690984beaf1c0746cc93c1d6d21d2b5e4687da55f1908f1b9ae41874df0f54c915fe1da8045f3f2071a", 0xce}, {&(0x7f0000002d40)="f855d0a24f5b9d23e476fda7fe3b", 0xe}, {&(0x7f0000002d80)="423527250948c3e3c9a62d4c33ba7211e9aa500a47be3476acff27e243ebd7803e4c710d309fa4df968fdfaba96989fef849db3e03be37c49193ad69641dbbff7ff2c1291643189417ccb66ea00a3d1dccbc13cb45730740504ad6e4b79527f28f464e0ce97b365fc00740bd27c2814fe480f2e3659f7e49ba084a28ca70dad334e37829067ba3d5b7e85dcbeeb64c6403388b59eb85875fa4d0c10fa526d567d5596e370e6f90aad45807c0acc17b32b77b510fa445f0e046b5bc3d7945149a0477f0b7db28e5cbb77d0214e711862d08063ae36f55369b808c53aa047e73ec76a71e390d7ebde18734f89599dfcc99d8c4824246c277995d48fd", 0xfb}, {&(0x7f0000002e80)="a6cc9b4246aceb6a709b507a0e33ff46262df4033abbddc416554bd6ba03b7895b4cf8c9a19e9365fb96a5bc1acdf1abb8aa0936883d5919bba66bce08d618428e99a00af64c62879e486e69081f2abc5bbeeff70946cb178f5787e67d5cb98c04a2", 0x62}], 0x9, &(0x7f0000002fc0)=[{0xd8, 0x11, 0x8, "6b05f103945f9b6975096f23fc67318cf341055cdaa57d6dceb27fdfdec7003fb4aece531b14347a5c90078d6eb86462b0e337a17697967c57a3a352e5f6290ace3dae5e3c398b619054b9dd495bb5de4dd4423c0e441c34d87e9452d8d571261f05ac55b810c4c02e3b68c0e32af6d0281be91a87bff4d9b52664a15db787694edfbe201a5119722bece2c367cf8225357265e321c4f6ec307063d761d91579e3480919213d37acac34689f022a68f91802113a6b94d206c8b5d6cab79ff62124ab2d"}, {0x70, 0x103, 0x7, "6a5c553f9caef79a956918da5faf9973e9e8c9263ae36a435a51e9866b15451568448d6cb89df4161d138e8ffb59fdb432b0172c9dee4cbbd1a57383efedbbca985d2e9bec433e75a18f3b0e54a0fe02a8109a16f13a4f3818a83ca49244"}], 0x148}, 0x80) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000003180)=""/9) 45.63734ms ago: executing program 0 (id=21159): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f00000003c0)={&(0x7f00000010c0)=@in6={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5}, 0x80, 0x0}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r1, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f92a24fc60", 0x14}], 0x3}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500"], 0x0}, 0x94) write$cgroup_netprio_ifpriomap(0xffffffffffffffff, 0x0, 0x9) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) r4 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r4, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000b80)="3e0000003a000511d25a80698c63940d0124fc602f6e35400c000200001ec00037153e370a000180dc861d3e000000000000006ccdfb0a8259104247f3d8", 0x3e}], 0x1, 0x0, 0x0, 0x39c}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r5}, &(0x7f0000000340), 0x0}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000bc0)={0xc, 0x10, &(0x7f0000000e40)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b704000008000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r6, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="61df712bc884fed5722780b605a7", 0x0, 0x2f00, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0xffffffffffffffe8) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x3, 0x0, 0x0) recvmsg$kcm(r2, &(0x7f0000001580)={0x0, 0x0, 0x0}, 0x0) 0s ago: executing program 3 (id=21160): r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d0e, 0x80218, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x1, 0x7}, 0x2005, 0x0, 0x51, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x4, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[], 0x50) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0xd) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_subtree(r1, 0x0, 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000080)={[{0x2b, 'cpu'}]}, 0x5) write$cgroup_subtree(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b34, 0x0) r3 = socket$kcm(0x1e, 0x1, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff1100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x57) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_config_ext={0x8, 0x4}, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x702, 0x36, 0x0, &(0x7f0000001080)="e460334470b8d480eb00c15286dd08d8829f5fb5e2eb3b56fddaa2b27da9d81c20bfde92a3cd98f29389530882794568195b29c77653", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$kcm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000004c0)}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001840)=[{&(0x7f0000000040)="6700000011008188040f56ecdb4cb9cca7480ef435000000e3bd6efb440009000e002e0010000000ba80013ffa85f59a0000005a8c3774fa0af3dc59a933c1e6a6d3361d83b20000319cdf5656826edaaa11032701c61ec666d482078ccebcb9a4f187f7a4e98f", 0x67}], 0x1}, 0x24004004) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000000300000000000000730131fcffff3eef9f8e000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000}, 0x48) r6 = openat$cgroup_int(r1, &(0x7f00000001c0)='io.weight\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f00000002c0)=0x7, 0x12) kernel console output (not intermixed with test programs): 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2539.229873][T28182] RSP: 002b:00007ff6cabad028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2539.238287][T28182] RAX: ffffffffffffffda RBX: 00007ff6ca025fa0 RCX: 00007ff6c9d9de99 [ 2539.246689][T28182] RDX: 0000000000000810 RSI: 0000200000000040 RDI: 0000000000000003 [ 2539.254687][T28182] RBP: 00007ff6cabad090 R08: 0000000000000000 R09: 0000000000000000 [ 2539.262658][T28182] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2539.270718][T28182] R13: 00007ff6ca026038 R14: 00007ff6ca025fa0 R15: 00007fff7a0d4d98 [ 2539.278740][T28182] [ 2539.326919][T28182] memory allocation failure, unreliable refcount tracker. [ 2539.808214][T28197] netlink: 'syz.0.19159': attribute type 4 has an invalid length. [ 2539.816101][T28197] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.19159'. [ 2539.947079][T28205] netlink: 152 bytes leftover after parsing attributes in process `syz.3.19164'. [ 2539.990408][T28209] netlink: 128 bytes leftover after parsing attributes in process `syz.2.19167'. [ 2540.009832][T28209] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2540.052190][T28209] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2540.975972][T28230] netlink: 'syz.4.19171': attribute type 1 has an invalid length. [ 2541.031495][T28230] netlink: 4 bytes leftover after parsing attributes in process `syz.4.19171'. [ 2541.685680][ T4272] Bluetooth: hci3: ISO packet for unknown connection handle 528 [ 2542.987542][T28295] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.19194'. [ 2543.588455][T28307] delete_channel: no stack [ 2544.235626][T28323] netlink: 'syz.3.19205': attribute type 16 has an invalid length. [ 2544.257278][T28323] netlink: 152 bytes leftover after parsing attributes in process `syz.3.19205'. [ 2544.277351][T28323] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2544.579886][T28333] netlink: 128 bytes leftover after parsing attributes in process `syz.3.19209'. [ 2544.606950][T28333] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2544.640238][T28333] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2545.518631][T28354] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.19212'. [ 2545.758502][T28354] bridge_slave_1: default FDB implementation only supports local addresses [ 2546.479343][T28384] netlink: 202920 bytes leftover after parsing attributes in process `syz.2.19223'. [ 2546.496852][ T4272] Bluetooth: hci1: command 0x0406 tx timeout [ 2551.497567][T28452] delete_channel: no stack [ 2551.704221][T28461] netlink: 'syz.4.19244': attribute type 10 has an invalid length. [ 2552.381652][T28479] netlink: 14 bytes leftover after parsing attributes in process `syz.3.19252'. [ 2552.604097][T28479] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2552.724478][T28479] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 2552.807356][T28479] bond0 (unregistering): Released all slaves [ 2553.220482][T28506] netlink: 'syz.3.19258': attribute type 10 has an invalid length. [ 2553.873910][T28527] netlink: 128 bytes leftover after parsing attributes in process `syz.0.19267'. [ 2553.883452][T28527] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2553.912775][T28527] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2553.951451][T28528] syzkaller0: tun_chr_ioctl cmd 1074033753 [ 2554.143401][T28535] netlink: 14 bytes leftover after parsing attributes in process `syz.0.19270'. [ 2554.201294][T28535] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2554.225286][T28535] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2554.244266][T28535] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 2554.254968][T28535] bond0 (unregistering): Released all slaves [ 2554.269577][T28539] bond0: (slave netdevsim0): Error: Slave device does not support XDP [ 2554.288386][T28541] netlink: 'syz.1.19271': attribute type 10 has an invalid length. [ 2555.658262][T28567] netlink: 'syz.3.19280': attribute type 4 has an invalid length. [ 2555.677068][T28567] netlink: 'syz.3.19280': attribute type 8 has an invalid length. [ 2555.685466][T28567] netlink: 109560 bytes leftover after parsing attributes in process `syz.3.19280'. [ 2555.805717][T28570] netlink: 'syz.3.19280': attribute type 10 has an invalid length. [ 2557.901314][T28648] netlink: 'syz.0.19311': attribute type 15 has an invalid length. [ 2557.915796][T28648] netlink: 'syz.0.19311': attribute type 7 has an invalid length. [ 2557.929730][T28648] netlink: 52 bytes leftover after parsing attributes in process `syz.0.19311'. [ 2560.522580][T28724] FAULT_INJECTION: forcing a failure. [ 2560.522580][T28724] name failslab, interval 1, probability 0, space 0, times 0 [ 2560.535696][T28724] CPU: 0 PID: 28724 Comm: syz.0.19329 Not tainted syzkaller #0 [ 2560.543631][T28724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2560.553739][T28724] Call Trace: [ 2560.557193][T28724] [ 2560.560161][T28724] dump_stack_lvl+0x188/0x24e [ 2560.564891][T28724] ? show_regs_print_info+0x12/0x12 [ 2560.570136][T28724] ? load_image+0x410/0x410 [ 2560.574672][T28724] ? verify_lock_unused+0x140/0x140 [ 2560.579964][T28724] ? verify_lock_unused+0x140/0x140 [ 2560.585413][T28724] should_fail_ex+0x390/0x4c0 [ 2560.590196][T28724] should_failslab+0x5/0x20 [ 2560.594746][T28724] slab_pre_alloc_hook+0x59/0x300 [ 2560.599802][T28724] ? ref_tracker_alloc+0x14f/0x490 [ 2560.604956][T28724] __kmem_cache_alloc_node+0x4f/0x270 [ 2560.610391][T28724] ? ref_tracker_alloc+0x14f/0x490 [ 2560.615550][T28724] kmalloc_trace+0x26/0xe0 [ 2560.620010][T28724] ref_tracker_alloc+0x14f/0x490 [ 2560.624993][T28724] ? ref_tracker_dir_print+0x150/0x150 [ 2560.630481][T28724] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 2560.636589][T28724] ? _raw_spin_lock_irqsave+0x8b/0x100 [ 2560.642085][T28724] ? _raw_spin_lock_irqsave+0x8b/0x100 [ 2560.647580][T28724] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 2560.653071][T28724] ? _raw_spin_lock+0x40/0x40 [ 2560.657857][T28724] ? linkwatch_urgent_event+0x5f/0x3c0 [ 2560.663360][T28724] linkwatch_fire_event+0x1a4/0x200 [ 2560.668597][T28724] __tun_detach+0xd31/0x1590 [ 2560.673300][T28724] tun_chr_close+0x109/0x1b0 [ 2560.677927][T28724] ? tun_chr_open+0x4d0/0x4d0 [ 2560.682653][T28724] __fput+0x20a/0x8b0 [ 2560.686636][T28724] task_work_run+0x1d0/0x260 [ 2560.691373][T28724] ? task_work_cancel+0x220/0x220 [ 2560.696608][T28724] ? exit_to_user_mode_loop+0x3b/0x110 [ 2560.702085][T28724] exit_to_user_mode_loop+0xe6/0x110 [ 2560.707383][T28724] exit_to_user_mode_prepare+0xee/0x180 [ 2560.712983][T28724] syscall_exit_to_user_mode+0x16/0x40 [ 2560.718454][T28724] do_syscall_64+0x58/0xa0 [ 2560.722891][T28724] ? clear_bhb_loop+0x60/0xb0 [ 2560.727664][T28724] ? clear_bhb_loop+0x60/0xb0 [ 2560.732858][T28724] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2560.738846][T28724] RIP: 0033:0x7ff6c9d9de99 [ 2560.743359][T28724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2560.762980][T28724] RSP: 002b:00007ff6cabad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2560.771487][T28724] RAX: 0000000000000000 RBX: 00007ff6ca025fa0 RCX: 00007ff6c9d9de99 [ 2560.779556][T28724] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 [ 2560.787551][T28724] RBP: 00007ff6cabad090 R08: 0000000000000000 R09: 0000000000000000 [ 2560.795571][T28724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2560.803548][T28724] R13: 00007ff6ca026038 R14: 00007ff6ca025fa0 R15: 00007fff7a0d4d98 [ 2560.811533][T28724] [ 2561.269803][T28750] netlink: 'syz.4.19340': attribute type 46 has an invalid length. [ 2561.338462][T28750] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19340'. [ 2561.438693][T28756] netlink: 'syz.2.19345': attribute type 41 has an invalid length. [ 2561.650120][T28764] netlink: 14463 bytes leftover after parsing attributes in process `syz.2.19345'. [ 2562.854384][T28765] netlink: 128 bytes leftover after parsing attributes in process `syz.1.19347'. [ 2562.870310][T28765] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2562.907286][T28765] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2563.223951][T28790] netlink: 15231 bytes leftover after parsing attributes in process `syz.1.19352'. [ 2563.720408][T28808] netlink: 'syz.0.19358': attribute type 46 has an invalid length. [ 2563.782447][T28808] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19358'. [ 2565.006668][T28852] netlink: 'syz.3.19374': attribute type 46 has an invalid length. [ 2565.046865][T28852] netlink: 55 bytes leftover after parsing attributes in process `syz.3.19374'. [ 2567.066526][T28899] netlink: 'syz.4.19387': attribute type 46 has an invalid length. [ 2567.102862][T28899] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19387'. [ 2567.560209][T28906] netlink: 'syz.0.19390': attribute type 10 has an invalid length. [ 2567.608765][T28906] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19390'. [ 2568.771630][T28940] netlink: 'syz.1.19403': attribute type 46 has an invalid length. [ 2568.826982][T28940] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19403'. [ 2569.023214][T28950] sock: sock_set_timeout: `syz.1.19409' (pid 28950) tries to set negative timeout [ 2569.260191][T28958] bond0: (slave netdevsim0): Error: Slave device does not support XDP [ 2569.288205][T28958] netlink: 'syz.1.19412': attribute type 10 has an invalid length. [ 2569.315117][T28956] netlink: 'syz.3.19411': attribute type 2 has an invalid length. [ 2569.343989][T28956] netlink: 'syz.3.19411': attribute type 8 has an invalid length. [ 2569.364308][T28956] netlink: 132 bytes leftover after parsing attributes in process `syz.3.19411'. [ 2570.459974][T28988] netlink: 'syz.2.19421': attribute type 46 has an invalid length. [ 2570.524763][T28988] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19421'. [ 2571.202253][T29013] netlink: 128 bytes leftover after parsing attributes in process `syz.1.19431'. [ 2571.231219][T29013] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2571.281370][T29013] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2571.713710][T29029] netlink: 'syz.2.19438': attribute type 10 has an invalid length. [ 2571.734933][T29029] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19438'. [ 2573.078451][T29056] netlink: 'syz.4.19445': attribute type 10 has an invalid length. [ 2573.112299][T29056] netlink: 40 bytes leftover after parsing attributes in process `syz.4.19445'. [ 2573.154937][T29056] bridge0: port 3(veth0_vlan) entered blocking state [ 2573.203817][T29056] bridge0: port 3(veth0_vlan) entered disabled state [ 2573.259717][T29056] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 2573.559113][T29067] netlink: 'syz.4.19449': attribute type 2 has an invalid length. [ 2573.575118][T29067] netlink: 'syz.4.19449': attribute type 8 has an invalid length. [ 2573.596201][T29067] netlink: 132 bytes leftover after parsing attributes in process `syz.4.19449'. [ 2573.622675][T29071] netlink: 'syz.0.19450': attribute type 2 has an invalid length. [ 2573.647342][T29071] netlink: 132 bytes leftover after parsing attributes in process `syz.0.19450'. [ 2574.667608][T29082] validate_nla: 1 callbacks suppressed [ 2574.667643][T29082] netlink: 'syz.1.19455': attribute type 10 has an invalid length. [ 2574.687441][T29082] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19455'. [ 2575.377655][T29097] netlink: 'syz.0.19460': attribute type 10 has an invalid length. [ 2575.731468][T29111] netlink: 44 bytes leftover after parsing attributes in process `syz.1.19464'. [ 2576.310826][T29135] netlink: 'syz.2.19470': attribute type 46 has an invalid length. [ 2576.335353][T29135] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19470'. [ 2576.695149][T29147] netlink: 128 bytes leftover after parsing attributes in process `syz.4.19475'. [ 2576.705923][T29147] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2576.721131][T29147] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2576.818162][T29151] netlink: 'syz.4.19477': attribute type 1 has an invalid length. [ 2576.832519][T29151] netlink: 'syz.4.19477': attribute type 4 has an invalid length. [ 2576.850674][T29151] netlink: 7030 bytes leftover after parsing attributes in process `syz.4.19477'. [ 2577.417871][T29171] netlink: 'syz.2.19482': attribute type 46 has an invalid length. [ 2577.425843][T29171] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19482'. [ 2577.590223][T29178] netlink: 'syz.3.19485': attribute type 10 has an invalid length. [ 2577.648626][T29182] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.19486'. [ 2578.380638][T29211] netlink: 'syz.2.19496': attribute type 2 has an invalid length. [ 2578.394084][T29211] netlink: 'syz.2.19496': attribute type 8 has an invalid length. [ 2578.402120][T29211] netlink: 132 bytes leftover after parsing attributes in process `syz.2.19496'. [ 2578.464077][T29214] netlink: 'syz.1.19498': attribute type 3 has an invalid length. [ 2578.491646][T29214] netlink: 197344 bytes leftover after parsing attributes in process `syz.1.19498'. [ 2578.532230][T29214] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.19498'. [ 2580.309133][T29263] netlink: 122896 bytes leftover after parsing attributes in process `syz.4.19511'. [ 2580.348536][T29263] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 2581.472433][T29299] validate_nla: 2 callbacks suppressed [ 2581.472469][T29299] netlink: 'syz.3.19527': attribute type 10 has an invalid length. [ 2581.556781][T29299] bridge0: port 3(team0) entered disabled state [ 2581.615418][T29299] bridge0: port 3(team0) entered disabled state [ 2581.641754][T29299] device team_slave_0 left promiscuous mode [ 2581.722070][T29299] team0 (unregistering): Port device team_slave_0 removed [ 2581.732018][T29299] device team_slave_1 left promiscuous mode [ 2581.786163][T29299] team0 (unregistering): Port device team_slave_1 removed [ 2581.795703][T29299] device geneve1 left promiscuous mode [ 2581.810463][T29299] team0 (unregistering): Port device geneve1 removed [ 2581.905181][T29312] netlink: 122896 bytes leftover after parsing attributes in process `syz.0.19530'. [ 2581.950973][T29312] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 2583.125898][T29369] netlink: 122896 bytes leftover after parsing attributes in process `syz.2.19551'. [ 2583.243056][T29369] debugfs: Directory '!!!' with parent 'ieee80211' already present! [ 2584.095526][ T4272] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2584.113523][ T4272] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2584.122985][ T4272] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2584.132958][ T4272] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2584.162614][ T4272] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 2584.170266][ T4272] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2584.377673][T19849] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2584.655303][T19849] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2584.808750][T19849] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2584.852406][T29422] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.19570'. [ 2584.965780][T19849] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2585.284509][T29397] chnl_net:caif_netlink_parms(): no params data found [ 2585.822867][T29397] bridge0: port 1(bridge_slave_0) entered blocking state [ 2585.830170][T29397] bridge0: port 1(bridge_slave_0) entered disabled state [ 2585.843819][T29397] device bridge_slave_0 entered promiscuous mode [ 2585.852638][T29397] bridge0: port 2(bridge_slave_1) entered blocking state [ 2585.860283][T29397] bridge0: port 2(bridge_slave_1) entered disabled state [ 2585.868520][T29397] device bridge_slave_1 entered promiscuous mode [ 2585.957632][T29460] netlink: 194236 bytes leftover after parsing attributes in process `syz.4.19575'. [ 2586.066224][T29460] netlink: zone id is out of range [ 2586.161261][T29460] netlink: get zone limit has 8 unknown bytes [ 2586.191993][T29397] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2586.257275][ T4272] Bluetooth: hci4: command 0x0409 tx timeout [ 2586.486709][T29397] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2586.923922][T29397] team0: Port device team_slave_0 added [ 2586.945724][T29397] team0: Port device team_slave_1 added [ 2587.129398][T29397] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2587.146983][T29397] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2587.216333][T29397] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2587.334456][T29397] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2587.357345][T29397] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2587.394322][T29397] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2587.462556][T29397] device hsr_slave_0 entered promiscuous mode [ 2587.470178][T29397] device hsr_slave_1 entered promiscuous mode [ 2587.489340][T29397] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2587.498942][T29397] Cannot create hsr debugfs directory [ 2588.337177][ T4272] Bluetooth: hci4: command 0x041b tx timeout [ 2588.573633][T19849] device hsr_slave_0 left promiscuous mode [ 2588.596326][T19849] device hsr_slave_1 left promiscuous mode [ 2588.622060][T19849] device bridge_slave_1 left promiscuous mode [ 2588.649857][T19849] bridge0: port 2(bridge_slave_1) entered disabled state [ 2588.676591][T19849] device bridge_slave_0 left promiscuous mode [ 2588.700836][T19849] bridge0: port 1(bridge_slave_0) entered disabled state [ 2588.781180][T19849] device veth1_vlan left promiscuous mode [ 2588.790632][T19849] device veth0_vlan left promiscuous mode [ 2589.838877][T29541] netlink: 'syz.2.19597': attribute type 3 has an invalid length. [ 2589.877044][T29541] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.19597'. [ 2590.424693][ T4272] Bluetooth: hci4: command 0x040f tx timeout [ 2590.499991][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 2590.506392][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 2592.497120][ T4272] Bluetooth: hci4: command 0x0419 tx timeout [ 2592.999769][T29539] netlink: 'syz.4.19596': attribute type 10 has an invalid length. [ 2593.082405][T29539] team0 (unregistering): Port device team_slave_0 removed [ 2593.108659][T29539] team0 (unregistering): Port device team_slave_1 removed [ 2593.127993][T29549] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.19598'. [ 2596.514517][T29397] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2596.572973][T29397] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2596.629805][T29397] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2596.689976][T29397] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2597.041532][T29617] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.19610'. [ 2597.114656][T29397] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2597.168865][T29621] netlink: 128 bytes leftover after parsing attributes in process `syz.0.19611'. [ 2597.182858][T29621] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2597.200864][T29621] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2597.242043][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 2597.284288][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2597.324419][T29397] 8021q: adding VLAN 0 to HW filter on device team0 [ 2597.360787][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 2597.388004][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2597.440510][T19847] bridge0: port 1(bridge_slave_0) entered blocking state [ 2597.447738][T19847] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2597.500630][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 2597.531594][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 2597.567697][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2597.596701][T19813] bridge0: port 2(bridge_slave_1) entered blocking state [ 2597.603909][T19813] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2597.657051][ T4153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 2597.701754][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 2597.721014][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 2597.743250][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2597.772905][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 2597.802921][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2597.864394][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2597.897633][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 2597.927690][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2597.961296][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 2597.977696][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2597.988495][T29397] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2598.640990][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 2598.662576][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2598.721123][T29397] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2598.756467][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 2598.780016][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 2598.843548][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 2598.853641][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 2598.880082][T29397] device veth0_vlan entered promiscuous mode [ 2598.888235][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 2598.907347][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 2598.924382][T29397] device veth1_vlan entered promiscuous mode [ 2598.995858][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 2599.014845][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 2599.051074][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 2599.082815][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 2599.111668][T29397] device veth0_macvtap entered promiscuous mode [ 2599.132040][T29397] device veth1_macvtap entered promiscuous mode [ 2599.158551][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2599.182703][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.203424][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2599.214466][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.263663][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2599.276535][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.302971][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2599.319701][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.334855][T29397] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2599.391043][T29672] netlink: 'syz.1.19623': attribute type 46 has an invalid length. [ 2599.414491][T29672] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19623'. [ 2599.424211][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 2599.433014][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 2599.442423][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 2599.451929][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 2599.467799][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2599.480961][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.491833][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2599.502865][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.513455][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2599.531740][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.544302][T29397] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2599.560135][T29397] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2599.575312][T29397] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2599.591815][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 2599.605184][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 2599.622628][T29397] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2599.652431][T29397] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2599.675353][T29397] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2599.685545][T29397] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2599.837449][ T4145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2599.874751][ T4145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2599.904206][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 2599.931020][T19849] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2599.946510][T19849] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2599.963807][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 2600.658522][T29682] delete_channel: no stack [ 2601.311124][T29715] netlink: 'syz.2.19636': attribute type 46 has an invalid length. [ 2601.350706][T29715] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19636'. [ 2602.060171][T29738] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.19641'. [ 2603.814585][T29779] netlink: 'syz.0.19649': attribute type 46 has an invalid length. [ 2603.863656][T29779] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19649'. [ 2604.367116][T29793] netlink: 'syz.1.19653': attribute type 10 has an invalid length. [ 2606.000397][T29838] netlink: 'syz.0.19664': attribute type 46 has an invalid length. [ 2606.078174][T29838] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19664'. [ 2607.346157][T29876] netlink: 'syz.2.19673': attribute type 10 has an invalid length. [ 2607.912008][T29897] netlink: 'syz.1.19679': attribute type 46 has an invalid length. [ 2607.932596][T29897] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19679'. [ 2609.707649][T29957] netlink: 'syz.0.19698': attribute type 46 has an invalid length. [ 2609.736269][T29957] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19698'. [ 2610.928176][T30009] netlink: 'syz.4.19714': attribute type 46 has an invalid length. [ 2610.974584][T30009] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19714'. [ 2611.530241][T30032] netlink: 164 bytes leftover after parsing attributes in process `syz.1.19720'. [ 2611.595512][T30032] netlink: 10 bytes leftover after parsing attributes in process `syz.1.19720'. [ 2611.634111][T30032] netlink: 'syz.1.19720': attribute type 2 has an invalid length. [ 2611.666851][T30032] netlink: 'syz.1.19720': attribute type 1 has an invalid length. [ 2611.693427][T30032] netlink: 'syz.1.19720': attribute type 4 has an invalid length. [ 2611.736960][T30032] netlink: 208312 bytes leftover after parsing attributes in process `syz.1.19720'. [ 2612.380473][T30061] netlink: 'syz.1.19728': attribute type 46 has an invalid length. [ 2612.428181][T30061] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19728'. [ 2613.271540][T30079] can: request_module (can-proto-0) failed. [ 2613.867379][T30110] netlink: 'syz.1.19742': attribute type 46 has an invalid length. [ 2613.889932][T30110] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19742'. [ 2614.946612][T30151] netlink: 'syz.4.19755': attribute type 46 has an invalid length. [ 2614.980648][T30151] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19755'. [ 2615.895917][T30185] netlink: 128 bytes leftover after parsing attributes in process `syz.1.19767'. [ 2615.905493][T30185] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2615.933129][T30185] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2616.121399][T30190] netlink: 'syz.1.19768': attribute type 46 has an invalid length. [ 2616.219317][T30190] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19768'. [ 2618.245630][T30246] netlink: 'syz.0.19782': attribute type 46 has an invalid length. [ 2618.269032][T30246] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19782'. [ 2619.295967][T30267] delete_channel: no stack [ 2620.046446][T30291] netlink: 'syz.1.19799': attribute type 16 has an invalid length. [ 2620.058359][T30295] netlink: 'syz.3.19801': attribute type 46 has an invalid length. [ 2620.078142][T30295] netlink: 55 bytes leftover after parsing attributes in process `syz.3.19801'. [ 2620.105115][T30296] netlink: 'syz.1.19799': attribute type 10 has an invalid length. [ 2620.113216][T30291] netlink: 132 bytes leftover after parsing attributes in process `syz.1.19799'. [ 2620.199708][T30288] delete_channel: no stack [ 2621.492242][T30342] netlink: 'syz.4.19814': attribute type 46 has an invalid length. [ 2621.568601][T30342] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19814'. [ 2623.404721][T30402] netlink: 'syz.0.19830': attribute type 46 has an invalid length. [ 2623.447907][T30402] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19830'. [ 2624.757096][T30459] netlink: 'syz.3.19846': attribute type 46 has an invalid length. [ 2624.765803][T30459] netlink: 55 bytes leftover after parsing attributes in process `syz.3.19846'. [ 2626.125690][T30493] netlink: 'syz.1.19858': attribute type 46 has an invalid length. [ 2626.203408][T30493] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19858'. [ 2627.699598][T30544] netlink: 'syz.0.19873': attribute type 46 has an invalid length. [ 2627.810231][T30544] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19873'. [ 2628.417560][ T4279] Bluetooth: hci2: command 0x0406 tx timeout [ 2628.861597][T30585] netlink: 128 bytes leftover after parsing attributes in process `syz.4.19885'. [ 2628.877918][T30585] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2628.906222][T30585] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2629.084599][T30594] netlink: 'syz.3.19889': attribute type 3 has an invalid length. [ 2629.102780][T30595] netlink: 'syz.4.19888': attribute type 46 has an invalid length. [ 2629.106861][T30594] netlink: 'syz.3.19889': attribute type 1 has an invalid length. [ 2629.114852][T30595] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19888'. [ 2630.155069][T30634] netlink: 'syz.1.19901': attribute type 46 has an invalid length. [ 2630.253845][T30634] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19901'. [ 2631.145811][T30650] delete_channel: no stack [ 2631.727640][T30672] netlink: 'syz.1.19913': attribute type 46 has an invalid length. [ 2631.763241][T30672] netlink: 55 bytes leftover after parsing attributes in process `syz.1.19913'. [ 2632.149788][T30692] netlink: 'syz.1.19920': attribute type 3 has an invalid length. [ 2632.160500][T30692] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.19920'. [ 2632.814622][T30723] netlink: 'syz.2.19928': attribute type 46 has an invalid length. [ 2632.861293][T30723] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19928'. [ 2633.159787][T30730] FAULT_INJECTION: forcing a failure. [ 2633.159787][T30730] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2633.195887][T30730] CPU: 0 PID: 30730 Comm: syz.2.19934 Not tainted syzkaller #0 [ 2633.203501][T30730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2633.213662][T30730] Call Trace: [ 2633.216964][T30730] [ 2633.219903][T30730] dump_stack_lvl+0x188/0x24e [ 2633.224625][T30730] ? show_regs_print_info+0x12/0x12 [ 2633.229933][T30730] ? load_image+0x410/0x410 [ 2633.234462][T30730] ? __lock_acquire+0x7c40/0x7c40 [ 2633.239515][T30730] should_fail_ex+0x390/0x4c0 [ 2633.244216][T30730] _copy_from_user+0x2c/0x170 [ 2633.248919][T30730] __sys_bpf+0x2ea/0x780 [ 2633.253190][T30730] ? bpf_link_show_fdinfo+0x380/0x380 [ 2633.258649][T30730] ? lock_chain_count+0x20/0x20 [ 2633.263530][T30730] __x64_sys_bpf+0x78/0x90 [ 2633.267972][T30730] do_syscall_64+0x4c/0xa0 [ 2633.272406][T30730] ? clear_bhb_loop+0x60/0xb0 [ 2633.277104][T30730] ? clear_bhb_loop+0x60/0xb0 [ 2633.281813][T30730] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2633.287723][T30730] RIP: 0033:0x7f4aa759de99 [ 2633.292164][T30730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2633.311879][T30730] RSP: 002b:00007f4aa8461028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2633.320317][T30730] RAX: ffffffffffffffda RBX: 00007f4aa7825fa0 RCX: 00007f4aa759de99 [ 2633.328319][T30730] RDX: 0000000000000090 RSI: 00002000000004c0 RDI: 0000000000000005 [ 2633.336316][T30730] RBP: 00007f4aa8461090 R08: 0000000000000000 R09: 0000000000000000 [ 2633.344486][T30730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2633.352491][T30730] R13: 00007f4aa7826038 R14: 00007f4aa7825fa0 R15: 00007ffc94e3bee8 [ 2633.360489][T30730] [ 2634.254954][T30780] netlink: 'syz.0.19946': attribute type 46 has an invalid length. [ 2634.281697][T30781] netlink: 'syz.2.19948': attribute type 1 has an invalid length. [ 2634.303378][T30780] netlink: 55 bytes leftover after parsing attributes in process `syz.0.19946'. [ 2634.322914][T30781] netlink: 5 bytes leftover after parsing attributes in process `syz.2.19948'. [ 2637.771444][T30821] netlink: 'syz.4.19959': attribute type 46 has an invalid length. [ 2637.808100][T30821] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19959'. [ 2638.105680][T30832] netlink: 'syz.4.19963': attribute type 10 has an invalid length. [ 2638.191991][T30832] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 2639.069078][T30869] netlink: 'syz.4.19973': attribute type 46 has an invalid length. [ 2639.106424][T30869] netlink: 55 bytes leftover after parsing attributes in process `syz.4.19973'. [ 2639.691461][T30885] netlink: 'syz.3.19979': attribute type 10 has an invalid length. [ 2639.716869][T30885] netlink: 40 bytes leftover after parsing attributes in process `syz.3.19979'. [ 2639.734488][T30885] device dummy0 entered promiscuous mode [ 2639.753390][T30885] bridge0: port 3(dummy0) entered blocking state [ 2639.767589][T30885] bridge0: port 3(dummy0) entered disabled state [ 2639.811443][T30885] bridge0: port 3(dummy0) entered blocking state [ 2639.818648][T30885] bridge0: port 3(dummy0) entered forwarding state [ 2640.942459][T30912] netlink: 'syz.2.19987': attribute type 46 has an invalid length. [ 2641.017433][T30912] netlink: 55 bytes leftover after parsing attributes in process `syz.2.19987'. [ 2641.588666][T30933] netlink: 'syz.2.19992': attribute type 2 has an invalid length. [ 2641.611404][T30933] netlink: 10 bytes leftover after parsing attributes in process `syz.2.19992'. [ 2642.022887][T30947] netlink: 132 bytes leftover after parsing attributes in process `syz.0.19997'. [ 2642.332150][T30955] netlink: 128 bytes leftover after parsing attributes in process `syz.4.19999'. [ 2642.350951][T30955] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2642.365772][T30955] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2642.391488][T30957] device pim6reg1 entered promiscuous mode [ 2642.733257][T30970] netlink: 'syz.4.20003': attribute type 46 has an invalid length. [ 2642.751627][T30970] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20003'. [ 2643.494583][T31000] netlink: 'syz.4.20011': attribute type 1 has an invalid length. [ 2643.514287][T31000] netlink: 'syz.4.20011': attribute type 1 has an invalid length. [ 2643.525230][T31000] netlink: 116376 bytes leftover after parsing attributes in process `syz.4.20011'. [ 2644.997838][T31015] netlink: 'syz.2.20018': attribute type 46 has an invalid length. [ 2645.066441][T31015] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20018'. [ 2645.303334][T31029] netlink: 164 bytes leftover after parsing attributes in process `syz.2.20022'. [ 2645.320808][T31028] netlink: 'syz.2.20022': attribute type 29 has an invalid length. [ 2645.331582][T31028] netlink: 'syz.2.20022': attribute type 29 has an invalid length. [ 2646.191633][T31055] bond0: (slave netdevsim0): Error: Slave device does not support XDP [ 2646.204213][T31055] netlink: 'syz.1.20029': attribute type 10 has an invalid length. [ 2646.557873][T31065] netlink: 'syz.3.20032': attribute type 46 has an invalid length. [ 2646.575158][T31065] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20032'. [ 2647.769873][T31098] netlink: 'syz.2.20043': attribute type 46 has an invalid length. [ 2647.789786][T31098] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20043'. [ 2648.503026][T31116] FAULT_INJECTION: forcing a failure. [ 2648.503026][T31116] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2648.580229][T31116] CPU: 0 PID: 31116 Comm: syz.0.20047 Not tainted syzkaller #0 [ 2648.587853][T31116] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2648.598045][T31116] Call Trace: [ 2648.601340][T31116] [ 2648.604294][T31116] dump_stack_lvl+0x188/0x24e [ 2648.609025][T31116] ? show_regs_print_info+0x12/0x12 [ 2648.614254][T31116] ? load_image+0x410/0x410 [ 2648.618782][T31116] ? __lock_acquire+0x7c40/0x7c40 [ 2648.623933][T31116] should_fail_ex+0x390/0x4c0 [ 2648.628688][T31116] strncpy_from_user+0x32/0x340 [ 2648.633564][T31116] bpf_prog_load+0x200/0x1530 [ 2648.638264][T31116] ? map_freeze+0x390/0x390 [ 2648.642767][T31116] ? __might_fault+0xa6/0x120 [ 2648.647533][T31116] ? __might_fault+0xa6/0x120 [ 2648.652302][T31116] ? __might_fault+0xc2/0x120 [ 2648.656967][T31116] ? __might_fault+0xa6/0x120 [ 2648.661637][T31116] ? bpf_lsm_bpf+0x5/0x10 [ 2648.665955][T31116] ? security_bpf+0x7a/0xa0 [ 2648.670454][T31116] __sys_bpf+0x5b8/0x780 [ 2648.674739][T31116] ? bpf_link_show_fdinfo+0x380/0x380 [ 2648.680119][T31116] ? lock_chain_count+0x20/0x20 [ 2648.684999][T31116] __x64_sys_bpf+0x78/0x90 [ 2648.689417][T31116] do_syscall_64+0x4c/0xa0 [ 2648.693828][T31116] ? clear_bhb_loop+0x60/0xb0 [ 2648.698500][T31116] ? clear_bhb_loop+0x60/0xb0 [ 2648.703174][T31116] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2648.709064][T31116] RIP: 0033:0x7ff6c9d9de99 [ 2648.713489][T31116] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2648.733195][T31116] RSP: 002b:00007ff6cabad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2648.741668][T31116] RAX: ffffffffffffffda RBX: 00007ff6ca025fa0 RCX: 00007ff6c9d9de99 [ 2648.749635][T31116] RDX: 0000000000000090 RSI: 00002000000004c0 RDI: 0000000000000005 [ 2648.757599][T31116] RBP: 00007ff6cabad090 R08: 0000000000000000 R09: 0000000000000000 [ 2648.765561][T31116] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2648.773549][T31116] R13: 00007ff6ca026038 R14: 00007ff6ca025fa0 R15: 00007fff7a0d4d98 [ 2648.781525][T31116] [ 2649.011844][T31128] netlink: 132 bytes leftover after parsing attributes in process `syz.3.20050'. [ 2649.319947][T31139] netlink: 'syz.0.20053': attribute type 1 has an invalid length. [ 2649.338815][T31139] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.20053'. [ 2649.828243][T31154] netlink: 'syz.2.20056': attribute type 46 has an invalid length. [ 2649.898111][T31154] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20056'. [ 2650.747342][T31183] syz.3.20065[31183] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 2650.747502][T31183] syz.3.20065[31183] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 2651.946640][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 2651.971133][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 2653.910819][T31206] netlink: 'syz.1.20069': attribute type 3 has an invalid length. [ 2653.993636][T31206] netlink: 114680 bytes leftover after parsing attributes in process `syz.1.20069'. [ 2654.835558][T31220] netlink: 'syz.4.20074': attribute type 46 has an invalid length. [ 2654.886959][T31220] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20074'. [ 2656.053101][T31269] netlink: 'syz.1.20087': attribute type 46 has an invalid length. [ 2656.077807][T31269] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20087'. [ 2657.171561][T31287] FAULT_INJECTION: forcing a failure. [ 2657.171561][T31287] name failslab, interval 1, probability 0, space 0, times 0 [ 2657.212599][T31287] CPU: 1 PID: 31287 Comm: syz.4.20093 Not tainted syzkaller #0 [ 2657.220254][T31287] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2657.230342][T31287] Call Trace: [ 2657.233621][T31287] [ 2657.236739][T31287] dump_stack_lvl+0x188/0x24e [ 2657.241444][T31287] ? show_regs_print_info+0x12/0x12 [ 2657.246668][T31287] ? load_image+0x410/0x410 [ 2657.251184][T31287] ? __might_sleep+0xd0/0xd0 [ 2657.255864][T31287] ? __lock_acquire+0x7c40/0x7c40 [ 2657.260897][T31287] ? aa_file_perm+0x3ea/0xf00 [ 2657.265578][T31287] should_fail_ex+0x390/0x4c0 [ 2657.270265][T31287] should_failslab+0x5/0x20 [ 2657.274758][T31287] slab_pre_alloc_hook+0x59/0x300 [ 2657.279784][T31287] ? kernfs_fop_write_iter+0x154/0x520 [ 2657.285239][T31287] __kmem_cache_alloc_node+0x4f/0x270 [ 2657.290607][T31287] ? kernfs_fop_write_iter+0x154/0x520 [ 2657.296056][T31287] __kmalloc+0xa3/0x240 [ 2657.300211][T31287] kernfs_fop_write_iter+0x154/0x520 [ 2657.305494][T31287] vfs_write+0x482/0x9a0 [ 2657.309752][T31287] ? file_end_write+0x250/0x250 [ 2657.314603][T31287] ? __fget_files+0x3fc/0x460 [ 2657.319283][T31287] ? __fdget_pos+0x2ae/0x360 [ 2657.323873][T31287] ? ksys_write+0x70/0x260 [ 2657.328288][T31287] ksys_write+0x14d/0x260 [ 2657.332643][T31287] ? __ia32_sys_read+0x80/0x80 [ 2657.337408][T31287] ? lockdep_hardirqs_on+0x94/0x140 [ 2657.342624][T31287] do_syscall_64+0x4c/0xa0 [ 2657.347038][T31287] ? clear_bhb_loop+0x60/0xb0 [ 2657.351709][T31287] ? clear_bhb_loop+0x60/0xb0 [ 2657.356397][T31287] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2657.362288][T31287] RIP: 0033:0x7f7cc859de99 [ 2657.366696][T31287] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2657.386390][T31287] RSP: 002b:00007f7cc67f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2657.395068][T31287] RAX: ffffffffffffffda RBX: 00007f7cc8825fa0 RCX: 00007f7cc859de99 [ 2657.403040][T31287] RDX: 0000000000000012 RSI: 0000200000000080 RDI: 0000000000000007 [ 2657.411000][T31287] RBP: 00007f7cc67f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2657.419160][T31287] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2657.427330][T31287] R13: 00007f7cc8826038 R14: 00007f7cc8825fa0 R15: 00007ffdcaaa1f98 [ 2657.435358][T31287] [ 2658.453807][T31312] netlink: 'syz.3.20100': attribute type 46 has an invalid length. [ 2658.476910][T31312] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20100'. [ 2660.486973][T31360] netlink: 'syz.4.20112': attribute type 46 has an invalid length. [ 2660.528026][T31360] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20112'. [ 2660.556440][T31363] netlink: 128 bytes leftover after parsing attributes in process `syz.2.20114'. [ 2660.572906][T31363] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2660.605870][T31363] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2661.983891][T31412] netlink: 12 bytes leftover after parsing attributes in process `syz.0.20128'. [ 2662.115343][T31416] netlink: 'syz.4.20129': attribute type 46 has an invalid length. [ 2662.156236][T31416] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20129'. [ 2663.426321][T31447] bond0: (slave dummy0): Error: Slave device does not support XDP [ 2663.969506][T31463] netlink: 'syz.3.20145': attribute type 12 has an invalid length. [ 2663.991883][T31463] netlink: 132 bytes leftover after parsing attributes in process `syz.3.20145'. [ 2664.037030][T31463] netlink: 'syz.3.20145': attribute type 6 has an invalid length. [ 2664.055519][T31463] netlink: 168 bytes leftover after parsing attributes in process `syz.3.20145'. [ 2664.071376][T31467] netlink: 'syz.4.20144': attribute type 46 has an invalid length. [ 2664.102917][T31467] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20144'. [ 2664.113401][T31463] netlink: 'syz.3.20145': attribute type 5 has an invalid length. [ 2664.125506][T31462] delete_channel: no stack [ 2665.250677][T31498] FAULT_INJECTION: forcing a failure. [ 2665.250677][T31498] name failslab, interval 1, probability 0, space 0, times 0 [ 2665.300294][T31498] CPU: 1 PID: 31498 Comm: syz.1.20158 Not tainted syzkaller #0 [ 2665.307920][T31498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2665.317997][T31498] Call Trace: [ 2665.321302][T31498] [ 2665.324262][T31498] dump_stack_lvl+0x188/0x24e [ 2665.328975][T31498] ? show_regs_print_info+0x12/0x12 [ 2665.334197][T31498] ? load_image+0x410/0x410 [ 2665.338734][T31498] ? __might_sleep+0xd0/0xd0 [ 2665.343358][T31498] ? __lock_acquire+0x7c40/0x7c40 [ 2665.348424][T31498] should_fail_ex+0x390/0x4c0 [ 2665.353134][T31498] should_failslab+0x5/0x20 [ 2665.357667][T31498] slab_pre_alloc_hook+0x59/0x300 [ 2665.362723][T31498] ? __get_vm_area_node+0x122/0x330 [ 2665.367966][T31498] __kmem_cache_alloc_node+0x4f/0x270 [ 2665.373370][T31498] ? __get_vm_area_node+0x122/0x330 [ 2665.378590][T31498] kmalloc_node_trace+0x22/0xe0 [ 2665.383487][T31498] __get_vm_area_node+0x122/0x330 [ 2665.388645][T31498] __vmalloc_node_range+0x357/0x1380 [ 2665.393941][T31498] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.399590][T31498] ? aa_get_newest_label+0xf9/0x5b0 [ 2665.404806][T31498] ? free_vm_area+0x50/0x50 [ 2665.409315][T31498] ? end_current_label_crit_section+0x170/0x170 [ 2665.415564][T31498] ? __lock_acquire+0x7c40/0x7c40 [ 2665.420589][T31498] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.426131][T31498] __vmalloc+0x76/0x80 [ 2665.430199][T31498] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.435803][T31498] bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.441303][T31498] ? bpf_prog_alloc+0x13/0x1b0 [ 2665.446085][T31498] bpf_prog_alloc+0x1c/0x1b0 [ 2665.450690][T31498] bpf_prog_load+0x7d4/0x1530 [ 2665.455388][T31498] ? map_freeze+0x390/0x390 [ 2665.459976][T31498] ? __might_fault+0xa6/0x120 [ 2665.464750][T31498] ? trace_call_bpf+0xbf/0x6b0 [ 2665.469517][T31498] ? __might_fault+0xa6/0x120 [ 2665.474248][T31498] ? __might_fault+0xc2/0x120 [ 2665.478934][T31498] ? __might_fault+0xa6/0x120 [ 2665.483656][T31498] ? bpf_lsm_bpf+0x5/0x10 [ 2665.488024][T31498] ? security_bpf+0x7a/0xa0 [ 2665.492548][T31498] __sys_bpf+0x5b8/0x780 [ 2665.496840][T31498] ? bpf_link_show_fdinfo+0x380/0x380 [ 2665.502273][T31498] ? lock_chain_count+0x20/0x20 [ 2665.507155][T31498] __x64_sys_bpf+0x78/0x90 [ 2665.511612][T31498] do_syscall_64+0x4c/0xa0 [ 2665.516048][T31498] ? clear_bhb_loop+0x60/0xb0 [ 2665.520928][T31498] ? clear_bhb_loop+0x60/0xb0 [ 2665.525680][T31498] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2665.531608][T31498] RIP: 0033:0x7f141379de99 [ 2665.536180][T31498] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2665.555805][T31498] RSP: 002b:00007f14145cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2665.564537][T31498] RAX: ffffffffffffffda RBX: 00007f1413a25fa0 RCX: 00007f141379de99 [ 2665.572509][T31498] RDX: 0000000000000090 RSI: 00002000000004c0 RDI: 0000000000000005 [ 2665.580486][T31498] RBP: 00007f14145cd090 R08: 0000000000000000 R09: 0000000000000000 [ 2665.588468][T31498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2665.596439][T31498] R13: 00007f1413a26038 R14: 00007f1413a25fa0 R15: 00007ffe6a74b498 [ 2665.604420][T31498] [ 2665.637971][T31498] syz.1.20158: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 2665.666822][T31498] CPU: 0 PID: 31498 Comm: syz.1.20158 Not tainted syzkaller #0 [ 2665.674437][T31498] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2665.684642][T31498] Call Trace: [ 2665.687938][T31498] [ 2665.690876][T31498] dump_stack_lvl+0x188/0x24e [ 2665.695572][T31498] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 2665.702007][T31498] ? show_regs_print_info+0x12/0x12 [ 2665.707239][T31498] ? load_image+0x410/0x410 [ 2665.711763][T31498] ? cpuset_print_current_mems_allowed+0x1b/0x360 [ 2665.718210][T31498] ? cpuset_print_current_mems_allowed+0x2e3/0x360 [ 2665.724752][T31498] warn_alloc+0x242/0x330 [ 2665.729115][T31498] ? __get_vm_area_node+0x122/0x330 [ 2665.734348][T31498] ? zone_watermark_ok_safe+0x270/0x270 [ 2665.739925][T31498] ? rcu_is_watching+0x11/0xa0 [ 2665.744902][T31498] ? __get_vm_area_node+0x318/0x330 [ 2665.750131][T31498] __vmalloc_node_range+0x37c/0x1380 [ 2665.755452][T31498] ? aa_get_newest_label+0xf9/0x5b0 [ 2665.760671][T31498] ? free_vm_area+0x50/0x50 [ 2665.765177][T31498] ? end_current_label_crit_section+0x170/0x170 [ 2665.771434][T31498] ? __lock_acquire+0x7c40/0x7c40 [ 2665.776459][T31498] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.782240][T31498] __vmalloc+0x76/0x80 [ 2665.786312][T31498] ? bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.791853][T31498] bpf_prog_alloc_no_stats+0x37/0x3a0 [ 2665.797654][T31498] ? bpf_prog_alloc+0x13/0x1b0 [ 2665.802531][T31498] bpf_prog_alloc+0x1c/0x1b0 [ 2665.807237][T31498] bpf_prog_load+0x7d4/0x1530 [ 2665.811915][T31498] ? map_freeze+0x390/0x390 [ 2665.816409][T31498] ? __might_fault+0xa6/0x120 [ 2665.821077][T31498] ? trace_call_bpf+0xbf/0x6b0 [ 2665.825844][T31498] ? __might_fault+0xa6/0x120 [ 2665.830513][T31498] ? __might_fault+0xc2/0x120 [ 2665.835201][T31498] ? __might_fault+0xa6/0x120 [ 2665.839870][T31498] ? bpf_lsm_bpf+0x5/0x10 [ 2665.844196][T31498] ? security_bpf+0x7a/0xa0 [ 2665.848785][T31498] __sys_bpf+0x5b8/0x780 [ 2665.853058][T31498] ? bpf_link_show_fdinfo+0x380/0x380 [ 2665.858436][T31498] ? lock_chain_count+0x20/0x20 [ 2665.863286][T31498] __x64_sys_bpf+0x78/0x90 [ 2665.867868][T31498] do_syscall_64+0x4c/0xa0 [ 2665.872365][T31498] ? clear_bhb_loop+0x60/0xb0 [ 2665.877034][T31498] ? clear_bhb_loop+0x60/0xb0 [ 2665.881714][T31498] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2665.887685][T31498] RIP: 0033:0x7f141379de99 [ 2665.892187][T31498] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2665.912043][T31498] RSP: 002b:00007f14145cd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2665.920713][T31498] RAX: ffffffffffffffda RBX: 00007f1413a25fa0 RCX: 00007f141379de99 [ 2665.928679][T31498] RDX: 0000000000000090 RSI: 00002000000004c0 RDI: 0000000000000005 [ 2665.936734][T31498] RBP: 00007f14145cd090 R08: 0000000000000000 R09: 0000000000000000 [ 2665.944868][T31498] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2665.952827][T31498] R13: 00007f1413a26038 R14: 00007f1413a25fa0 R15: 00007ffe6a74b498 [ 2665.960990][T31498] [ 2666.083039][T31505] netlink: 'syz.2.20160': attribute type 46 has an invalid length. [ 2666.133127][T31505] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20160'. [ 2666.317561][T31498] Mem-Info: [ 2666.321404][T31498] active_anon:11017 inactive_anon:0 isolated_anon:0 [ 2666.321404][T31498] active_file:22051 inactive_file:41020 isolated_file:0 [ 2666.321404][T31498] unevictable:768 dirty:129 writeback:0 [ 2666.321404][T31498] slab_reclaimable:21763 slab_unreclaimable:96588 [ 2666.321404][T31498] mapped:33352 shmem:1361 pagetables:626 [ 2666.321404][T31498] sec_pagetables:0 bounce:0 [ 2666.321404][T31498] kernel_misc_reclaimable:0 [ 2666.321404][T31498] free:1307541 free_pcp:9697 free_cma:0 [ 2666.502881][T31498] Node 0 active_anon:43968kB inactive_anon:0kB active_file:88204kB inactive_file:163880kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:133508kB dirty:516kB writeback:0kB shmem:3908kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:10396kB pagetables:2504kB sec_pagetables:0kB all_unreclaimable? no [ 2666.545947][T31498] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp: 0kB shmem_pmdmapped: 0kB anon_thp: 0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 2666.584647][T31498] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2666.616673][T31498] lowmem_reserve[]: 0 2527 2528 2528 2528 [ 2666.622581][T31498] Node 0 DMA32 free:1300072kB boost:0kB min:34692kB low:43364kB high:52036kB reserved_highatomic:0KB active_anon:43968kB inactive_anon:0kB active_file:88204kB inactive_file:163880kB unevictable:1536kB writepending:516kB present:3129332kB managed:2592912kB mlocked:0kB bounce:0kB free_pcp:39360kB local_pcp:17732kB free_cma:0kB [ 2666.665762][T31498] lowmem_reserve[]: 0 0 1 1 1 [ 2666.671945][T31498] Node 0 Normal free:20kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:1048576kB managed:1424kB mlocked:0kB bounce:0kB free_pcp:20kB local_pcp:12kB free_cma:0kB [ 2666.705291][T31498] lowmem_reserve[]: 0 0 0 0 0 [ 2666.710433][T31498] Node 1 Normal free:3918860kB boost:0kB min:55192kB low:68988kB high:82784kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117620kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2666.746415][T31498] lowmem_reserve[]: 0 0 0 0 0 [ 2666.751572][T31498] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 2666.775282][T31498] Node 0 DMA32: 627*4kB (UME) 1265*8kB (UME) 2077*16kB (UME) 3474*32kB (UME) 608*64kB (UME) 342*128kB (UME) 257*256kB (UME) 111*512kB (UME) 66*1024kB (UM) 9*2048kB (UME) 208*4096kB (UM) = 1300324kB [ 2666.800876][T31498] Node 0 Normal: 1*4kB (U) 2*8kB (U) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 2666.814645][T31498] Node 1 Normal: 239*4kB (UME) 66*8kB (UME) 38*16kB (UME) 215*32kB (UE) 102*64kB (UME) 25*128kB (UME) 15*256kB (UM) 4*512kB (UM) 1*1024kB (E) 3*2048kB (UE) 949*4096kB (M) = 3918860kB [ 2666.837902][T31498] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2666.848856][T31498] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2666.860625][T31498] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2666.871645][T31498] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2666.883097][T31498] 64432 total pagecache pages [ 2666.888192][T31498] 0 pages in swap cache [ 2666.892484][T31498] Free swap = 124996kB [ 2666.901665][T31498] Total swap = 124996kB [ 2666.906043][T31498] 2097051 pages RAM [ 2666.910398][T31498] 0 pages HighMem/MovableOnly [ 2666.915296][T31498] 415222 pages reserved [ 2666.925549][T31498] 0 pages cma reserved [ 2667.583092][T31558] netlink: 'syz.2.20174': attribute type 46 has an invalid length. [ 2667.654918][T31558] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20174'. [ 2668.147287][T31566] syz.0.20176[31566] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 2668.147383][T31566] syz.0.20176[31566] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 2670.322339][T31629] netlink: 'syz.4.20190': attribute type 46 has an invalid length. [ 2670.466890][T31629] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20190'. [ 2672.476945][T31688] netlink: 'syz.0.20206': attribute type 46 has an invalid length. [ 2672.552269][T31688] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20206'. [ 2672.864445][T31698] FAULT_INJECTION: forcing a failure. [ 2672.864445][T31698] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2672.907571][T31698] CPU: 1 PID: 31698 Comm: syz.3.20212 Not tainted syzkaller #0 [ 2672.915190][T31698] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2672.925274][T31698] Call Trace: [ 2672.928576][T31698] [ 2672.931532][T31698] dump_stack_lvl+0x188/0x24e [ 2672.936251][T31698] ? show_regs_print_info+0x12/0x12 [ 2672.941501][T31698] ? load_image+0x410/0x410 [ 2672.946044][T31698] ? __lock_acquire+0x7c40/0x7c40 [ 2672.951102][T31698] should_fail_ex+0x390/0x4c0 [ 2672.955810][T31698] _copy_from_iter+0x1c0/0x1130 [ 2672.960691][T31698] ? copyout_mc+0x110/0x110 [ 2672.965220][T31698] ? __virt_addr_valid+0x188/0x540 [ 2672.970365][T31698] ? __virt_addr_valid+0x188/0x540 [ 2672.975513][T31698] ? __virt_addr_valid+0x467/0x540 [ 2672.980656][T31698] ? __phys_addr_symbol+0x2b/0x70 [ 2672.985708][T31698] ? __check_object_size+0x4f6/0xa70 [ 2672.991029][T31698] kernfs_fop_write_iter+0x19a/0x520 [ 2672.996345][T31698] vfs_write+0x482/0x9a0 [ 2673.000614][T31698] ? file_end_write+0x250/0x250 [ 2673.005495][T31698] ? __fget_files+0x3fc/0x460 [ 2673.010213][T31698] ? __fdget_pos+0x2ae/0x360 [ 2673.014843][T31698] ? ksys_write+0x70/0x260 [ 2673.019298][T31698] ksys_write+0x14d/0x260 [ 2673.023667][T31698] ? __ia32_sys_read+0x80/0x80 [ 2673.028468][T31698] ? lockdep_hardirqs_on+0x94/0x140 [ 2673.033681][T31698] do_syscall_64+0x4c/0xa0 [ 2673.038108][T31698] ? clear_bhb_loop+0x60/0xb0 [ 2673.042904][T31698] ? clear_bhb_loop+0x60/0xb0 [ 2673.047605][T31698] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2673.053519][T31698] RIP: 0033:0x7f0e7479de99 [ 2673.057951][T31698] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2673.077581][T31698] RSP: 002b:00007f0e75629028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2673.086035][T31698] RAX: ffffffffffffffda RBX: 00007f0e74a25fa0 RCX: 00007f0e7479de99 [ 2673.094032][T31698] RDX: 0000000000000012 RSI: 0000200000000080 RDI: 0000000000000007 [ 2673.102081][T31698] RBP: 00007f0e75629090 R08: 0000000000000000 R09: 0000000000000000 [ 2673.110268][T31698] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2673.118264][T31698] R13: 00007f0e74a26038 R14: 00007f0e74a25fa0 R15: 00007ffe0e388c08 [ 2673.126270][T31698] [ 2673.348479][T31713] netlink: 'syz.2.20216': attribute type 2 has an invalid length. [ 2673.366784][T31713] netlink: 10 bytes leftover after parsing attributes in process `syz.2.20216'. [ 2673.635405][T31729] netlink: 128 bytes leftover after parsing attributes in process `syz.1.20219'. [ 2673.669857][T31729] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2673.690366][T31729] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2674.421863][T31754] netlink: 'syz.4.20224': attribute type 46 has an invalid length. [ 2674.438814][T31754] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20224'. [ 2676.438707][T31804] netlink: 'syz.3.20238': attribute type 46 has an invalid length. [ 2676.467329][T31804] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20238'. [ 2677.090776][T31827] netlink: 122896 bytes leftover after parsing attributes in process `syz.3.20246'. [ 2678.218697][T31844] bond0: (slave netdevsim0): Error: Slave device does not support XDP [ 2678.293578][T31849] netlink: 'syz.2.20251': attribute type 21 has an invalid length. [ 2678.333942][T31849] netlink: 'syz.2.20251': attribute type 6 has an invalid length. [ 2678.381022][T31849] netlink: 132 bytes leftover after parsing attributes in process `syz.2.20251'. [ 2678.424141][T31852] netlink: 'syz.1.20250': attribute type 10 has an invalid length. [ 2678.857368][T31864] netlink: 'syz.0.20256': attribute type 46 has an invalid length. [ 2678.959067][T31864] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20256'. [ 2680.646955][T31915] netlink: 'syz.3.20270': attribute type 46 has an invalid length. [ 2680.654939][T31915] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20270'. [ 2681.144968][T31936] netlink: 'syz.2.20276': attribute type 29 has an invalid length. [ 2681.229352][T31936] netlink: 'syz.2.20276': attribute type 29 has an invalid length. [ 2682.098163][T31981] netlink: 'syz.0.20288': attribute type 46 has an invalid length. [ 2682.197774][T31981] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20288'. [ 2683.322979][T32024] netlink: 'syz.1.20301': attribute type 46 has an invalid length. [ 2683.366788][T32024] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20301'. [ 2685.294835][T32071] netlink: 'syz.1.20317': attribute type 46 has an invalid length. [ 2685.303688][T32071] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20317'. [ 2687.450355][T32074] netlink: 128 bytes leftover after parsing attributes in process `syz.2.20318'. [ 2687.502177][T32074] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2687.534360][T32074] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2688.907630][T32128] netlink: 'syz.3.20332': attribute type 46 has an invalid length. [ 2688.956808][T32128] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20332'. [ 2690.418649][T32184] netlink: 'syz.4.20348': attribute type 46 has an invalid length. [ 2690.436146][T32184] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20348'. [ 2691.185820][T32201] netlink: 'syz.3.20354': attribute type 10 has an invalid length. [ 2691.516583][T32211] netlink: 154020 bytes leftover after parsing attributes in process `syz.3.20357'. [ 2691.527251][T32211] openvswitch: netlink: ufid size 48894 bytes exceeds the range (1, 16) [ 2691.716948][T32217] netlink: 'syz.3.20359': attribute type 46 has an invalid length. [ 2691.746903][T32217] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20359'. [ 2692.452205][T32235] netlink: 63579 bytes leftover after parsing attributes in process `syz.0.20365'. [ 2693.261293][T32256] netlink: 'syz.0.20371': attribute type 46 has an invalid length. [ 2693.340690][T32256] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20371'. [ 2694.935333][T32309] netlink: 'syz.3.20387': attribute type 46 has an invalid length. [ 2694.946411][T32309] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20387'. [ 2695.194477][T32312] netlink: 'syz.4.20389': attribute type 1 has an invalid length. [ 2695.543234][T32330] netlink: 132 bytes leftover after parsing attributes in process `syz.0.20394'. [ 2696.365164][T32361] netlink: 'syz.1.20402': attribute type 46 has an invalid length. [ 2696.416911][T32361] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20402'. [ 2696.783127][T32374] netlink: 'syz.3.20406': attribute type 6 has an invalid length. [ 2696.794329][T32374] netlink: 140 bytes leftover after parsing attributes in process `syz.3.20406'. [ 2697.458545][T32402] netlink: 'syz.0.20415': attribute type 46 has an invalid length. [ 2697.528000][T32402] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20415'. [ 2698.636808][T32437] netlink: 128 bytes leftover after parsing attributes in process `syz.4.20426'. [ 2698.676875][T32437] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2698.696463][T32437] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2699.671740][T32460] netlink: 'syz.4.20434': attribute type 46 has an invalid length. [ 2699.819309][T32460] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20434'. [ 2699.879999][T32468] netlink: 126612 bytes leftover after parsing attributes in process `syz.2.20436'. [ 2699.907579][T32468] netlink: 17 bytes leftover after parsing attributes in process `syz.2.20436'. [ 2701.294503][T32522] netlink: 'syz.2.20452': attribute type 10 has an invalid length. [ 2702.214517][T32526] netlink: 'syz.0.20453': attribute type 46 has an invalid length. [ 2702.224646][T32526] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20453'. [ 2703.707157][T32579] netlink: 'syz.0.20468': attribute type 46 has an invalid length. [ 2703.715135][T32579] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20468'. [ 2703.734565][T32581] netlink: 16222 bytes leftover after parsing attributes in process `syz.4.20470'. [ 2705.717747][T32634] netlink: 'syz.2.20484': attribute type 46 has an invalid length. [ 2705.725726][T32634] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20484'. [ 2706.014130][T32640] netlink: 'syz.3.20488': attribute type 39 has an invalid length. [ 2707.725427][T32672] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.20497'. [ 2708.128596][T32688] netlink: 'syz.1.20500': attribute type 46 has an invalid length. [ 2708.136576][T32688] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20500'. [ 2708.791617][T32703] mac80211_hwsim hwsim386 ªªªªªª: renamed from wlan0 [ 2709.263877][T32729] netlink: 'syz.3.20514': attribute type 46 has an invalid length. [ 2709.282597][T32729] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20514'. [ 2709.322088][T32728] netlink: 'syz.2.20517': attribute type 11 has an invalid length. [ 2709.334385][T32728] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.20517'. [ 2709.360285][T32728] netlink: 'syz.2.20517': attribute type 2 has an invalid length. [ 2709.369254][T32728] netlink: 10 bytes leftover after parsing attributes in process `syz.2.20517'. [ 2709.387973][T32728] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.20517'. [ 2709.424183][T32728] netlink: 'syz.2.20517': attribute type 10 has an invalid length. [ 2709.596547][T32728] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 2709.625450][T32726] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2710.337264][ T4272] Bluetooth: hci4: command 0x0406 tx timeout [ 2710.357690][T32760] netlink: 128 bytes leftover after parsing attributes in process `syz.3.20525'. [ 2710.372232][T32760] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2710.386090][T32760] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2710.776999][ T306] netlink: 'syz.3.20530': attribute type 46 has an invalid length. [ 2710.827373][ T306] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20530'. [ 2712.539995][ T345] sctp: [Deprecated]: syz.2.20543 (pid 345) Use of struct sctp_assoc_value in delayed_ack socket option. [ 2712.539995][ T345] Use struct sctp_sack_info instead [ 2712.757717][ T361] netlink: 'syz.4.20546': attribute type 46 has an invalid length. [ 2712.780531][ T361] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20546'. [ 2713.099518][ T372] netlink: 14 bytes leftover after parsing attributes in process `syz.1.20550'. [ 2713.232575][ T372] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2713.274668][ T372] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2713.296117][ T372] bond0 (unregistering): (slave netdevsim0): Releasing backup interface [ 2713.306068][ T372] bond0 (unregistering): Released all slaves [ 2713.381179][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 2713.387664][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 2713.588290][ T388] netlink: 'syz.3.20557': attribute type 10 has an invalid length. [ 2714.185275][ T409] netlink: 'syz.3.20562': attribute type 46 has an invalid length. [ 2714.204780][ T409] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20562'. [ 2714.974816][ T429] netlink: 16046 bytes leftover after parsing attributes in process `syz.2.20572'. [ 2715.028710][ T434] netlink: 'syz.2.20572': attribute type 2 has an invalid length. [ 2715.057622][ T434] netlink: 'syz.2.20572': attribute type 8 has an invalid length. [ 2715.065594][ T434] netlink: 132 bytes leftover after parsing attributes in process `syz.2.20572'. [ 2715.316937][ T441] netlink: 'syz.4.20576': attribute type 46 has an invalid length. [ 2715.359612][ T441] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20576'. [ 2716.758934][ T490] netlink: 'syz.2.20591': attribute type 46 has an invalid length. [ 2716.792317][ T490] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20591'. [ 2717.102246][ T500] netlink: 5427 bytes leftover after parsing attributes in process `syz.0.20595'. [ 2717.113411][ T500] netlink: 52477 bytes leftover after parsing attributes in process `syz.0.20595'. [ 2717.157220][ T500] netlink: 71676 bytes leftover after parsing attributes in process `syz.0.20595'. [ 2717.293604][ T509] netlink: 'syz.3.20598': attribute type 21 has an invalid length. [ 2717.643925][ T520] device syzkaller0 entered promiscuous mode [ 2721.002047][ T552] netlink: 'syz.2.20609': attribute type 46 has an invalid length. [ 2721.010102][ T552] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20609'. [ 2722.180120][ T615] netlink: 'syz.0.20627': attribute type 46 has an invalid length. [ 2722.218592][ T615] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20627'. [ 2722.779729][ T605] delete_channel: no stack [ 2722.903261][ T633] netlink: 'syz.3.20631': attribute type 46 has an invalid length. [ 2722.923056][ T633] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20631'. [ 2724.357409][ T679] netlink: 'syz.2.20643': attribute type 46 has an invalid length. [ 2724.365767][ T679] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20643'. [ 2724.831971][ T697] bond0: (slave wlan1): Error: Slave device does not support XDP [ 2725.114971][ T708] netlink: 'syz.2.20652': attribute type 46 has an invalid length. [ 2725.155096][ T708] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20652'. [ 2725.554299][ T720] netlink: 'syz.1.20657': attribute type 46 has an invalid length. [ 2725.565349][ T720] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20657'. [ 2725.848266][ T731] netlink: 'syz.1.20658': attribute type 46 has an invalid length. [ 2725.872947][ T731] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20658'. [ 2726.748367][ T765] netlink: 'syz.1.20668': attribute type 46 has an invalid length. [ 2726.790251][ T765] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20668'. [ 2727.044167][ T776] netlink: 'syz.1.20669': attribute type 46 has an invalid length. [ 2727.086887][ T776] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20669'. [ 2728.172077][ T813] netlink: 'syz.0.20680': attribute type 46 has an invalid length. [ 2728.189841][ T783] delete_channel: no stack [ 2728.229483][ T813] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20680'. [ 2728.974327][ T823] netlink: 'syz.2.20682': attribute type 1 has an invalid length. [ 2729.028449][ T823] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.20682'. [ 2729.071722][ T827] netlink: 'syz.4.20681': attribute type 46 has an invalid length. [ 2729.121614][ T827] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20681'. [ 2729.192163][ T828] netlink: 'syz.3.20683': attribute type 46 has an invalid length. [ 2729.273531][ T828] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20683'. [ 2733.143541][ T942] netlink: 'syz.1.20718': attribute type 10 has an invalid length. [ 2733.155148][ T942] netlink: 40 bytes leftover after parsing attributes in process `syz.1.20718'. [ 2733.170865][ T942] device dummy0 entered promiscuous mode [ 2733.182074][ T942] bridge0: port 4(dummy0) entered blocking state [ 2733.193393][ T942] bridge0: port 4(dummy0) entered disabled state [ 2733.223729][ T942] bridge0: port 4(dummy0) entered blocking state [ 2733.230739][ T942] bridge0: port 4(dummy0) entered forwarding state [ 2740.884967][ T1109] netlink: 'syz.4.20744': attribute type 46 has an invalid length. [ 2740.917252][ T1109] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20744'. [ 2741.295426][ T1124] netlink: 'syz.3.20749': attribute type 11 has an invalid length. [ 2741.320860][ T1124] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.20749'. [ 2741.396078][ T1124] netlink: 'syz.3.20749': attribute type 2 has an invalid length. [ 2741.419155][ T1124] netlink: 10 bytes leftover after parsing attributes in process `syz.3.20749'. [ 2741.442453][ T1127] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.20749'. [ 2741.490771][ T1124] netlink: 'syz.3.20749': attribute type 10 has an invalid length. [ 2741.686323][ T1124] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 2741.754770][ T1123] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2741.893441][ T1130] mac80211_hwsim hwsim383 ªªªªªª: renamed from wlan0 [ 2746.039257][ T1169] netlink: 'syz.0.20758': attribute type 46 has an invalid length. [ 2746.105103][ T1169] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20758'. [ 2746.812632][ T1201] netlink: 'syz.0.20768': attribute type 11 has an invalid length. [ 2746.823116][ T1201] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.20768'. [ 2746.865605][ T1201] netlink: 'syz.0.20768': attribute type 2 has an invalid length. [ 2746.876105][ T1201] netlink: 10 bytes leftover after parsing attributes in process `syz.0.20768'. [ 2746.900605][ T1201] netlink: 16186 bytes leftover after parsing attributes in process `syz.0.20768'. [ 2746.921610][ T1201] netlink: 'syz.0.20768': attribute type 10 has an invalid length. [ 2746.938352][ T1201] device wlan1 left promiscuous mode [ 2747.008558][ T1198] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2747.525436][ T1227] netlink: 'syz.4.20773': attribute type 46 has an invalid length. [ 2747.552129][ T1227] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20773'. [ 2748.609016][ T1273] bond0: (slave wlan1): Error: Slave device does not support XDP [ 2748.644247][ T1272] netlink: 'syz.1.20785': attribute type 46 has an invalid length. [ 2748.656036][ T1272] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20785'. [ 2748.667621][ T1273] netlink: 'syz.3.20784': attribute type 10 has an invalid length. [ 2748.682450][ T1273] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 2750.887201][ T1344] netlink: 'syz.0.20804': attribute type 2 has an invalid length. [ 2750.915778][ T1344] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.20804'. [ 2752.264101][ T1392] netlink: 'syz.1.20822': attribute type 46 has an invalid length. [ 2752.293618][ T1392] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20822'. [ 2752.859704][ T1396] netlink: 128 bytes leftover after parsing attributes in process `syz.4.20823'. [ 2752.897775][ T1396] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2752.951985][ T1396] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2753.139060][ T1407] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.20829'. [ 2753.458801][ T1421] netlink: 'syz.0.20835': attribute type 10 has an invalid length. [ 2753.498442][ T1423] netlink: 'syz.1.20834': attribute type 46 has an invalid length. [ 2753.531191][ T1423] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20834'. [ 2754.123332][ T1448] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.20846'. [ 2754.528721][ T1455] netlink: 'syz.4.20849': attribute type 46 has an invalid length. [ 2754.540172][ T1455] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20849'. [ 2755.789779][ T1488] netlink: 'syz.4.20862': attribute type 46 has an invalid length. [ 2755.848543][ T1488] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20862'. [ 2756.344812][ T1521] netlink: 'syz.1.20873': attribute type 33 has an invalid length. [ 2756.387887][ T1521] netlink: 152 bytes leftover after parsing attributes in process `syz.1.20873'. [ 2756.404563][ T1520] netlink: 128 bytes leftover after parsing attributes in process `syz.2.20874'. [ 2756.422800][ T1520] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2756.467255][ T1520] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2756.546286][ T1521] mac80211_hwsim hwsim381 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 2757.219858][ T1543] netlink: 'syz.0.20878': attribute type 46 has an invalid length. [ 2757.242945][ T1543] netlink: 55 bytes leftover after parsing attributes in process `syz.0.20878'. [ 2757.978353][ T1565] bond0: (slave dummy0): Error: Slave device does not support XDP [ 2758.061638][ T1566] netlink: 'syz.4.20885': attribute type 10 has an invalid length. [ 2758.191262][ T1566] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 2758.794171][ T1584] netlink: 'syz.4.20892': attribute type 46 has an invalid length. [ 2758.810721][ T1584] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20892'. [ 2758.835798][ T1583] netlink: 'syz.1.20893': attribute type 9 has an invalid length. [ 2758.846971][ T1583] netlink: 156 bytes leftover after parsing attributes in process `syz.1.20893'. [ 2759.108926][ T1591] can: request_module (can-proto-0) failed. [ 2760.525920][ T1622] syzkaller0: tun_chr_ioctl cmd 2147767519 [ 2760.538636][ T1622] syzkaller0: tun_chr_ioctl cmd 1074025681 [ 2760.614297][ T1622] device sit0 entered promiscuous mode [ 2760.749085][ T1630] netlink: 'syz.1.20907': attribute type 46 has an invalid length. [ 2760.771857][ T1630] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20907'. [ 2762.758484][ T1673] netlink: 'syz.1.20920': attribute type 46 has an invalid length. [ 2762.770086][ T1673] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20920'. [ 2762.885638][ T1678] netlink: 60 bytes leftover after parsing attributes in process `syz.3.20922'. [ 2763.144312][ T1691] netlink: 128 bytes leftover after parsing attributes in process `syz.0.20925'. [ 2763.184517][ T1691] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2763.220663][ T1691] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2766.461618][ T1710] bond0: (slave dummy0): Error: Slave device does not support XDP [ 2766.474136][ T1713] netlink: 'syz.4.20931': attribute type 10 has an invalid length. [ 2766.905680][ T1743] netlink: 144 bytes leftover after parsing attributes in process `syz.2.20942'. [ 2766.923411][ T1746] netlink: 'syz.1.20945': attribute type 8 has an invalid length. [ 2766.940579][ T1746] netlink: 'syz.1.20945': attribute type 4 has an invalid length. [ 2766.959977][ T1746] netlink: 'syz.1.20945': attribute type 7 has an invalid length. [ 2766.981346][ T1746] netlink: 'syz.1.20945': attribute type 8 has an invalid length. [ 2767.003025][ T1746] netlink: 'syz.1.20945': attribute type 7 has an invalid length. [ 2767.022092][ T1746] netlink: 125876 bytes leftover after parsing attributes in process `syz.1.20945'. [ 2767.293137][ T1760] device macsec0 entered promiscuous mode [ 2771.060079][ T1778] ref_ctr_offset mismatch. inode: 0x75e offset: 0x0 ref_ctr_offset(old): 0x7602 ref_ctr_offset(new): 0x0 [ 2771.910802][ T1800] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 2771.921019][ T1800] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 2771.929811][ T1800] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 2771.938383][ T1800] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 2771.948419][ T1800] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 2771.955839][ T1800] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 2772.740812][ T1799] chnl_net:caif_netlink_parms(): no params data found [ 2772.773361][ T1824] netlink: 'syz.2.20968': attribute type 46 has an invalid length. [ 2772.785461][ T1824] netlink: 55 bytes leftover after parsing attributes in process `syz.2.20968'. [ 2772.933047][ T4153] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2772.955238][ T1799] bridge0: port 1(bridge_slave_0) entered blocking state [ 2772.968044][ T1799] bridge0: port 1(bridge_slave_0) entered disabled state [ 2772.976314][ T1799] device bridge_slave_0 entered promiscuous mode [ 2772.995879][ T1799] bridge0: port 2(bridge_slave_1) entered blocking state [ 2773.006485][ T1799] bridge0: port 2(bridge_slave_1) entered disabled state [ 2773.019522][ T1799] device bridge_slave_1 entered promiscuous mode [ 2773.051847][ T4153] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2773.115809][ T1799] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2773.152417][ T1799] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2773.222657][ T4153] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2773.285231][ T1799] team0: Port device team_slave_0 added [ 2773.296007][ T1799] team0: Port device team_slave_1 added [ 2773.342243][ T4153] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2773.394912][ T1799] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2773.437992][ T1799] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2773.498964][ T1799] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2773.556536][ T1799] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2773.586749][ T1799] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2773.632555][ T1799] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2773.822866][ T1865] sctp: [Deprecated]: syz.2.20977 (pid 1865) Use of struct sctp_assoc_value in delayed_ack socket option. [ 2773.822866][ T1865] Use struct sctp_sack_info instead [ 2773.836913][ T1799] device hsr_slave_0 entered promiscuous mode [ 2773.853796][ T1799] device hsr_slave_1 entered promiscuous mode [ 2773.884790][ T1858] netlink: 'syz.1.20979': attribute type 46 has an invalid length. [ 2773.912687][ T1858] netlink: 55 bytes leftover after parsing attributes in process `syz.1.20979'. [ 2773.938540][ T1867] netlink: 'syz.4.20981': attribute type 46 has an invalid length. [ 2773.955634][ T1867] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20981'. [ 2774.002306][ T4153] device 0 left promiscuous mode [ 2774.026926][ T1800] Bluetooth: hci5: command 0x0409 tx timeout [ 2774.471986][ T1882] netlink: 'syz.4.20984': attribute type 21 has an invalid length. [ 2774.487735][ T1882] netlink: 'syz.4.20984': attribute type 6 has an invalid length. [ 2774.513058][ T1882] netlink: 132 bytes leftover after parsing attributes in process `syz.4.20984'. [ 2774.822836][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 2774.829385][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 2775.385319][ T1907] netlink: 'syz.1.20990': attribute type 10 has an invalid length. [ 2775.443896][ T1907] device geneve1 entered promiscuous mode [ 2775.467788][ T1907] team0: Port device geneve1 added [ 2775.586073][ T1913] netlink: 'syz.3.20992': attribute type 46 has an invalid length. [ 2775.624582][ T1913] netlink: 55 bytes leftover after parsing attributes in process `syz.3.20992'. [ 2775.675592][ T1799] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2775.742141][ T1916] netlink: 'syz.4.20993': attribute type 46 has an invalid length. [ 2775.786670][ T1916] netlink: 55 bytes leftover after parsing attributes in process `syz.4.20993'. [ 2775.822812][ T1799] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2776.008500][ T1799] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2776.026635][ T1932] netlink: 128 bytes leftover after parsing attributes in process `syz.3.20997'. [ 2776.045056][ T1932] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2776.096970][ T1800] Bluetooth: hci5: command 0x041b tx timeout [ 2776.107078][ T1932] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2776.127955][ T1799] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2776.524719][ T4153] device hsr_slave_0 left promiscuous mode [ 2776.535489][ T4153] device hsr_slave_1 left promiscuous mode [ 2776.556987][ T4153] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2776.574763][ T4153] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2776.586872][ T4153] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2776.594611][ T4153] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2776.620989][ T4153] device bridge_slave_1 left promiscuous mode [ 2776.642240][ T4153] bridge0: port 2(bridge_slave_1) entered disabled state [ 2776.651526][ T4153] device bridge_slave_0 left promiscuous mode [ 2776.658211][ T4153] bridge0: port 1(bridge_slave_0) entered disabled state [ 2776.704382][ T4153] device veth1_macvtap left promiscuous mode [ 2776.715579][ T4153] device veth0_macvtap left promiscuous mode [ 2778.186864][ T1800] Bluetooth: hci5: command 0x040f tx timeout [ 2780.256930][ T1800] Bluetooth: hci5: command 0x0419 tx timeout [ 2784.772237][ T1799] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2784.833467][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 2784.877522][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2784.888306][ T1799] 8021q: adding VLAN 0 to HW filter on device team0 [ 2784.909631][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 2784.938699][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2784.978839][T19845] bridge0: port 1(bridge_slave_0) entered blocking state [ 2784.986146][T19845] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2785.061252][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 2785.075392][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 2785.119140][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2785.157352][T19845] bridge0: port 2(bridge_slave_1) entered blocking state [ 2785.164565][T19845] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2785.190544][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 2785.214328][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 2785.243959][ T2009] FAULT_INJECTION: forcing a failure. [ 2785.243959][ T2009] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2785.272301][ T2007] bond0: (slave wlan1): Error: Slave device does not support XDP [ 2785.285132][ T2010] netlink: 'syz.2.21018': attribute type 10 has an invalid length. [ 2785.294457][ T2009] CPU: 0 PID: 2009 Comm: syz.3.21019 Not tainted syzkaller #0 [ 2785.302079][ T2009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2785.312248][ T2009] Call Trace: [ 2785.315537][ T2009] [ 2785.318501][ T2009] dump_stack_lvl+0x188/0x24e [ 2785.323221][ T2009] ? show_regs_print_info+0x12/0x12 [ 2785.328461][ T2009] ? load_image+0x410/0x410 [ 2785.332996][ T2009] ? __lock_acquire+0x7c40/0x7c40 [ 2785.338148][ T2009] ? __lock_acquire+0x7c40/0x7c40 [ 2785.343213][ T2009] should_fail_ex+0x390/0x4c0 [ 2785.347924][ T2009] _copy_from_user+0x2c/0x170 [ 2785.352645][ T2009] ___sys_recvmsg+0x170/0x590 [ 2785.357357][ T2009] ? __sys_recvmsg+0x2a0/0x2a0 [ 2785.362157][ T2009] ? trace_call_bpf+0xbf/0x6b0 [ 2785.366975][ T2009] ? __fget_files+0x3fc/0x460 [ 2785.371762][ T2009] __x64_sys_recvmsg+0x20d/0x2e0 [ 2785.376732][ T2009] ? ___sys_recvmsg+0x590/0x590 [ 2785.381624][ T2009] ? syscall_enter_from_user_mode+0x2a/0x80 [ 2785.387546][ T2009] do_syscall_64+0x4c/0xa0 [ 2785.391979][ T2009] ? clear_bhb_loop+0x60/0xb0 [ 2785.396684][ T2009] ? clear_bhb_loop+0x60/0xb0 [ 2785.401368][ T2009] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2785.407350][ T2009] RIP: 0033:0x7f0e7479de99 [ 2785.411839][ T2009] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2785.431466][ T2009] RSP: 002b:00007f0e75629028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 2785.439958][ T2009] RAX: ffffffffffffffda RBX: 00007f0e74a25fa0 RCX: 00007f0e7479de99 [ 2785.447954][ T2009] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000007 [ 2785.455940][ T2009] RBP: 00007f0e75629090 R08: 0000000000000000 R09: 0000000000000000 [ 2785.463943][ T2009] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2785.471916][ T2009] R13: 00007f0e74a26038 R14: 00007f0e74a25fa0 R15: 00007ffe0e388c08 [ 2785.479900][ T2009] [ 2785.508628][ T2010] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 2785.531684][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 2785.549918][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2785.583863][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 2785.609926][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2785.655423][ T1799] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 2785.718317][ T1799] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2785.754534][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2785.768718][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 2785.796330][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2785.845439][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 2785.873018][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2785.928349][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2786.946865][ T2045] netlink: 'syz.3.21030': attribute type 15 has an invalid length. [ 2786.956262][ T2045] netlink: 'syz.3.21030': attribute type 16 has an invalid length. [ 2786.966416][ T2045] netlink: 'syz.3.21030': attribute type 20 has an invalid length. [ 2786.987045][ T2046] netlink: 'syz.3.21030': attribute type 2 has an invalid length. [ 2786.990701][ T2045] netlink: 'syz.3.21030': attribute type 21 has an invalid length. [ 2787.013915][ T2045] netlink: 'syz.3.21030': attribute type 23 has an invalid length. [ 2787.035885][ T2045] netlink: 'syz.3.21030': attribute type 25 has an invalid length. [ 2787.053690][ T1799] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2787.064674][ T2045] netlink: 15862 bytes leftover after parsing attributes in process `syz.3.21030'. [ 2787.207329][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 2787.215493][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2787.259607][ T2046] device 0 entered promiscuous mode [ 2790.651588][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 2790.673082][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 2790.713910][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 2790.757477][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 2790.766554][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 2790.827596][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 2790.869436][ T1799] device veth0_vlan entered promiscuous mode [ 2790.906541][ T1799] device veth1_vlan entered promiscuous mode [ 2790.992845][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 2791.014728][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 2791.034155][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 2791.044930][T19847] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 2791.066693][ T1799] device veth0_macvtap entered promiscuous mode [ 2791.084238][ T1799] device veth1_macvtap entered promiscuous mode [ 2791.110687][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2791.129736][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.156161][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2791.172200][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.182372][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2791.198699][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.213029][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2791.234880][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.253965][ T1799] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2791.275510][ T4153] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 2791.299313][ T4153] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 2791.317685][ T4153] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 2791.333253][ T4153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 2791.349765][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2791.383437][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.399099][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2791.412404][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.422450][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2791.439634][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.452453][ T1799] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2791.477427][ T1799] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2791.495118][ T1799] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2791.516340][ T2083] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.21040'. [ 2791.533845][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 2791.544586][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 2791.565161][ T2081] device syzkaller0 entered promiscuous mode [ 2791.588466][ T1799] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2791.603487][ T1799] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2791.613273][ T1799] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2791.631487][ T1799] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2791.851494][ T4145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2791.873679][ T4145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2791.906069][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 2791.984932][T19849] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2792.002856][T19849] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2792.056492][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 2792.607545][ T2099] netlink: 'syz.0.21045': attribute type 10 has an invalid length. [ 2792.832113][ T2102] FAULT_INJECTION: forcing a failure. [ 2792.832113][ T2102] name failslab, interval 1, probability 0, space 0, times 0 [ 2792.937549][ T2102] CPU: 1 PID: 2102 Comm: syz.4.21046 Not tainted syzkaller #0 [ 2792.945081][ T2102] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2792.955179][ T2102] Call Trace: [ 2792.958488][ T2102] [ 2792.961438][ T2102] dump_stack_lvl+0x188/0x24e [ 2792.966157][ T2102] ? show_regs_print_info+0x12/0x12 [ 2792.971390][ T2102] ? load_image+0x410/0x410 [ 2792.975926][ T2102] ? __might_sleep+0xd0/0xd0 [ 2792.980541][ T2102] ? __lock_acquire+0x7c40/0x7c40 [ 2792.985595][ T2102] ? trace_contention_end+0x5f/0x170 [ 2792.990918][ T2102] should_fail_ex+0x390/0x4c0 [ 2792.995627][ T2102] should_failslab+0x5/0x20 [ 2793.000227][ T2102] slab_pre_alloc_hook+0x59/0x300 [ 2793.005292][ T2102] kmem_cache_alloc_node+0x5a/0x310 [ 2793.010523][ T2102] ? __alloc_skb+0xf9/0x7d0 [ 2793.015077][ T2102] __alloc_skb+0xf9/0x7d0 [ 2793.019454][ T2102] netlink_dump+0x1e1/0xcd0 [ 2793.023998][ T2102] ? kasan_quarantine_put+0x84/0x210 [ 2793.029323][ T2102] ? netlink_lookup+0x200/0x200 [ 2793.034219][ T2102] ? netlink_recvmsg+0x5e3/0xe00 [ 2793.039186][ T2102] ? kmem_cache_free+0xf7/0x2a0 [ 2793.044069][ T2102] netlink_recvmsg+0x68f/0xe00 [ 2793.048872][ T2102] ? netlink_sendmsg+0xbd0/0xbd0 [ 2793.053839][ T2102] ? aa_af_perm+0x340/0x340 [ 2793.058381][ T2102] ? bpf_lsm_socket_recvmsg+0x5/0x10 [ 2793.063786][ T2102] ? security_socket_recvmsg+0x85/0xb0 [ 2793.069283][ T2102] ? netlink_sendmsg+0xbd0/0xbd0 [ 2793.074257][ T2102] ____sys_recvmsg+0x2c8/0x5b0 [ 2793.079062][ T2102] ? __sys_recvmsg_sock+0x40/0x40 [ 2793.084119][ T2102] ? import_iovec+0x6f/0xa0 [ 2793.088648][ T2102] ___sys_recvmsg+0x210/0x590 [ 2793.093369][ T2102] ? __sys_recvmsg+0x2a0/0x2a0 [ 2793.098253][ T2102] ? trace_call_bpf+0xbf/0x6b0 [ 2793.103041][ T2102] ? trace_call_bpf+0x5d6/0x6b0 [ 2793.107926][ T2102] ? __fget_files+0x3fc/0x460 [ 2793.112650][ T2102] __x64_sys_recvmsg+0x20d/0x2e0 [ 2793.117621][ T2102] ? perf_trace_preemptirq_template+0x268/0x320 [ 2793.123895][ T2102] ? ___sys_recvmsg+0x590/0x590 [ 2793.128793][ T2102] ? lockdep_hardirqs_on+0x94/0x140 [ 2793.134023][ T2102] do_syscall_64+0x4c/0xa0 [ 2793.138472][ T2102] ? clear_bhb_loop+0x60/0xb0 [ 2793.143185][ T2102] ? clear_bhb_loop+0x60/0xb0 [ 2793.147896][ T2102] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2793.153809][ T2102] RIP: 0033:0x7f7cc859de99 [ 2793.158245][ T2102] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2793.177880][ T2102] RSP: 002b:00007f7cc67f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 2793.186329][ T2102] RAX: ffffffffffffffda RBX: 00007f7cc8825fa0 RCX: 00007f7cc859de99 [ 2793.194346][ T2102] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000007 [ 2793.202520][ T2102] RBP: 00007f7cc67f6090 R08: 0000000000000000 R09: 0000000000000000 [ 2793.210559][ T2102] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2793.218560][ T2102] R13: 00007f7cc8826038 R14: 00007f7cc8825fa0 R15: 00007ffdcaaa1f98 [ 2793.226579][ T2102] [ 2793.266007][ T4272] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2793.275470][ T4272] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2793.287973][ T4272] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2793.296215][ T4272] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2793.304578][ T4272] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 2793.312081][ T4272] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2795.388123][ T1800] Bluetooth: hci0: command 0x0409 tx timeout [ 2796.180702][ T2117] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.21049'. [ 2796.234057][T19813] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2796.391197][T19813] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2796.542394][T19813] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2796.722636][T19813] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2796.881322][ T2149] netlink: 15487 bytes leftover after parsing attributes in process `syz.2.21058'. [ 2796.920423][ T2103] chnl_net:caif_netlink_parms(): no params data found [ 2797.449498][ T2103] bridge0: port 1(bridge_slave_0) entered blocking state [ 2797.457602][ T1800] Bluetooth: hci0: command 0x041b tx timeout [ 2797.479086][ T2103] bridge0: port 1(bridge_slave_0) entered disabled state [ 2797.495291][ T2103] device bridge_slave_0 entered promiscuous mode [ 2797.507345][ T2103] bridge0: port 2(bridge_slave_1) entered blocking state [ 2797.515212][ T2103] bridge0: port 2(bridge_slave_1) entered disabled state [ 2797.524696][ T2103] device bridge_slave_1 entered promiscuous mode [ 2797.589198][ T2103] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2797.639661][ T2103] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2797.785307][ T2103] team0: Port device team_slave_0 added [ 2797.819517][ T2103] team0: Port device team_slave_1 added [ 2797.971801][ T2103] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2797.986857][ T2103] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2798.046296][ T2103] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2798.149750][ T2103] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2798.157255][ T2103] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2798.183865][ T2103] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2798.321086][ T2103] device hsr_slave_0 entered promiscuous mode [ 2798.365589][ T2103] device hsr_slave_1 entered promiscuous mode [ 2798.381458][ T2103] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2798.390808][ T2103] Cannot create hsr debugfs directory [ 2799.539551][ T1800] Bluetooth: hci0: command 0x040f tx timeout [ 2801.623284][ T1800] Bluetooth: hci0: command 0x0419 tx timeout [ 2802.487482][ T2246] netlink: 'syz.3.21083': attribute type 3 has an invalid length. [ 2802.549279][ T2246] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.21083'. [ 2802.702207][T19813] device wlan1 left promiscuous mode [ 2802.787542][T19813] team0: Port device wlan1 removed [ 2803.218181][T19813] device hsr_slave_0 left promiscuous mode [ 2803.233790][T19813] device hsr_slave_1 left promiscuous mode [ 2803.247169][T19813] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2803.255324][T19813] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2803.276038][T19813] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2803.286765][T19813] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2803.294869][T19813] bridge0: port 4(dummy0) entered disabled state [ 2803.314167][T19813] bridge0: port 3(team0) entered disabled state [ 2803.334184][T19813] device bridge_slave_1 left promiscuous mode [ 2803.356918][T19813] bridge0: port 2(bridge_slave_1) entered disabled state [ 2803.391982][T19813] device bridge_slave_0 left promiscuous mode [ 2803.437013][T19813] bridge0: port 1(bridge_slave_0) entered disabled state [ 2803.840921][T19813] device geneve1 left promiscuous mode [ 2803.858362][T19813] team0 (unregistering): Port device geneve1 removed [ 2804.326405][T19813] device team_slave_1 left promiscuous mode [ 2804.333543][T19813] team0 (unregistering): Port device team_slave_1 removed [ 2804.382642][T19813] device team_slave_0 left promiscuous mode [ 2804.390946][T19813] team0 (unregistering): Port device team_slave_0 removed [ 2805.053491][ T2103] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 2805.086246][ T2103] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 2805.124996][ T2103] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 2805.220128][ T2103] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 2805.283912][ T2295] netlink: 'syz.0.21092': attribute type 29 has an invalid length. [ 2805.363581][ T2295] netlink: 'syz.0.21092': attribute type 29 has an invalid length. [ 2805.399536][ T2299] netlink: 'syz.0.21092': attribute type 29 has an invalid length. [ 2805.555361][ T2308] netlink: 'syz.2.21096': attribute type 1 has an invalid length. [ 2805.598398][ T2308] netlink: 'syz.2.21096': attribute type 1 has an invalid length. [ 2805.633416][ T2308] netlink: 116376 bytes leftover after parsing attributes in process `syz.2.21096'. [ 2805.640278][ T2103] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2805.698643][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 2805.715665][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2805.752529][ T2304] netlink: 'syz.0.21092': attribute type 29 has an invalid length. [ 2805.783014][ T2103] 8021q: adding VLAN 0 to HW filter on device team0 [ 2805.810514][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 2805.876077][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2805.917084][T19848] bridge0: port 1(bridge_slave_0) entered blocking state [ 2805.924331][T19848] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2805.972178][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 2806.010612][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 2806.034920][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2806.077982][T19848] bridge0: port 2(bridge_slave_1) entered blocking state [ 2806.085131][T19848] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2806.115502][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 2806.156187][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 2806.199946][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 2806.225741][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2806.243609][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2806.280414][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 2806.297781][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2806.330986][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 2806.347454][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2806.370529][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 2806.392079][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2806.411956][ T2103] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2807.041252][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 2807.058483][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2807.092481][ T2103] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2807.165905][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 2807.192156][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 2807.265677][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 2807.307099][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 2807.329019][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 2807.345697][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 2807.357724][ T2103] device veth0_vlan entered promiscuous mode [ 2807.432320][ T2103] device veth1_vlan entered promiscuous mode [ 2807.498350][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 2807.518607][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 2807.536107][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 2807.564652][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 2807.597354][ T2103] device veth0_macvtap entered promiscuous mode [ 2807.632313][ T2391] bond0: (slave wlan1): Error: Slave device does not support XDP [ 2807.704554][ T2103] device veth1_macvtap entered promiscuous mode [ 2807.760820][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2807.791732][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2807.811808][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2807.836886][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2807.855663][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2807.867322][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2807.879415][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2807.891138][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2807.908293][ T2103] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2807.929626][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 2807.944288][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 2807.955355][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 2807.968373][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 2807.984902][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2808.007019][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2808.026714][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2808.046708][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2808.066717][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2808.077746][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2808.092780][ T2103] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2808.116863][ T2103] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2808.138104][ T2103] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2808.158648][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 2808.190213][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 2808.219383][ T2103] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2808.254671][ T2103] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2808.279459][ T2103] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2808.320484][ T2103] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2808.584999][T19848] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2808.626788][T19848] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2808.703393][T19848] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 2808.722928][T19809] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2808.761294][T19809] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2808.800008][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 2810.043586][ T2486] netlink: 128 bytes leftover after parsing attributes in process `syz.3.21139'. [ 2810.053661][ T2486] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 2810.073111][ T2486] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2810.127157][ T2488] netlink: 132 bytes leftover after parsing attributes in process `syz.2.21140'. [ 2810.909372][ T2518] netlink: 'syz.2.21148': attribute type 46 has an invalid length. [ 2810.954068][ T2518] netlink: 55 bytes leftover after parsing attributes in process `syz.2.21148'. [ 2811.266546][ T2528] netlink: 'syz.2.21150': attribute type 11 has an invalid length. [ 2811.700814][ T2537] netlink: 122896 bytes leftover after parsing attributes in process `syz.1.21155'. [ 2811.780976][ T2537] debugfs: Directory '.!' with parent 'ieee80211' already present! [ 2811.945411][ T1800] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2811.956265][ T1800] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2811.965084][ T1800] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2811.974204][ T1800] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2811.983046][ T1800] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 2811.993340][ T1800] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2812.087471][ T2557] netlink: 14 bytes leftover after parsing attributes in process `syz.0.21159'. [ 2812.142417][ T2557] openvswitch: netlink: Message has 6 unknown bytes. [ 2812.272992][ T2564] netlink: 'syz.3.21160': attribute type 46 has an invalid length. [ 2812.309791][ T2564] netlink: 55 bytes leftover after parsing attributes in process `syz.3.21160'. [ 2812.337611][ T2566] bond0: (slave wlan1): Error: Slave device does not support XDP [ 2812.512874][ T2549] chnl_net:caif_netlink_parms(): no params data found [ 2812.744573][ T2549] bridge0: port 1(bridge_slave_0) entered blocking state [ 2812.785506][ T2549] bridge0: port 1(bridge_slave_0) entered disabled state [ 2812.822135][ T2549] device bridge_slave_0 entered promiscuous mode [ 2812.835282][ T2549] bridge0: port 2(bridge_slave_1) entered blocking state [ 2812.843321][ T2549] bridge0: port 2(bridge_slave_1) entered disabled state [ 2812.851657][ T2549] device bridge_slave_1 entered promiscuous mode [ 2812.888154][ T2549] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2812.915426][ T2549] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2812.945242][ T2549] team0: Port device team_slave_0 added [ 2812.955269][ T2549] team0: Port device team_slave_1 added [ 2812.972934][ T2549] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2812.980059][ T2549] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2813.006489][ T2549] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2813.018568][ T2549] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2813.025561][ T2549] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2813.051533][ T2549] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2813.081225][ T2549] device hsr_slave_0 entered promiscuous mode [ 2813.088324][ T2549] device hsr_slave_1 entered promiscuous mode [ 2813.094984][ T2549] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2813.103080][ T2549] Cannot create hsr debugfs directory [ 2813.200520][ T2549] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2813.209999][ T2549] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2813.220476][ T2549] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2813.229516][ T2549] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2813.251727][ T2549] bridge0: port 2(bridge_slave_1) entered blocking state [ 2813.258920][ T2549] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2813.266465][ T2549] bridge0: port 1(bridge_slave_0) entered blocking state [ 2813.273634][ T2549] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2813.319155][ T2549] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2813.331745][T19845] bridge0: port 1(bridge_slave_0) entered disabled state [ 2813.340524][T19845] bridge0: port 2(bridge_slave_1) entered disabled state [ 2813.351123][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 2813.363447][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 2813.371346][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 2813.382175][ T2549] 8021q: adding VLAN 0 to HW filter on device team0 [ 2813.396399][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 2813.408728][ T4145] bridge0: port 1(bridge_slave_0) entered blocking state [ 2813.415843][ T4145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2813.428979][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 2813.437832][T19845] bridge0: port 2(bridge_slave_1) entered blocking state [ 2813.444917][T19845] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2813.473173][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 2813.482741][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 2813.496170][T19845] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 2813.512503][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 2813.526095][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 2813.539174][ T2549] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 2813.695178][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 2813.705213][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 2813.722758][ T2549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2813.953569][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 2813.962648][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 2813.984514][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 2813.993342][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 2814.002811][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 2814.011750][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 2814.024884][ T2549] device veth0_vlan entered promiscuous mode [ 2814.031147][ T4272] Bluetooth: hci3: command 0x0409 tx timeout [ 2814.046019][ T2549] device veth1_vlan entered promiscuous mode [ 2814.067845][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 2814.076508][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 2814.084904][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 2814.093797][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 2814.105436][ T2549] device veth0_macvtap entered promiscuous mode [ 2814.120624][ T2549] device veth1_macvtap entered promiscuous mode [ 2814.137487][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2814.148521][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.158823][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2814.169871][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.180171][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2814.191277][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.201512][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2814.212583][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.222551][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2814.233332][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.244745][ T2549] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2814.254255][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 2814.264795][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 2814.273117][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 2814.282009][T19813] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 2814.292115][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2814.303007][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.313403][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2814.324585][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.334615][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2814.345278][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.355173][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2814.365804][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.375712][ T2549] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2814.386559][ T2549] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2814.398893][ T2549] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2814.408080][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 2814.418379][T19849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 2814.433572][ T2549] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2814.442437][ T2549] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2814.451649][ T2549] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2814.460550][ T2549] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2814.520876][T19849] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2814.533496][T19849] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2814.542172][ T4145] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 2814.562037][T19849] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2814.570965][T19849] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2814.581874][T19809] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 2816.096997][ T4272] Bluetooth: hci3: command 0x041b tx timeout [ 2818.176911][ T4272] Bluetooth: hci3: command 0x040f tx timeout [ 2820.267752][ T1800] Bluetooth: hci3: command 0x0419 tx timeout [ 2836.260950][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 2836.267759][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 2894.656789][ T4272] Bluetooth: hci5: command 0x0406 tx timeout [ 2897.700187][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 2897.706706][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 2920.256930][ T1800] Bluetooth: hci0: command 0x0406 tx timeout [ 2935.616891][ T4272] Bluetooth: hci3: command 0x0406 tx timeout [ 2957.857033][ T27] INFO: task syz.4.21055:2140 blocked for more than 143 seconds. [ 2957.865236][ T27] Not tainted syzkaller #0 [ 2957.876342][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2957.885606][ T27] task:syz.4.21055 state:D stack:25968 pid:2140 ppid:25155 flags:0x00004004 [ 2957.894946][ T27] Call Trace: [ 2957.898290][ T27] [ 2957.901286][ T27] __schedule+0x107f/0x4030 [ 2957.905850][ T27] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 2957.912121][ T27] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 2957.918371][ T27] ? __sched_text_start+0x8/0x8 [ 2957.923480][ T27] ? task_work_cancel+0xa1/0x220 [ 2957.940262][ T27] ? task_work_cancel_func+0x210/0x210 [ 2957.946290][ T27] ? irq_work_sync+0x26d/0x370 [ 2957.951403][ T27] schedule+0xb9/0x180 [ 2957.955602][ T27] ? _free_event+0x10d/0x1050 [ 2957.960342][ T27] _free_event+0x176/0x1050 [ 2957.965086][ T27] perf_event_release_kernel+0x7c4/0x850 [ 2957.971142][ T27] ? __might_sleep+0xd0/0xd0 [ 2957.975772][ T27] ? rcu_is_watching+0x11/0xa0 [ 2957.980638][ T27] ? calc_timer_values+0x410/0x410 [ 2957.986516][ T27] ? lockdep_hardirqs_on+0x94/0x140 [ 2957.991984][ T27] ? perf_mmap+0x1470/0x1470 [ 2957.996763][ T27] perf_release+0x37/0x40 [ 2958.001400][ T27] __fput+0x20a/0x8b0 [ 2958.005432][ T27] task_work_run+0x1d0/0x260 [ 2958.010218][ T27] ? task_work_cancel+0x220/0x220 [ 2958.015309][ T27] exit_to_user_mode_loop+0xe6/0x110 [ 2958.020923][ T27] exit_to_user_mode_prepare+0xee/0x180 [ 2958.026807][ T27] syscall_exit_to_user_mode+0x16/0x40 [ 2958.032375][ T27] do_syscall_64+0x58/0xa0 [ 2958.036889][ T27] ? clear_bhb_loop+0x60/0xb0 [ 2958.041728][ T27] ? clear_bhb_loop+0x60/0xb0 [ 2958.046455][ T27] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2958.052587][ T27] RIP: 0033:0x7f7cc859de99 [ 2958.057138][ T27] RSP: 002b:00007f7cc67d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 2958.065593][ T27] RAX: 0000000000000000 RBX: 00007f7cc8826090 RCX: 00007f7cc859de99 [ 2958.073740][ T27] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000a [ 2958.081794][ T27] RBP: 00007f7cc8633eaf R08: 0000000000000000 R09: 0000000000000000 [ 2958.091722][ T27] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2958.100012][ T27] R13: 00007f7cc8826128 R14: 00007f7cc8826090 R15: 00007ffdcaaa1f98 [ 2958.108194][ T27] [ 2958.111256][ T27] [ 2958.111256][ T27] Showing all locks held in the system: [ 2958.119064][ T27] 1 lock held by rcu_tasks_kthre/12: [ 2958.124361][ T27] #0: ffffffff8cb2e4f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 [ 2958.134912][ T27] 1 lock held by rcu_tasks_trace/13: [ 2958.140444][ T27] #0: ffffffff8cb2ed10 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 [ 2958.151518][ T27] 1 lock held by khungtaskd/27: [ 2958.156380][ T27] #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 [ 2958.166822][ T27] 2 locks held by getty/4026: [ 2958.171517][ T27] #0: ffff88814d419098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 [ 2958.181526][ T27] #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 [ 2958.192359][ T27] [ 2958.195869][ T27] ============================================= [ 2958.195869][ T27] [ 2958.204551][ T27] NMI backtrace for cpu 1 [ 2958.209195][ T27] CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 [ 2958.216412][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2958.226520][ T27] Call Trace: [ 2958.229832][ T27] [ 2958.232858][ T27] dump_stack_lvl+0x188/0x24e [ 2958.237649][ T27] ? show_regs_print_info+0x12/0x12 [ 2958.243524][ T27] ? load_image+0x410/0x410 [ 2958.248061][ T27] ? vprintk_emit+0x59f/0x6a0 [ 2958.254033][ T27] ? printk_sprint+0x460/0x460 [ 2958.259600][ T27] nmi_cpu_backtrace+0x3e6/0x460 [ 2958.265455][ T27] ? nmi_trigger_cpumask_backtrace+0x450/0x450 [ 2958.271640][ T27] ? _printk+0xda/0x130 [ 2958.275953][ T27] ? load_image+0x410/0x410 [ 2958.280480][ T27] ? load_image+0x410/0x410 [ 2958.285043][ T27] ? nmi_trigger_cpumask_backtrace+0xf3/0x450 [ 2958.291925][ T27] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 2958.298273][ T27] nmi_trigger_cpumask_backtrace+0x1d4/0x450 [ 2958.304473][ T27] watchdog+0xf0e/0xf50 [ 2958.308645][ T27] ? watchdog+0x1ed/0xf50 [ 2958.313095][ T27] kthread+0x29d/0x330 [ 2958.317251][ T27] ? hungtask_pm_notify+0x40/0x40 [ 2958.322276][ T27] ? kthread_blkcg+0xd0/0xd0 [ 2958.326862][ T27] ret_from_fork+0x1f/0x30 [ 2958.331314][ T27] [ 2958.335043][ T27] Sending NMI from CPU 1 to CPUs 0: [ 2958.340461][ C0] NMI backtrace for cpu 0 [ 2958.340473][ C0] CPU: 0 PID: 13007 Comm: kworker/0:8 Not tainted syzkaller #0 [ 2958.340488][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2958.340498][ C0] Workqueue: events_power_efficient wg_ratelimiter_gc_entries [ 2958.340602][ C0] RIP: 0010:kasan_check_range+0x84/0x290 [ 2958.340626][ C0] Code: 49 c1 e9 03 4b 8d 1c 21 49 89 df 4d 29 df 49 83 ff 10 7f 29 4d 85 ff 0f 84 38 01 00 00 4c 89 cb 48 f7 d3 4c 01 f3 41 80 3b 00 <0f> 85 86 01 00 00 49 ff c3 48 ff c3 75 ee e9 18 01 00 00 44 89 dd [ 2958.340640][ C0] RSP: 0018:ffffc90004027810 EFLAGS: 00000046 [ 2958.340652][ C0] RAX: 0000000000000001 RBX: ffffffffffffffff RCX: ffffffff8163fef5 [ 2958.340663][ C0] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b10320 [ 2958.340672][ C0] RBP: ffffc90004027a70 R08: ffffffff90b10327 R09: 1ffffffff2162064 [ 2958.340684][ C0] R10: dffffc0000000000 R11: fffffbfff2162064 R12: dffffc0000000001 [ 2958.340695][ C0] R13: ffff88802bee9e00 R14: 1ffffffff2162064 R15: 0000000000000001 [ 2958.340706][ C0] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 2958.340718][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2958.340729][ C0] CR2: 000055dccbbd1168 CR3: 000000000c88e000 CR4: 00000000003506f0 [ 2958.340743][ C0] DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000008d24 [ 2958.340753][ C0] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 2958.340762][ C0] Call Trace: [ 2958.340768][ C0] [ 2958.340775][ C0] __lock_acquire+0x5f5/0x7c40 [ 2958.340797][ C0] ? mark_lock+0x94/0x320 [ 2958.340816][ C0] ? __lock_acquire+0x1465/0x7c40 [ 2958.340838][ C0] ? verify_lock_unused+0x140/0x140 [ 2958.340861][ C0] ? mark_lock+0x94/0x320 [ 2958.340880][ C0] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 2958.340900][ C0] ? __lock_acquire+0x7c40/0x7c40 [ 2958.340920][ C0] lock_acquire+0x1bb/0x4a0 [ 2958.340938][ C0] ? wg_ratelimiter_gc_entries+0x59/0x450 [ 2958.340960][ C0] ? wg_ratelimiter_gc_entries+0x37e/0x450 [ 2958.340980][ C0] ? read_lock_is_recursive+0x10/0x10 [ 2958.340998][ C0] ? __lock_acquire+0x7c40/0x7c40 [ 2958.341017][ C0] ? __rwlock_init+0x140/0x140 [ 2958.341030][ C0] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 2958.341052][ C0] _raw_spin_lock+0x2a/0x40 [ 2958.341068][ C0] ? wg_ratelimiter_gc_entries+0x59/0x450 [ 2958.341087][ C0] wg_ratelimiter_gc_entries+0x59/0x450 [ 2958.341108][ C0] ? process_one_work+0x7b4/0x1160 [ 2958.341125][ C0] process_one_work+0x8ab/0x1160 [ 2958.341146][ C0] ? worker_detach_from_pool+0x240/0x240 [ 2958.341164][ C0] ? _raw_spin_lock_irq+0xb7/0xf0 [ 2958.341179][ C0] ? _raw_spin_lock_irqsave+0x100/0x100 [ 2958.341196][ C0] ? wq_worker_running+0x97/0x190 [ 2958.341218][ C0] worker_thread+0xaf5/0x12a0 [ 2958.341243][ C0] kthread+0x29d/0x330 [ 2958.341255][ C0] ? worker_clr_flags+0x1a0/0x1a0 [ 2958.341270][ C0] ? kthread_blkcg+0xd0/0xd0 [ 2958.341284][ C0] ret_from_fork+0x1f/0x30 [ 2958.341313][ C0] [ 2958.356714][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 2958.356731][ T27] CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 [ 2958.356748][ T27] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 2958.356758][ T27] Call Trace: [ 2958.356766][ T27] [ 2958.356774][ T27] dump_stack_lvl+0x188/0x24e [ 2958.356801][ T27] ? memcpy+0x3c/0x60 [ 2958.356819][ T27] ? show_regs_print_info+0x12/0x12 [ 2958.356840][ T27] ? load_image+0x410/0x410 [ 2958.356867][ T27] panic+0x2d3/0x710 [ 2958.356883][ T27] ? schedule_preempt_disabled+0x20/0x20 [ 2958.356908][ T27] ? bpf_jit_dump+0xd0/0xd0 [ 2958.356923][ T27] ? __irq_work_queue_local+0x12c/0x190 [ 2958.356947][ T27] ? nmi_trigger_cpumask_backtrace+0x35b/0x450 [ 2958.356970][ T27] ? nmi_trigger_cpumask_backtrace+0x360/0x450 [ 2958.356992][ T27] watchdog+0xf4d/0xf50 [ 2958.357014][ T27] ? watchdog+0x1ed/0xf50 [ 2958.357036][ T27] kthread+0x29d/0x330 [ 2958.357051][ T27] ? hungtask_pm_notify+0x40/0x40 [ 2958.357069][ T27] ? kthread_blkcg+0xd0/0xd0 [ 2958.357085][ T27] ret_from_fork+0x1f/0x30 [ 2958.357116][ T27] [ 2958.358908][ T27] Kernel Offset: disabled [ 2958.766739][ T27] Rebooting in 86400 seconds..