last executing test programs: 15.999519152s ago: executing program 0 (id=2494): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x16}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000002080)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0c000000040000000400000009"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0xffffffff, r1, 0x900000000000000}, 0x38) 15.863423192s ago: executing program 0 (id=2496): r0 = socket$kcm(0x2, 0x922000000001, 0x106) setsockopt$sock_attach_bpf(r0, 0x6, 0x9, &(0x7f0000000c40), 0x4) 3.514589198s ago: executing program 3 (id=2573): perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x9}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001780)={0x0, 0x0, 0x0}, 0xc0c0) recvmsg$unix(r0, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x17}, 0x12000) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_attach_bpf(r3, 0x10f, 0x8a, &(0x7f0000000180)=r2, 0x4) 3.259949765s ago: executing program 3 (id=2576): r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0xfffffffd, 0x8, 0x3fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa40c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff, 0x0, 0xfffffffffffffffd}, 0x0, 0x1, r0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x50) socket$kcm(0x2, 0x200000000000001, 0x106) socket$kcm(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0xf, 0x4, 0x8, 0xb}, 0x48) r1 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r1, 0x84, 0xd, &(0x7f0000000480), 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000000)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x57}}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2.450807445s ago: executing program 2 (id=2580): perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, @perf_config_ext={0x8, 0x830d}, 0x2010, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x1e, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x6, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xe, 0x5, &(0x7f0000000400)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r1}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x5, 0x9549, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, @perf_config_ext={0x4, 0x4}, 0x11efa, 0x4, 0x4000, 0x0, 0x2, 0x2, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000080)={r5, r4, 0x4, r4}, 0x10) sendmsg$kcm(r0, 0x0, 0x0) recvmsg$kcm(r0, 0x0, 0x0) close(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x1a, 0x11, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41000, 0x8}, 0x94) socket$kcm(0x10, 0x2, 0x4) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0), 0xc) socket$kcm(0xa, 0x1, 0x0) 2.155347701s ago: executing program 3 (id=2582): bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000500)={0x1, 0x0, 0x0}, 0x10) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xef, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4e381, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, @perf_config_ext={0xb, 0xffffffffffffffff}, 0x8, 0x0, 0x0, 0x5, 0x6, 0x6, 0x0, 0x0, 0x0, 0x0, 0x400200000000003b}, 0x0, 0x7fffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r0) socket$kcm(0x11, 0xa, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x500, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, 0x50) ioctl$TUNGETVNETLE(r0, 0x8953, &(0x7f0000000040)) 2.065152791s ago: executing program 2 (id=2583): r0 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r0, 0x84, 0xb, &(0x7f0000000000), 0xe) sendmsg$inet(r0, &(0x7f0000000ac0)={&(0x7f00000001c0)={0x2, 0x4e33, @rand_addr=0x64010102}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000680), 0x58}], 0x1}, 0x4008014) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext, 0x8093, 0x84, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) recvmsg(r0, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x1) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, &(0x7f0000000880)=[{&(0x7f0000000640)="a1", 0x1}], 0x1}, 0x80) 2.038515716s ago: executing program 1 (id=2584): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x3, 0xb, &(0x7f0000000780)=@framed={{0x18, 0x2, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x3}, [@printk={@p, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000680)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00, 0xa}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xce0, 0x0, &(0x7f0000000440)="e0b9547e841fd74eabc89b6f5b32", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 1.960011564s ago: executing program 3 (id=2585): perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0xaf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x1, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000740)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0xeaae}, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2688634c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 1.958994344s ago: executing program 1 (id=2586): perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x40000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x0, 0x5, 0x2, 0xffffffa1, 0xfffc, 0x0, 0x0, 0x0, 0xc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8927, &(0x7f0000000580)='lo:\x96o8\x14d\xa1\xba\xda\xd1\xa0J\x12tQ\xb16\xe3\xd7\\b\x8b\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\xff\xe6\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\xb7l\xed}\xe5\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x02\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2ak\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x01\x00\x00\x00\xd3\r7\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xd5s2\x9cVF\xd5\x18\xfe\x0f\x8f \x01\x00\x00\xb1\x88\xebW_\xa5\xe1\xf6\x8aj\xca\xf8m\xab\xe8\x99\xeb\xe1\xde\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\rh^J-\xd1\xfc\xfa 6(%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x1f\x9c,\x113\x7f\x03\x93\xe1\xcc\xe7f\r\xf3\xff0\f\x82%_\x92\x8b\xc4\xb9\xd9\xe7\xf2\xe4\xc1i\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02!\xed\xff\xee$\xc89\x8cB0\xd1\xa8\xd4\xe6K0\xe1\xa3TS\x18\xe6x\x1f%P\x9fU)\x83E\n\x90M\r.\x85gn_\xb2\xe9\x8a\x1c\xe3\x93\xd8\xbc\xb6N\xc3\xe1\xafh\xa0iF\xdcq\xf9\x17\xd9i\x844E\x1a\x13\x9a\xe6\xd3\xab:PM\xfbe\xfe9\xd9\x94\x1dx\xd6\x03b\xf7\x10N\xd1\x93\rU\x7fy\x18tE\xf1*\x9a0Z\x9f\xdc{\x13\xf6\xb7\xf7\xe6=\x9cD\x108\x8eS\xa0\xd0\xa7\tn\xd9\xae\xc0\x18~x[\x85Y\xb2\x82w\x150\x97\xba\xe6\xca\xb1\xa3\x02\x14^\xbdZ\xae\xf5/\xcf\xb8\xea8Uw\x92`\"2\x81j\xbb\x87+\x89\xc50xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x89ff, &(0x7f0000000900)={'ip6tnl0\x00', @random="0600002000"}) 1.301185361s ago: executing program 1 (id=2588): r0 = getpid() r1 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_bp={0x0, 0x7}, 0x11efa, 0x4, 0x98, 0x0, 0x4, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0x68000000}, 0x0) r3 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x9, @private1}}, 0xa0, 0x0, 0x0, &(0x7f0000000180)=ANY=[], 0x18, 0x68000000}, 0x80fe) 1.060056784s ago: executing program 3 (id=2589): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r1) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETCARRIER(r0, 0x400454e2, &(0x7f0000000100)) ioctl$TUNSETLINK(r0, 0x400454cd, 0x308) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00'}) 1.059690164s ago: executing program 2 (id=2590): r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0xfffffffd, 0x8, 0x3fe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000140)={0x0, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0xa40c8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0xffff, 0x0, 0xfffffffffffffffd}, 0x0, 0x1, r0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x830d}, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r1, 0x6, 0x17, 0x0, 0x0) 1.059602904s ago: executing program 0 (id=2497): socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) sendmsg$tipc(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000}, 0x800) sendmsg$sock(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000380)='1UB', 0x5dc}], 0x1}, 0x1) 975.215733ms ago: executing program 1 (id=2591): r0 = perf_event_open(&(0x7f0000000300)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, @perf_bp={0x0, 0xc}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r2, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(r1, 0x401054d5, 0x0) 910.330348ms ago: executing program 2 (id=2592): socket$kcm(0xa, 0x2, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, 0x0) close(0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0xa, 0x73) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2673004c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x100002, 0x0) write$cgroup_type(r3, 0x0, 0x0) recvmsg$unix(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x5, 0x0, &(0x7f0000000640)="b9ff030768", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x50) 795.989573ms ago: executing program 0 (id=2593): openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, 0x0, 0x0) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x8, 0xd, 0x4000003, 0x8000000, 0x7}, 0x0, 0xfffffffffffffffb, 0xffffffffffffffff, 0x1) r1 = socket$kcm(0xf, 0x3, 0x2) write$cgroup_devices(r1, &(0x7f0000000080)=ANY=[], 0xfefb) 578.003641ms ago: executing program 1 (id=2595): r0 = socket$kcm(0xa, 0x1, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x1a, &(0x7f0000000040), 0x4) 555.908186ms ago: executing program 0 (id=2596): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x50, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x6, 0xc}, 0x104046, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0xa}, 0x114244, 0x0, 0xafe8, 0x4, 0x7fff, 0x7fffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="0d2e0020fdcc6177d93790ff", @ANYRES32, @ANYBLOB='\b'], 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r0, 0x27, 0x14, 0x0, &(0x7f0000000000)="f8ad1dcc02cb29dcc80032008100", 0x0, 0x4000, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) 456.072048ms ago: executing program 2 (id=2597): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1d, 0x4, &(0x7f00000002c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0xeffffffc}, [@call={0x85, 0x0, 0x0, 0x5e}]}, &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @lsm=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 330.655536ms ago: executing program 1 (id=2598): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110c230000) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1980, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230007) r2 = getpid() r3 = perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0, 0x1}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r2, 0xff7fffffffffffff, 0xffffffffffffffff, 0x9) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) close(r1) 183.583019ms ago: executing program 2 (id=2599): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000680)=""/151, 0x97}], 0x1, 0xfffffffffffffffe}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001a40)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, @perf_config_ext={0x4612, 0xffffffffffffffff}, 0x114105, 0x6, 0x6, 0x5, 0x1, 0x40000, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) close(r1) 0s ago: executing program 0 (id=2600): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12003, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x401, 0x6}, 0x120, 0xf, 0x0, 0x0, 0x0, 0x3ff, 0x3, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r2) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000006c0)={@fallback, 0x4, 0x0, 0xba9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) kernel console output (not intermixed with test programs): b555e98e [ 213.685576][ T8681] RDX: 000000000000000f RSI: 00007f10b643a0a0 RDI: 0000000000000008 [ 213.685587][ T8681] RBP: 00007f10b643a090 R08: 0000000000000000 R09: 0000000000000000 [ 213.685597][ T8681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 213.685607][ T8681] R13: 00007f10b5826038 R14: 00007f10b5825fa0 R15: 00007ffd830f4d78 [ 213.685638][ T8681] [ 214.099186][ T8685] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.916'. [ 214.108508][ T8685] bridge_slave_1: default FDB implementation only supports local addresses [ 214.565291][ T8705] netlink: 40 bytes leftover after parsing attributes in process `syz.3.924'. [ 214.968309][ T8717] netlink: 'syz.3.929': attribute type 29 has an invalid length. [ 214.984201][ T8717] netlink: 'syz.3.929': attribute type 29 has an invalid length. [ 215.019924][ T8717] netlink: 'syz.3.929': attribute type 29 has an invalid length. [ 215.040604][ T8717] netlink: 'syz.3.929': attribute type 29 has an invalid length. [ 215.080465][ T8717] netlink: 'syz.3.929': attribute type 29 has an invalid length. [ 215.302392][ T8728] IPv6: NLM_F_CREATE should be specified when creating new route [ 215.581553][ T8733] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.937'. [ 215.817979][ T8753] netlink: 1030 bytes leftover after parsing attributes in process `syz.2.943'. [ 215.859495][ T8753] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 215.900168][ T8753] netlink: 1030 bytes leftover after parsing attributes in process `syz.2.943'. [ 215.922340][ T8753] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 216.885311][ T8789] syz.0.957 uses obsolete (PF_INET,SOCK_PACKET) [ 217.287484][ T8804] ±ÿ: renamed from lo (while UP) [ 218.084354][ T8831] netlink: 55 bytes leftover after parsing attributes in process `syz.1.972'. [ 218.894956][ T8840] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 218.906564][ T8840] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 218.925876][ T8840] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 218.941921][ T8840] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 219.366662][ T8853] validate_nla: 33 callbacks suppressed [ 219.366706][ T8853] netlink: 'syz.0.978': attribute type 29 has an invalid length. [ 219.395477][ T8853] netlink: 'syz.0.978': attribute type 29 has an invalid length. [ 219.419153][ T8860] netlink: 'syz.0.978': attribute type 29 has an invalid length. [ 219.748616][ T8866] netlink: 'syz.0.978': attribute type 29 has an invalid length. [ 222.121022][ T8882] bridge0: port 1(bridge_slave_0) entered disabled state [ 222.352257][ T8909] netlink: 'syz.2.994': attribute type 41 has an invalid length. [ 222.368465][ T8905] netlink: 'syz.3.993': attribute type 29 has an invalid length. [ 222.472485][ T8905] netlink: 'syz.3.993': attribute type 29 has an invalid length. [ 222.546052][ T8906] netlink: 'syz.3.993': attribute type 29 has an invalid length. [ 222.557787][ T8913] netlink: 'syz.0.995': attribute type 29 has an invalid length. [ 222.606457][ T8913] netlink: 'syz.0.995': attribute type 29 has an invalid length. [ 222.694298][ T8920] FAULT_INJECTION: forcing a failure. [ 222.694298][ T8920] name failslab, interval 1, probability 0, space 0, times 0 [ 222.707233][ T8920] CPU: 1 PID: 8920 Comm: syz.3.998 Not tainted syzkaller #0 [ 222.714567][ T8920] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 222.724667][ T8920] Call Trace: [ 222.727993][ T8920] [ 222.730967][ T8920] dump_stack_lvl+0x18c/0x250 [ 222.735694][ T8920] ? show_regs_print_info+0x20/0x20 [ 222.740941][ T8920] ? load_image+0x420/0x420 [ 222.745507][ T8920] ? __might_sleep+0xe0/0xe0 [ 222.750139][ T8920] ? __lock_acquire+0x7d80/0x7d80 [ 222.755654][ T8920] should_fail_ex+0x394/0x4c0 [ 222.760387][ T8920] should_failslab+0x9/0x20 [ 222.764949][ T8920] slab_pre_alloc_hook+0x59/0x300 [ 222.770029][ T8920] ? sock_kmalloc+0x96/0xf0 [ 222.774556][ T8920] ? sock_kmalloc+0x96/0xf0 [ 222.779059][ T8920] __kmem_cache_alloc_node+0x53/0x250 [ 222.784448][ T8920] ? sock_kmalloc+0x96/0xf0 [ 222.788961][ T8920] __kmalloc+0xa7/0x240 [ 222.793125][ T8920] sock_kmalloc+0x96/0xf0 [ 222.797458][ T8920] ____sys_sendmsg+0x1d4/0x980 [ 222.802228][ T8920] ? __asan_memset+0x22/0x40 [ 222.806823][ T8920] ? __sys_sendmsg_sock+0x30/0x30 [ 222.811892][ T8920] ? __import_iovec+0x5f2/0x850 [ 222.816785][ T8920] ? import_iovec+0x73/0xa0 [ 222.821312][ T8920] ___sys_sendmsg+0x2a6/0x360 [ 222.826007][ T8920] ? get_pid_task+0x20/0x1e0 [ 222.830617][ T8920] ? __sys_sendmsg+0x2b0/0x2b0 [ 222.835414][ T8920] ? __lock_acquire+0x7d80/0x7d80 [ 222.840471][ T8920] __se_sys_sendmsg+0x1d0/0x2c0 [ 222.845425][ T8920] ? __x64_sys_sendmsg+0x80/0x80 [ 222.850394][ T8920] ? lockdep_hardirqs_on+0x98/0x150 [ 222.855605][ T8920] do_syscall_64+0x55/0xb0 [ 222.860036][ T8920] ? clear_bhb_loop+0x40/0x90 [ 222.864726][ T8920] ? clear_bhb_loop+0x40/0x90 [ 222.869424][ T8920] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 222.875330][ T8920] RIP: 0033:0x7fad2c79e159 [ 222.879760][ T8920] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 222.899378][ T8920] RSP: 002b:00007fad2d73e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 222.908196][ T8920] RAX: ffffffffffffffda RBX: 00007fad2ca25fa0 RCX: 00007fad2c79e159 [ 222.916216][ T8920] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 222.924228][ T8920] RBP: 00007fad2d73e090 R08: 0000000000000000 R09: 0000000000000000 [ 222.932210][ T8920] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 222.940190][ T8920] R13: 00007fad2ca26038 R14: 00007fad2ca25fa0 R15: 00007fffefce0768 [ 222.948197][ T8920] [ 223.121478][ T8924] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.999'. [ 223.484428][ T8940] team0: Device wg1 is of different type [ 223.921696][ T8959] sock: sock_set_timeout: `syz.0.1013' (pid 8959) tries to set negative timeout [ 224.045362][ T5787] Bluetooth: hci3: unexpected event 0x0f length: 151 > 4 [ 224.058235][ T8964] team0: Device wg1 is of different type [ 224.231014][ T8972] netlink: 140 bytes leftover after parsing attributes in process `syz.0.1016'. [ 224.265547][ T8972] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1016'. [ 224.287983][ T8972] bond0: (slave bond_slave_0): Releasing backup interface [ 224.325827][ T8972] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 224.473043][ T8977] syzkaller0: entered promiscuous mode [ 224.483306][ T8977] syzkaller0: entered allmulticast mode [ 228.090508][ T5787] Bluetooth: hci3: Controller not accepting commands anymore: ncmd = 0 [ 228.100548][ T5787] Bluetooth: hci3: Injecting HCI hardware error event [ 228.108809][ T5783] Bluetooth: hci3: hardware error 0x00 [ 229.241303][ T8985] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.1021'. [ 229.250654][ T8985] bridge_slave_1: default FDB implementation only supports local addresses [ 229.361179][ T9000] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1025'. [ 229.427701][ T9003] validate_nla: 12 callbacks suppressed [ 229.427800][ T9003] netlink: 'syz.2.1028': attribute type 10 has an invalid length. [ 229.443523][ T9003] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1028'. [ 229.455321][ T9003] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 229.902277][ T9020] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 229.910061][ T9020] IPv6: NLM_F_CREATE should be set when creating new route [ 229.918169][ T9020] IPv6: NLM_F_CREATE should be set when creating new route [ 229.925898][ T9020] IPv6: NLM_F_CREATE should be set when creating new route [ 230.015943][ T9021] netlink: 144316 bytes leftover after parsing attributes in process `syz.0.1034'. [ 230.249366][ T5783] Bluetooth: hci3: Opcode 0x0c03 failed: -110 [ 230.375200][ T9031] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1036'. [ 230.457902][ T9035] netlink: 'syz.0.1038': attribute type 19 has an invalid length. [ 230.840547][ T9049] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 230.848493][ T9049] IPv6: NLM_F_CREATE should be set when creating new route [ 230.856942][ T9049] IPv6: NLM_F_CREATE should be set when creating new route [ 230.865001][ T9049] IPv6: NLM_F_CREATE should be set when creating new route [ 230.927957][ T9055] netlink: 'syz.0.1048': attribute type 21 has an invalid length. [ 232.258226][ T9084] netlink: 'syz.2.1059': attribute type 10 has an invalid length. [ 232.269994][ T9084] team0: Device wg1 is of different type [ 232.396484][ T9088] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 232.489790][ T9093] bridge0: port 1(bridge_slave_0) entered disabled state [ 232.854358][ T9110] syzkaller0: entered promiscuous mode [ 232.860047][ T9110] syzkaller0: entered allmulticast mode [ 232.882411][ T9110] netlink: 209592 bytes leftover after parsing attributes in process `syz.1.1066'. [ 234.770339][ T9115] netlink: 'syz.2.1069': attribute type 10 has an invalid length. [ 234.823373][ T5783] Bluetooth: hci2: ISO packet for unknown connection handle 62 [ 235.022271][ T9122] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1072'. [ 235.243996][ T9129] netlink: 10 bytes leftover after parsing attributes in process `syz.2.1070'. [ 237.254555][ T9161] FAULT_INJECTION: forcing a failure. [ 237.254555][ T9161] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 237.278227][ T9161] CPU: 1 PID: 9161 Comm: syz.3.1086 Not tainted syzkaller #0 [ 237.285861][ T9161] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 237.296142][ T9161] Call Trace: [ 237.299452][ T9161] [ 237.302418][ T9161] dump_stack_lvl+0x18c/0x250 [ 237.307145][ T9161] ? show_regs_print_info+0x20/0x20 [ 237.312389][ T9161] ? load_image+0x420/0x420 [ 237.316934][ T9161] ? __might_fault+0xaa/0x120 [ 237.322219][ T9161] ? __lock_acquire+0x7d80/0x7d80 [ 237.327297][ T9161] ? __virt_addr_valid+0x10c/0x380 [ 237.332464][ T9161] should_fail_ex+0x394/0x4c0 [ 237.337280][ T9161] _copy_from_user+0x2f/0xe0 [ 237.341912][ T9161] ____sys_sendmsg+0x329/0x980 [ 237.346739][ T9161] ? __sys_sendmsg_sock+0x30/0x30 [ 237.351991][ T9161] ? __import_iovec+0x5f2/0x850 [ 237.356953][ T9161] ? import_iovec+0x73/0xa0 [ 237.361771][ T9161] ___sys_sendmsg+0x2a6/0x360 [ 237.366489][ T9161] ? get_pid_task+0x20/0x1e0 [ 237.371312][ T9161] ? __sys_sendmsg+0x2b0/0x2b0 [ 237.376146][ T9161] ? __lock_acquire+0x7d80/0x7d80 [ 237.381211][ T9161] __se_sys_sendmsg+0x1d0/0x2c0 [ 237.386086][ T9161] ? __x64_sys_sendmsg+0x80/0x80 [ 237.391053][ T9161] ? lockdep_hardirqs_on+0x98/0x150 [ 237.396275][ T9161] do_syscall_64+0x55/0xb0 [ 237.400713][ T9161] ? clear_bhb_loop+0x40/0x90 [ 237.405404][ T9161] ? clear_bhb_loop+0x40/0x90 [ 237.410102][ T9161] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 237.416007][ T9161] RIP: 0033:0x7fad2c79e159 [ 237.420436][ T9161] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 237.440060][ T9161] RSP: 002b:00007fad2d73e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 237.448496][ T9161] RAX: ffffffffffffffda RBX: 00007fad2ca25fa0 RCX: 00007fad2c79e159 [ 237.456488][ T9161] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 237.464470][ T9161] RBP: 00007fad2d73e090 R08: 0000000000000000 R09: 0000000000000000 [ 237.473326][ T9161] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 237.481406][ T9161] R13: 00007fad2ca26038 R14: 00007fad2ca25fa0 R15: 00007fffefce0768 [ 237.489712][ T9161] [ 237.586527][ T9171] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1090'. [ 238.425669][ T9185] netlink: 'syz.3.1095': attribute type 29 has an invalid length. [ 238.427846][ T9187] netlink: 'syz.0.1096': attribute type 29 has an invalid length. [ 238.441417][ T9185] netlink: 'syz.3.1095': attribute type 29 has an invalid length. [ 238.455683][ T9192] netlink: 'syz.3.1095': attribute type 29 has an invalid length. [ 238.466146][ T9185] netlink: 'syz.3.1095': attribute type 29 has an invalid length. [ 238.488872][ T9187] netlink: 'syz.0.1096': attribute type 29 has an invalid length. [ 238.517219][ T9185] FAULT_INJECTION: forcing a failure. [ 238.517219][ T9185] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 238.526118][ T9193] netlink: 'syz.0.1096': attribute type 29 has an invalid length. [ 238.549097][ T9185] CPU: 1 PID: 9185 Comm: syz.3.1095 Not tainted syzkaller #0 [ 238.556655][ T9185] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 238.557358][ T9194] netlink: 'syz.0.1096': attribute type 29 has an invalid length. [ 238.567010][ T9185] Call Trace: [ 238.567023][ T9185] [ 238.567032][ T9185] dump_stack_lvl+0x18c/0x250 [ 238.567067][ T9185] ? show_regs_print_info+0x20/0x20 [ 238.567092][ T9185] ? load_image+0x420/0x420 [ 238.567117][ T9185] ? __might_fault+0xaa/0x120 [ 238.567138][ T9185] ? __lock_acquire+0x7d80/0x7d80 [ 238.567166][ T9185] should_fail_ex+0x394/0x4c0 [ 238.610587][ T9185] _copy_from_user+0x2f/0xe0 [ 238.615331][ T9185] ___sys_recvmsg+0x174/0x590 [ 238.620086][ T9185] ? __sys_recvmsg+0x2a0/0x2a0 [ 238.624912][ T9185] ? __fget_files+0x3fc/0x460 [ 238.629627][ T9185] __x64_sys_recvmsg+0x21e/0x2f0 [ 238.634608][ T9185] ? perf_trace_preemptirq_template+0x269/0x330 [ 238.640870][ T9185] ? ___sys_recvmsg+0x590/0x590 [ 238.645752][ T9185] ? lockdep_hardirqs_on+0x98/0x150 [ 238.651078][ T9185] do_syscall_64+0x55/0xb0 [ 238.655548][ T9185] ? clear_bhb_loop+0x40/0x90 [ 238.660413][ T9185] ? clear_bhb_loop+0x40/0x90 [ 238.665109][ T9185] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 238.671029][ T9185] RIP: 0033:0x7fad2c79e159 [ 238.675463][ T9185] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.695180][ T9185] RSP: 002b:00007fad2d73e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 238.703722][ T9185] RAX: ffffffffffffffda RBX: 00007fad2ca25fa0 RCX: 00007fad2c79e159 [ 238.711882][ T9185] RDX: 0000000000010002 RSI: 0000200000000780 RDI: 0000000000000008 [ 238.720042][ T9185] RBP: 00007fad2d73e090 R08: 0000000000000000 R09: 0000000000000000 [ 238.728111][ T9185] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 238.736098][ T9185] R13: 00007fad2ca26038 R14: 00007fad2ca25fa0 R15: 00007fffefce0768 [ 238.744216][ T9185] [ 238.794710][ T9187] netlink: 'syz.0.1096': attribute type 29 has an invalid length. [ 238.939861][ T9200] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 238.985260][ T9205] netdevsim netdevsim0 ÿÿÿÿÿÿ: renamed from netdevsim0 (while UP) [ 239.046092][ T9210] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1104'. [ 240.073767][ T9228] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1107'. [ 241.235076][ T9250] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1117'. [ 241.271478][ T9250] validate_nla: 2 callbacks suppressed [ 241.271497][ T9250] netlink: 'syz.3.1117': attribute type 3 has an invalid length. [ 241.299252][ T9250] netlink: 130984 bytes leftover after parsing attributes in process `syz.3.1117'. [ 241.937645][ T9263] delete_channel: no stack [ 241.948548][ T9272] netlink: 'syz.1.1126': attribute type 10 has an invalid length. [ 241.972091][ T9272] veth0_macvtap: left promiscuous mode [ 242.349416][ T9287] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1131'. [ 242.520344][ T9296] netlink: 180 bytes leftover after parsing attributes in process `syz.3.1134'. [ 242.890860][ T9312] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.1142'. [ 242.894666][ T9317] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1143'. [ 242.939176][ T9312] bridge_slave_1: default FDB implementation only supports local addresses [ 243.202522][ T5783] Bluetooth: hci0: ISO packet for unknown connection handle 62 [ 243.729490][ T9336] netlink: 'syz.2.1150': attribute type 6 has an invalid length. [ 243.775793][ T9336] netlink: 'syz.2.1150': attribute type 1 has an invalid length. [ 243.835511][ T9343] raw_sendmsg: syz.3.1152 forgot to set AF_INET. Fix it! [ 243.852446][ T9336] netlink: 165396 bytes leftover after parsing attributes in process `syz.2.1150'. [ 243.909707][ T9344] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1146'. [ 244.509022][ T9349] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.1154'. [ 244.865565][ T9373] netlink: 'syz.2.1163': attribute type 21 has an invalid length. [ 245.830899][ T9411] netlink: 'syz.2.1174': attribute type 46 has an invalid length. [ 246.042162][ T9414] syzkaller0: entered promiscuous mode [ 246.047737][ T9414] syzkaller0: entered allmulticast mode [ 246.264035][ T9423] netlink: 105120 bytes leftover after parsing attributes in process `syz.3.1178'. [ 246.289092][ T9423] netlink: 'syz.3.1178': attribute type 2 has an invalid length. [ 248.929220][ T9485] netlink: 'syz.2.1199': attribute type 39 has an invalid length. [ 248.946174][ T9482] €Â0: renamed from batadv_slave_1 (while UP) [ 249.242306][ T9498] netlink: 'syz.3.1203': attribute type 17 has an invalid length. [ 249.255325][ T9498] netlink: 'syz.3.1203': attribute type 16 has an invalid length. [ 249.263549][ T9498] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1203'. [ 252.246947][ T9509] netlink: 'syz.1.1205': attribute type 1 has an invalid length. [ 252.256558][ T9509] netlink: 112860 bytes leftover after parsing attributes in process `syz.1.1205'. [ 252.267501][ T9509] netlink: 'syz.1.1205': attribute type 1 has an invalid length. [ 252.347357][ T9513] netlink: 'syz.3.1207': attribute type 10 has an invalid length. [ 252.372411][ T9513] team0: Device wg1 is of different type [ 253.087157][ T9537] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.1214'. [ 253.634047][ T9541] netlink: 'syz.0.1215': attribute type 29 has an invalid length. [ 253.653720][ T9541] netlink: 'syz.0.1215': attribute type 29 has an invalid length. [ 253.667472][ T9548] netlink: 'syz.0.1215': attribute type 29 has an invalid length. [ 253.684599][ T9541] netlink: 'syz.0.1215': attribute type 29 has an invalid length. [ 253.728254][ T9541] netlink: 'syz.0.1215': attribute type 29 has an invalid length. [ 253.945221][ T9557] netlink: 279 bytes leftover after parsing attributes in process `syz.1.1218'. [ 254.656105][ T9579] netlink: 'syz.3.1229': attribute type 10 has an invalid length. [ 254.672091][ T9579] team0: Device vxcan1 is of different type [ 255.651961][ T9603] netlink: 'syz.0.1237': attribute type 2 has an invalid length. [ 255.695162][ T9603] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1237'. [ 256.097445][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.105573][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.264365][ T9610] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1241'. [ 256.318493][ T9612] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1241'. [ 258.265179][ T9662] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1259'. [ 258.521899][ T9667] C: renamed from team_slave_0 (while UP) [ 258.551010][ T9667] validate_nla: 1 callbacks suppressed [ 258.551027][ T9667] netlink: 'syz.2.1260': attribute type 8 has an invalid length. [ 258.609180][ T9667] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 258.675293][ T9667] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 258.852684][ T9675] netlink: 'syz.1.1264': attribute type 10 has an invalid length. [ 258.882403][ T9675] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1264'. [ 258.934201][ T9675] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 259.665556][ T9700] netlink: 'syz.3.1275': attribute type 21 has an invalid length. [ 260.469559][ T9722] netlink: 'syz.3.1282': attribute type 10 has an invalid length. [ 260.495237][ T9722] netlink: 185900 bytes leftover after parsing attributes in process `syz.3.1282'. [ 260.791736][ T9729] netlink: 'syz.3.1285': attribute type 10 has an invalid length. [ 260.814552][ T9729] team0: Device wg1 is of different type [ 261.011691][ T9735] netlink: 'syz.3.1286': attribute type 46 has an invalid length. [ 261.209544][ T8392] wlan1: Trigger new scan to find an IBSS to join [ 262.053356][ T9757] netlink: 'syz.1.1293': attribute type 15 has an invalid length. [ 262.089028][ T9757] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1293'. [ 262.168277][ T9757] netlink: 'syz.1.1293': attribute type 15 has an invalid length. [ 262.212352][ T9757] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1293'. [ 262.264309][ T9757] netlink: 'syz.1.1293': attribute type 15 has an invalid length. [ 262.264570][ T9763] netlink: 'syz.3.1295': attribute type 9 has an invalid length. [ 262.274415][ T9757] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1293'. [ 262.296888][ T9763] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.1295'. [ 262.341082][ T9757] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1293'. [ 262.373815][ T9757] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1293'. [ 262.421558][ T9757] netlink: 16098 bytes leftover after parsing attributes in process `syz.1.1293'. [ 264.284185][ T8410] wlan1: Trigger new scan to find an IBSS to join [ 265.399557][ T9808] __nla_validate_parse: 59 callbacks suppressed [ 265.399580][ T9808] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1309'. [ 265.442114][ T9814] validate_nla: 63 callbacks suppressed [ 265.442136][ T9814] netlink: 'syz.0.1309': attribute type 46 has an invalid length. [ 265.456701][ T9814] netlink: 'syz.0.1309': attribute type 46 has an invalid length. [ 265.469266][ T9813] netlink: 'syz.3.1310': attribute type 39 has an invalid length. [ 266.225860][ T5783] Bluetooth: hci2: unexpected subevent 0x01 length: 150 > 18 [ 266.804250][ T9847] netlink: 'syz.1.1323': attribute type 29 has an invalid length. [ 266.818188][ T9847] netlink: 'syz.1.1323': attribute type 29 has an invalid length. [ 266.872813][ T9856] netlink: 'syz.1.1323': attribute type 29 has an invalid length. [ 266.981194][ T9857] netlink: 'syz.1.1323': attribute type 29 has an invalid length. [ 267.062518][ T9847] netlink: 'syz.1.1323': attribute type 29 has an invalid length. [ 267.211856][ T3439] wlan1: Creating new IBSS network, BSSID 1a:45:f2:42:29:58 [ 267.339490][ T9864] netlink: 'syz.0.1328': attribute type 10 has an invalid length. [ 267.389624][ T9864] team0: Device wg1 is of different type [ 269.461837][ T9909] IPv6: NLM_F_CREATE should be specified when creating new route [ 269.502815][ T9909] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1341'. [ 269.973751][ T9916] netlink: 65185 bytes leftover after parsing attributes in process `syz.3.1343'. [ 270.139313][ T9921] netlink: 'syz.0.1344': attribute type 10 has an invalid length. [ 270.149864][ T9921] FAULT_INJECTION: forcing a failure. [ 270.149864][ T9921] name failslab, interval 1, probability 0, space 0, times 0 [ 270.163058][ T9921] CPU: 0 PID: 9921 Comm: syz.0.1344 Not tainted syzkaller #0 [ 270.170494][ T9921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 270.180678][ T9921] Call Trace: [ 270.184071][ T9921] [ 270.187130][ T9921] dump_stack_lvl+0x18c/0x250 [ 270.191888][ T9921] ? show_regs_print_info+0x20/0x20 [ 270.197127][ T9921] ? load_image+0x420/0x420 [ 270.201662][ T9921] ? __might_sleep+0xe0/0xe0 [ 270.206284][ T9921] ? __lock_acquire+0x7d80/0x7d80 [ 270.211340][ T9921] should_fail_ex+0x394/0x4c0 [ 270.216140][ T9921] should_failslab+0x9/0x20 [ 270.220701][ T9921] slab_pre_alloc_hook+0x59/0x300 [ 270.225761][ T9921] kmem_cache_alloc_lru+0x4d/0x2b0 [ 270.230921][ T9921] ? sock_alloc_inode+0x28/0xc0 [ 270.235917][ T9921] sock_alloc_inode+0x28/0xc0 [ 270.240616][ T9921] ? sockfs_init_fs_context+0xb0/0xb0 [ 270.246015][ T9921] new_inode_pseudo+0x63/0x1d0 [ 270.250810][ T9921] __sock_create+0x12d/0x940 [ 270.255466][ T9921] udp_sock_create6+0xd3/0x650 [ 270.260275][ T9921] ? inet6_hash+0x80/0x80 [ 270.264628][ T9921] ? rcu_read_lock_any_held+0xb4/0x140 [ 270.270224][ T9921] wg_socket_init+0x698/0xb10 [ 270.275009][ T9921] ? wg_socket_init+0x1b4/0xb10 [ 270.279889][ T9921] ? wg_socket_clear_peer_endpoint_src+0x50/0x50 [ 270.286241][ T9921] ? wg_socket_init+0xb10/0xb10 [ 270.291115][ T9921] ? __mutex_lock+0x30d/0xc80 [ 270.295816][ T9921] ? ib_device_get_by_netdev+0x82/0x4f0 [ 270.301403][ T9921] ? mutex_lock_nested+0x20/0x20 [ 270.306383][ T9921] wg_open+0x24f/0x420 [ 270.310496][ T9921] ? wg_newlink+0x720/0x720 [ 270.315200][ T9921] __dev_open+0x2cb/0x430 [ 270.319560][ T9921] ? dev_open+0x190/0x190 [ 270.323935][ T9921] ? ref_tracker_dir_exit+0x510/0x510 [ 270.329436][ T9921] dev_open+0xab/0x190 [ 270.333531][ T9921] ? netdev_notify_peers+0x180/0x180 [ 270.338939][ T9921] ? team_add_slave+0x2a2/0x28a0 [ 270.343939][ T9921] ? rcu_is_watching+0x15/0xb0 [ 270.348828][ T9921] ? team_add_slave+0x2a2/0x28a0 [ 270.353792][ T9921] ? __kmalloc+0xe5/0x240 [ 270.358157][ T9921] team_add_slave+0x703/0x28a0 [ 270.363068][ T9921] ? team_netpoll_cleanup+0xf0/0xf0 [ 270.368319][ T9921] ? __dev_change_flags+0x4d2/0x6a0 [ 270.373568][ T9921] ? dev_get_flags+0x1c0/0x1c0 [ 270.378446][ T9921] ? printk_sprint+0x460/0x460 [ 270.383236][ T9921] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 270.389160][ T9921] ? mutex_is_locked+0x12/0x40 [ 270.393951][ T9921] do_setlink+0xcde/0x3f40 [ 270.398421][ T9921] ? load_image+0x420/0x420 [ 270.402959][ T9921] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 270.409137][ T9921] ? stack_trace_save+0xaa/0x100 [ 270.414185][ T9921] ? stack_trace_snprint+0xf0/0xf0 [ 270.419379][ T9921] ? __nla_validate+0x50/0x50 [ 270.424165][ T9921] ? validate_linkmsg+0x719/0x910 [ 270.429233][ T9921] rtnl_newlink+0x1848/0x2170 [ 270.433985][ T9921] ? rtnl_newlink+0x4a1/0x2170 [ 270.438792][ T9921] ? rtnl_setlink+0x4e0/0x4e0 [ 270.443585][ T9921] ? __rwlock_init+0x150/0x150 [ 270.448413][ T9921] ? do_raw_spin_unlock+0x121/0x230 [ 270.453672][ T9921] ? __mutex_lock+0x923/0xc80 [ 270.458376][ T9921] ? __mutex_lock+0x4d2/0xc80 [ 270.463110][ T9921] ? rtnl_setlink+0x4e0/0x4e0 [ 270.469489][ T9921] rtnetlink_rcv_msg+0x843/0xf90 [ 270.474470][ T9921] ? rtnetlink_rcv_msg+0x220/0xf90 [ 270.479881][ T9921] ? rtnetlink_bind+0x80/0x80 [ 270.484668][ T9921] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 270.490810][ T9921] ? lock_chain_count+0x20/0x20 [ 270.495716][ T9921] ? __local_bh_enable_ip+0x13a/0x1c0 [ 270.501118][ T9921] ? lockdep_hardirqs_on+0x98/0x150 [ 270.506431][ T9921] ? __local_bh_enable_ip+0x13a/0x1c0 [ 270.511925][ T9921] ? _local_bh_enable+0xa0/0xa0 [ 270.516928][ T9921] ? __dev_queue_xmit+0x272/0x37e0 [ 270.522089][ T9921] ? __dev_queue_xmit+0x1329/0x37e0 [ 270.527608][ T9921] ? __dev_queue_xmit+0x272/0x37e0 [ 270.532907][ T9921] ? ref_tracker_free+0x686/0x830 [ 270.537982][ T9921] netlink_rcv_skb+0x235/0x4c0 [ 270.542776][ T9921] ? rtnetlink_bind+0x80/0x80 [ 270.547481][ T9921] ? netlink_ack+0x1160/0x1160 [ 270.552299][ T9921] ? __lock_acquire+0x7d80/0x7d80 [ 270.557388][ T9921] ? netlink_deliver_tap+0x2e/0x1b0 [ 270.562616][ T9921] netlink_unicast+0x7b1/0x930 [ 270.567419][ T9921] netlink_sendmsg+0x8d0/0xbf0 [ 270.572223][ T9921] ? netlink_getsockopt+0x590/0x590 [ 270.577474][ T9921] ? apparmor_socket_sendmsg+0x8e/0x330 [ 270.583071][ T9921] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 270.588676][ T9921] ? security_socket_sendmsg+0x80/0xa0 [ 270.594171][ T9921] ? netlink_getsockopt+0x590/0x590 [ 270.599429][ T9921] ____sys_sendmsg+0x61b/0x980 [ 270.604337][ T9921] ? __asan_memset+0x22/0x40 [ 270.609062][ T9921] ? __sys_sendmsg_sock+0x30/0x30 [ 270.614197][ T9921] ? __import_iovec+0x5f2/0x850 [ 270.619087][ T9921] ? import_iovec+0x73/0xa0 [ 270.623681][ T9921] ___sys_sendmsg+0x2a6/0x360 [ 270.628485][ T9921] ? get_pid_task+0x20/0x1e0 [ 270.633108][ T9921] ? __sys_sendmsg+0x2b0/0x2b0 [ 270.637929][ T9921] ? __lock_acquire+0x7d80/0x7d80 [ 270.643022][ T9921] __se_sys_sendmsg+0x1d0/0x2c0 [ 270.647924][ T9921] ? __x64_sys_sendmsg+0x80/0x80 [ 270.652922][ T9921] ? lockdep_hardirqs_on+0x98/0x150 [ 270.658163][ T9921] do_syscall_64+0x55/0xb0 [ 270.662608][ T9921] ? clear_bhb_loop+0x40/0x90 [ 270.667324][ T9921] ? clear_bhb_loop+0x40/0x90 [ 270.672037][ T9921] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 270.677951][ T9921] RIP: 0033:0x7f81b1d9e159 [ 270.682387][ T9921] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.702190][ T9921] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 270.710924][ T9921] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 270.719023][ T9921] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 270.727055][ T9921] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 270.735045][ T9921] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 270.743067][ T9921] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 270.751094][ T9921] [ 270.767324][ T9921] socket: no more sockets [ 270.773124][ T9921] wireguard: wg1: Could not create IPv6 socket [ 270.966041][ T9924] syzkaller0: entered promiscuous mode [ 270.976105][ T9924] syzkaller0: entered allmulticast mode [ 271.045105][ T9924] netlink: 207508 bytes leftover after parsing attributes in process `syz.1.1345'. [ 274.075443][ T9969] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1363'. [ 275.221465][T10006] netlink: 'syz.1.1377': attribute type 4 has an invalid length. [ 275.449270][T10012] netlink: 'syz.1.1379': attribute type 10 has an invalid length. [ 275.481008][T10012] 8021q: adding VLAN 0 to HW filter on device bond0 [ 275.504439][T10012] team0: Port device bond0 added [ 276.843683][T10066] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1397'. [ 277.745442][T10088] FAULT_INJECTION: forcing a failure. [ 277.745442][T10088] name failslab, interval 1, probability 0, space 0, times 0 [ 277.765507][T10088] CPU: 0 PID: 10088 Comm: syz.1.1413 Not tainted syzkaller #0 [ 277.773061][T10088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 277.783174][T10088] Call Trace: [ 277.786495][T10088] [ 277.789467][T10088] dump_stack_lvl+0x18c/0x250 [ 277.794206][T10088] ? show_regs_print_info+0x20/0x20 [ 277.799473][T10088] ? load_image+0x420/0x420 [ 277.804035][T10088] ? __might_sleep+0xe0/0xe0 [ 277.808691][T10088] ? __lock_acquire+0x7d80/0x7d80 [ 277.813776][T10088] ? __asan_memset+0x22/0x40 [ 277.818880][T10088] should_fail_ex+0x394/0x4c0 [ 277.823705][T10088] should_failslab+0x9/0x20 [ 277.828264][T10088] slab_pre_alloc_hook+0x59/0x300 [ 277.833364][T10088] kmem_cache_alloc+0x5a/0x2c0 [ 277.838182][T10088] ? security_inode_alloc+0x34/0x110 [ 277.843630][T10088] security_inode_alloc+0x34/0x110 [ 277.848807][T10088] inode_init_always+0x914/0xc90 [ 277.853804][T10088] new_inode_pseudo+0x95/0x1d0 [ 277.858630][T10088] __sock_create+0x12d/0x940 [ 277.863354][T10088] ? __asan_memset+0x22/0x40 [ 277.868034][T10088] udp_sock_create4+0xc6/0x480 [ 277.872841][T10088] ? free_zapped_rcu+0x250/0x250 [ 277.877837][T10088] ? erspan_exit_batch_net+0x30/0x30 [ 277.883270][T10088] rxrpc_lookup_local+0xd16/0x1700 [ 277.888434][T10088] ? rxrpc_local_dont_fragment+0x70/0x70 [ 277.894122][T10088] ? __local_bh_enable_ip+0x13a/0x1c0 [ 277.899540][T10088] ? __local_bh_enable_ip+0x13a/0x1c0 [ 277.905051][T10088] ? do_raw_spin_unlock+0x121/0x230 [ 277.910385][T10088] rxrpc_sendmsg+0x2f3/0x5b0 [ 277.915016][T10088] ? rxrpc_getsockopt+0x150/0x150 [ 277.920128][T10088] ____sys_sendmsg+0x61b/0x980 [ 277.924951][T10088] ? __sys_sendmsg_sock+0x30/0x30 [ 277.930014][T10088] ? __import_iovec+0x5f2/0x850 [ 277.934917][T10088] ? import_iovec+0x73/0xa0 [ 277.939467][T10088] ___sys_sendmsg+0x2a6/0x360 [ 277.944182][T10088] ? get_pid_task+0x20/0x1e0 [ 277.948818][T10088] ? __sys_sendmsg+0x2b0/0x2b0 [ 277.953691][T10088] ? __lock_acquire+0x7d80/0x7d80 [ 277.958788][T10088] __se_sys_sendmsg+0x1d0/0x2c0 [ 277.963686][T10088] ? __x64_sys_sendmsg+0x80/0x80 [ 277.968764][T10088] ? lockdep_hardirqs_on+0x98/0x150 [ 277.974000][T10088] do_syscall_64+0x55/0xb0 [ 277.978453][T10088] ? clear_bhb_loop+0x40/0x90 [ 277.983191][T10088] ? clear_bhb_loop+0x40/0x90 [ 277.987910][T10088] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 277.993847][T10088] RIP: 0033:0x7f10b559e159 [ 277.998293][T10088] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 278.018109][T10088] RSP: 002b:00007f10b643a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 278.026581][T10088] RAX: ffffffffffffffda RBX: 00007f10b5825fa0 RCX: 00007f10b559e159 [ 278.034599][T10088] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 278.042635][T10088] RBP: 00007f10b643a090 R08: 0000000000000000 R09: 0000000000000000 [ 278.050765][T10088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 278.058768][T10088] R13: 00007f10b5826038 R14: 00007f10b5825fa0 R15: 00007ffd830f4d78 [ 278.066808][T10088] [ 278.203749][T10088] socket: no more sockets [ 278.807004][T10108] netlink: 'syz.1.1418': attribute type 29 has an invalid length. [ 278.834536][T10108] netlink: 'syz.1.1418': attribute type 29 has an invalid length. [ 278.853615][T10112] netlink: 'syz.1.1418': attribute type 29 has an invalid length. [ 278.909709][T10114] netlink: 'syz.1.1418': attribute type 29 has an invalid length. [ 278.931284][T10108] netlink: 'syz.1.1418': attribute type 29 has an invalid length. [ 278.956434][T10118] netlink: 'syz.2.1420': attribute type 10 has an invalid length. [ 279.038149][T10118] team0: Device wg1 is of different type [ 279.314914][T10113] netlink: 'syz.3.1419': attribute type 25 has an invalid length. [ 279.325677][T10113] netlink: 'syz.3.1419': attribute type 10 has an invalid length. [ 283.679697][T10184] sit0: entered allmulticast mode [ 283.708088][T10185] team0: entered allmulticast mode [ 283.753106][T10185] team_slave_0: entered allmulticast mode [ 283.763182][T10185] team_slave_1: entered allmulticast mode [ 284.280946][T10210] netlink: 'syz.3.1448': attribute type 10 has an invalid length. [ 284.296271][T10210] team0: Device vxcan1 is of different type [ 284.430407][T10214] netlink: 'syz.2.1457': attribute type 29 has an invalid length. [ 284.440981][T10214] netlink: 'syz.2.1457': attribute type 29 has an invalid length. [ 284.529882][T10214] netlink: 'syz.2.1457': attribute type 29 has an invalid length. [ 284.590268][T10221] netlink: 'syz.2.1457': attribute type 29 has an invalid length. [ 284.660963][T10214] netlink: 'syz.2.1457': attribute type 29 has an invalid length. [ 285.325549][T10239] netlink: 142516 bytes leftover after parsing attributes in process `syz.2.1459'. [ 285.714842][T10240] delete_channel: no stack [ 285.954357][T10259] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.1469'. [ 285.964195][T10259] bridge_slave_1: default FDB implementation only supports local addresses [ 286.358478][T10261] netlink: 'syz.3.1470': attribute type 4 has an invalid length. [ 286.373919][T10261] netlink: 206236 bytes leftover after parsing attributes in process `syz.3.1470'. [ 286.597520][T10272] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1474'. [ 287.228404][T10288] netlink: 'syz.2.1477': attribute type 25 has an invalid length. [ 287.249625][T10288] netlink: 'syz.2.1477': attribute type 10 has an invalid length. [ 287.921749][T10306] netlink: 202920 bytes leftover after parsing attributes in process `syz.3.1486'. [ 289.089235][T10329] netlink: 'syz.1.1493': attribute type 25 has an invalid length. [ 289.610464][T10348] validate_nla: 1 callbacks suppressed [ 289.610724][T10348] netlink: 'syz.2.1500': attribute type 28 has an invalid length. [ 289.684577][T10348] netlink: 2 bytes leftover after parsing attributes in process `syz.2.1500'. [ 290.289129][T10348] syz.2.1500 (10348) used greatest stack depth: 17704 bytes left [ 290.393990][T10360] netlink: 'syz.3.1503': attribute type 21 has an invalid length. [ 290.622037][T10366] netlink: 176 bytes leftover after parsing attributes in process `syz.1.1506'. [ 292.122484][T10392] netlink: 'syz.1.1515': attribute type 10 has an invalid length. [ 292.215577][T10387] netlink: 'syz.0.1511': attribute type 25 has an invalid length. [ 292.299033][T10387] netlink: 'syz.0.1511': attribute type 10 has an invalid length. [ 293.029532][T10399] sit0: left promiscuous mode [ 293.278531][T10400] sit0: entered promiscuous mode [ 294.962943][T10439] netlink: 'syz.3.1530': attribute type 28 has an invalid length. [ 294.993033][T10439] netlink: 2 bytes leftover after parsing attributes in process `syz.3.1530'. [ 296.099698][T10453] FAULT_INJECTION: forcing a failure. [ 296.099698][T10453] name failslab, interval 1, probability 0, space 0, times 0 [ 296.231539][T10453] CPU: 1 PID: 10453 Comm: syz.0.1534 Not tainted syzkaller #0 [ 296.239098][T10453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 296.249190][T10453] Call Trace: [ 296.252529][T10453] [ 296.255490][T10453] dump_stack_lvl+0x18c/0x250 [ 296.260220][T10453] ? show_regs_print_info+0x20/0x20 [ 296.265463][T10453] ? load_image+0x420/0x420 [ 296.270013][T10453] ? __might_sleep+0xe0/0xe0 [ 296.274767][T10453] ? __lock_acquire+0x7d80/0x7d80 [ 296.279834][T10453] should_fail_ex+0x394/0x4c0 [ 296.284567][T10453] should_failslab+0x9/0x20 [ 296.289114][T10453] slab_pre_alloc_hook+0x59/0x300 [ 296.294192][T10453] kmem_cache_alloc+0x5a/0x2c0 [ 296.298998][T10453] ? sk_prot_alloc+0x57/0x210 [ 296.303722][T10453] sk_prot_alloc+0x57/0x210 [ 296.308267][T10453] ? sk_alloc+0x24/0x350 [ 296.312561][T10453] sk_alloc+0x3a/0x350 [ 296.316681][T10453] inet_create+0x7a9/0xfe0 [ 296.321154][T10453] ? inet_create+0x9d/0xfe0 [ 296.325804][T10453] __sock_create+0x49e/0x940 [ 296.330626][T10453] udp_sock_create4+0xc6/0x480 [ 296.335433][T10453] ? free_zapped_rcu+0x250/0x250 [ 296.340427][T10453] ? erspan_exit_batch_net+0x30/0x30 [ 296.345776][T10453] rxrpc_lookup_local+0xd16/0x1700 [ 296.350939][T10453] ? rxrpc_local_dont_fragment+0x70/0x70 [ 296.356630][T10453] ? __local_bh_enable_ip+0x13a/0x1c0 [ 296.362061][T10453] ? __local_bh_enable_ip+0x13a/0x1c0 [ 296.367491][T10453] ? do_raw_spin_unlock+0x121/0x230 [ 296.372758][T10453] rxrpc_sendmsg+0x2f3/0x5b0 [ 296.377407][T10453] ? rxrpc_getsockopt+0x150/0x150 [ 296.382490][T10453] ____sys_sendmsg+0x61b/0x980 [ 296.387313][T10453] ? __sys_sendmsg_sock+0x30/0x30 [ 296.392391][T10453] ? __import_iovec+0x5f2/0x850 [ 296.397311][T10453] ? import_iovec+0x73/0xa0 [ 296.402147][T10453] ___sys_sendmsg+0x2a6/0x360 [ 296.406868][T10453] ? get_pid_task+0x20/0x1e0 [ 296.411662][T10453] ? __sys_sendmsg+0x2b0/0x2b0 [ 296.416463][T10453] ? __lock_acquire+0x7d80/0x7d80 [ 296.421525][T10453] __se_sys_sendmsg+0x1d0/0x2c0 [ 296.426394][T10453] ? __x64_sys_sendmsg+0x80/0x80 [ 296.431370][T10453] ? lockdep_hardirqs_on+0x98/0x150 [ 296.436782][T10453] do_syscall_64+0x55/0xb0 [ 296.441396][T10453] ? clear_bhb_loop+0x40/0x90 [ 296.446181][T10453] ? clear_bhb_loop+0x40/0x90 [ 296.450876][T10453] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 296.456782][T10453] RIP: 0033:0x7f81b1d9e159 [ 296.461302][T10453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 296.481102][T10453] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 296.489793][T10453] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 296.497776][T10453] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 296.506038][T10453] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 296.514043][T10453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 296.522116][T10453] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 296.530120][T10453] [ 296.836795][T10469] netlink: 'syz.2.1540': attribute type 10 has an invalid length. [ 296.863502][T10465] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1535'. [ 296.881728][T10469] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1540'. [ 296.934216][T10465] A link change request failed with some changes committed already. Interface 26±ÿ may have been left with an inconsistent configuration, please check. [ 297.890992][T10495] netlink: 'syz.1.1550': attribute type 10 has an invalid length. [ 297.923743][T10495] team0: Device wg1 is of different type [ 298.419163][T10499] syzkaller0: entered promiscuous mode [ 298.427875][T10499] syzkaller0: entered allmulticast mode [ 298.688043][T10516] netlink: 'syz.1.1556': attribute type 1 has an invalid length. [ 298.991759][T10521] sit0: entered promiscuous mode [ 299.846845][T10544] netlink: 'syz.3.1568': attribute type 29 has an invalid length. [ 299.892907][T10544] netlink: 'syz.3.1568': attribute type 29 has an invalid length. [ 299.909945][T10547] netlink: 'syz.3.1568': attribute type 29 has an invalid length. [ 299.923184][T10553] netlink: 'syz.3.1568': attribute type 29 has an invalid length. [ 300.038076][T10547] netlink: 'syz.3.1568': attribute type 29 has an invalid length. [ 300.938291][T10566] netlink: 'syz.3.1575': attribute type 29 has an invalid length. [ 300.946752][T10566] netlink: 'syz.3.1575': attribute type 29 has an invalid length. [ 300.975668][T10567] netlink: 'syz.3.1575': attribute type 29 has an invalid length. [ 301.005262][T10566] netlink: 'syz.3.1575': attribute type 29 has an invalid length. [ 301.025399][T10567] netlink: 'syz.3.1575': attribute type 29 has an invalid length. [ 301.038261][T10574] netlink: 'syz.0.1577': attribute type 10 has an invalid length. [ 301.046576][T10574] FAULT_INJECTION: forcing a failure. [ 301.046576][T10574] name failslab, interval 1, probability 0, space 0, times 0 [ 301.061488][T10574] CPU: 1 PID: 10574 Comm: syz.0.1577 Not tainted syzkaller #0 [ 301.068998][T10574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 301.079173][T10574] Call Trace: [ 301.082478][T10574] [ 301.085433][T10574] dump_stack_lvl+0x18c/0x250 [ 301.090127][T10574] ? show_regs_print_info+0x20/0x20 [ 301.095353][T10574] ? load_image+0x420/0x420 [ 301.099885][T10574] ? __might_sleep+0xe0/0xe0 [ 301.104488][T10574] ? __lock_acquire+0x7d80/0x7d80 [ 301.109526][T10574] should_fail_ex+0x394/0x4c0 [ 301.114224][T10574] should_failslab+0x9/0x20 [ 301.118731][T10574] slab_pre_alloc_hook+0x59/0x300 [ 301.124031][T10574] kmem_cache_alloc+0x5a/0x2c0 [ 301.128810][T10574] ? sk_prot_alloc+0x57/0x210 [ 301.133508][T10574] sk_prot_alloc+0x57/0x210 [ 301.138020][T10574] ? sk_alloc+0x24/0x350 [ 301.142263][T10574] sk_alloc+0x3a/0x350 [ 301.146435][T10574] inet6_create+0x7d3/0x1120 [ 301.151035][T10574] ? inet6_create+0x80/0x1120 [ 301.155752][T10574] __sock_create+0x49e/0x940 [ 301.160382][T10574] udp_sock_create6+0xd3/0x650 [ 301.166059][T10574] ? inet6_hash+0x80/0x80 [ 301.170408][T10574] ? rcu_read_lock_any_held+0xb4/0x140 [ 301.175988][T10574] wg_socket_init+0x698/0xb10 [ 301.180726][T10574] ? wg_socket_init+0x1b4/0xb10 [ 301.185593][T10574] ? wg_socket_clear_peer_endpoint_src+0x50/0x50 [ 301.191935][T10574] ? wg_socket_init+0xb10/0xb10 [ 301.196804][T10574] ? __mutex_lock+0x30d/0xc80 [ 301.201485][T10574] ? ib_device_get_by_netdev+0x82/0x4f0 [ 301.207038][T10574] ? mutex_lock_nested+0x20/0x20 [ 301.211994][T10574] wg_open+0x24f/0x420 [ 301.216189][T10574] ? wg_newlink+0x720/0x720 [ 301.220711][T10574] __dev_open+0x2cb/0x430 [ 301.225062][T10574] ? dev_open+0x190/0x190 [ 301.229432][T10574] ? ref_tracker_dir_exit+0x510/0x510 [ 301.234857][T10574] dev_open+0xab/0x190 [ 301.238962][T10574] ? netdev_notify_peers+0x180/0x180 [ 301.244287][T10574] ? team_add_slave+0x2a2/0x28a0 [ 301.249291][T10574] ? rcu_is_watching+0x15/0xb0 [ 301.254070][T10574] ? team_add_slave+0x2a2/0x28a0 [ 301.259032][T10574] ? __kmalloc+0xe5/0x240 [ 301.263391][T10574] team_add_slave+0x703/0x28a0 [ 301.268231][T10574] ? team_netpoll_cleanup+0xf0/0xf0 [ 301.273558][T10574] ? __dev_change_flags+0x4d2/0x6a0 [ 301.278793][T10574] ? dev_get_flags+0x1c0/0x1c0 [ 301.283586][T10574] ? printk_sprint+0x460/0x460 [ 301.288362][T10574] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 301.294284][T10574] ? mutex_is_locked+0x12/0x40 [ 301.299105][T10574] do_setlink+0xcde/0x3f40 [ 301.303582][T10574] ? load_image+0x420/0x420 [ 301.308124][T10574] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 301.314501][T10574] ? stack_trace_save+0xaa/0x100 [ 301.319511][T10574] ? stack_trace_snprint+0xf0/0xf0 [ 301.324799][T10574] ? __nla_validate+0x50/0x50 [ 301.329573][T10574] ? validate_linkmsg+0x719/0x910 [ 301.334651][T10574] rtnl_newlink+0x1848/0x2170 [ 301.339401][T10574] ? rtnl_newlink+0x4a1/0x2170 [ 301.344248][T10574] ? rtnl_setlink+0x4e0/0x4e0 [ 301.348980][T10574] ? trace_raw_output_contention_end+0xd0/0xd0 [ 301.355189][T10574] ? rcu_is_watching+0x15/0xb0 [ 301.360007][T10574] ? trace_contention_end+0x39/0xe0 [ 301.365247][T10574] ? __mutex_lock+0x30d/0xc80 [ 301.370005][T10574] ? rtnl_setlink+0x4e0/0x4e0 [ 301.374736][T10574] rtnetlink_rcv_msg+0x843/0xf90 [ 301.379732][T10574] ? rtnetlink_rcv_msg+0x220/0xf90 [ 301.384854][T10574] ? rtnetlink_bind+0x80/0x80 [ 301.389550][T10574] ? perf_trace_preemptirq_template+0xac/0x330 [ 301.395730][T10574] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 301.401746][T10574] ? lock_chain_count+0x20/0x20 [ 301.406621][T10574] ? __local_bh_enable_ip+0x13a/0x1c0 [ 301.412026][T10574] ? lockdep_hardirqs_on+0x98/0x150 [ 301.417233][T10574] ? __local_bh_enable_ip+0x13a/0x1c0 [ 301.422614][T10574] ? _local_bh_enable+0xa0/0xa0 [ 301.427516][T10574] ? __dev_queue_xmit+0x272/0x37e0 [ 301.432652][T10574] ? __dev_queue_xmit+0x1329/0x37e0 [ 301.437864][T10574] ? __dev_queue_xmit+0x272/0x37e0 [ 301.442997][T10574] ? ref_tracker_free+0x686/0x830 [ 301.448054][T10574] netlink_rcv_skb+0x235/0x4c0 [ 301.452844][T10574] ? rtnetlink_bind+0x80/0x80 [ 301.457541][T10574] ? netlink_ack+0x1160/0x1160 [ 301.462345][T10574] ? __lock_acquire+0x7d80/0x7d80 [ 301.467461][T10574] ? netlink_deliver_tap+0x2e/0x1b0 [ 301.472673][T10574] netlink_unicast+0x7b1/0x930 [ 301.477459][T10574] netlink_sendmsg+0x8d0/0xbf0 [ 301.482261][T10574] ? netlink_getsockopt+0x590/0x590 [ 301.487469][T10574] ? apparmor_socket_sendmsg+0x8e/0x330 [ 301.493020][T10574] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 301.498329][T10574] ? security_socket_sendmsg+0x80/0xa0 [ 301.503804][T10574] ? netlink_getsockopt+0x590/0x590 [ 301.509017][T10574] ____sys_sendmsg+0x61b/0x980 [ 301.513812][T10574] ? __asan_memset+0x22/0x40 [ 301.518418][T10574] ? __sys_sendmsg_sock+0x30/0x30 [ 301.523490][T10574] ? __import_iovec+0x5f2/0x850 [ 301.528372][T10574] ? import_iovec+0x73/0xa0 [ 301.532887][T10574] ___sys_sendmsg+0x2a6/0x360 [ 301.537595][T10574] ? get_pid_task+0x20/0x1e0 [ 301.542205][T10574] ? __sys_sendmsg+0x2b0/0x2b0 [ 301.546998][T10574] ? __lock_acquire+0x7d80/0x7d80 [ 301.552044][T10574] __se_sys_sendmsg+0x1d0/0x2c0 [ 301.556918][T10574] ? __x64_sys_sendmsg+0x80/0x80 [ 301.561883][T10574] ? lockdep_hardirqs_on+0x98/0x150 [ 301.567087][T10574] do_syscall_64+0x55/0xb0 [ 301.571513][T10574] ? clear_bhb_loop+0x40/0x90 [ 301.576238][T10574] ? clear_bhb_loop+0x40/0x90 [ 301.580934][T10574] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 301.587059][T10574] RIP: 0033:0x7f81b1d9e159 [ 301.591495][T10574] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 301.611112][T10574] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 301.619593][T10574] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 301.628223][T10574] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 301.636310][T10574] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 301.644292][T10574] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 301.652355][T10574] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 301.660340][T10574] [ 301.671455][T10574] wireguard: wg1: Could not create IPv6 socket [ 301.939839][T10592] netlink: 'syz.2.1583': attribute type 6 has an invalid length. [ 301.950398][T10592] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1583'. [ 303.051697][T10609] delete_channel: no stack [ 303.357419][T10636] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.1598'. [ 303.366960][T10636] bridge_slave_1: default FDB implementation only supports local addresses [ 304.163139][T10672] netlink: 'syz.1.1608': attribute type 4 has an invalid length. [ 304.185998][T10672] netlink: 206236 bytes leftover after parsing attributes in process `syz.1.1608'. [ 304.298081][T10674] netlink: 'syz.3.1610': attribute type 29 has an invalid length. [ 305.077534][T10698] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1617'. [ 307.769573][T10716] FAULT_INJECTION: forcing a failure. [ 307.769573][T10716] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 307.809886][T10716] CPU: 0 PID: 10716 Comm: syz.0.1625 Not tainted syzkaller #0 [ 307.817436][T10716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 307.827549][T10716] Call Trace: [ 307.830865][T10716] [ 307.833826][T10716] dump_stack_lvl+0x18c/0x250 [ 307.838553][T10716] ? show_regs_print_info+0x20/0x20 [ 307.843794][T10716] ? load_image+0x420/0x420 [ 307.848360][T10716] ? __might_fault+0xaa/0x120 [ 307.853095][T10716] should_fail_ex+0x394/0x4c0 [ 307.857825][T10716] copyin+0x1a/0x90 [ 307.861682][T10716] _copy_from_iter+0x3ec/0x1290 [ 307.866593][T10716] ? copyout_mc+0x70/0x70 [ 307.870976][T10716] ? perf_trace_lock+0xfc/0x3b0 [ 307.875897][T10716] ? dev_get_by_index+0x22/0x2d0 [ 307.880880][T10716] ? dev_get_by_index+0x22/0x2d0 [ 307.885890][T10716] packet_sendmsg+0x2c7f/0x4a30 [ 307.890803][T10716] ? aa_sk_perm+0x970/0x970 [ 307.895382][T10716] ? __might_sleep+0xe0/0xe0 [ 307.900028][T10716] ? verify_lock_unused+0x140/0x140 [ 307.905289][T10716] ? aa_sk_perm+0x83c/0x970 [ 307.909852][T10716] ? packet_getsockopt+0xad0/0xad0 [ 307.915102][T10716] ? tomoyo_check_open_permission+0x340/0x460 [ 307.921219][T10716] ? aa_sock_msg_perm+0x94/0x150 [ 307.926210][T10716] ? apparmor_socket_sendmsg+0x8e/0x330 [ 307.932072][T10716] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 307.937503][T10716] ? security_socket_sendmsg+0x80/0xa0 [ 307.943009][T10716] ? packet_getsockopt+0xad0/0xad0 [ 307.948172][T10716] ____sys_sendmsg+0x61b/0x980 [ 307.952987][T10716] ? __asan_memset+0x22/0x40 [ 307.957639][T10716] ? __sys_sendmsg_sock+0x30/0x30 [ 307.962724][T10716] ? __import_iovec+0x3fa/0x850 [ 307.967680][T10716] ? import_iovec+0x73/0xa0 [ 307.972248][T10716] ___sys_sendmsg+0x2a6/0x360 [ 307.977005][T10716] ? __sys_sendmsg+0x2b0/0x2b0 [ 307.981854][T10716] ? __lock_acquire+0x7d80/0x7d80 [ 307.986971][T10716] __se_sys_sendmsg+0x1d0/0x2c0 [ 307.991872][T10716] ? __x64_sys_sendmsg+0x80/0x80 [ 307.996874][T10716] ? lockdep_hardirqs_on+0x98/0x150 [ 308.002122][T10716] do_syscall_64+0x55/0xb0 [ 308.006594][T10716] ? clear_bhb_loop+0x40/0x90 [ 308.011326][T10716] ? clear_bhb_loop+0x40/0x90 [ 308.016059][T10716] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 308.021987][T10716] RIP: 0033:0x7f81b1d9e159 [ 308.026440][T10716] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 308.046152][T10716] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 308.054599][T10716] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 308.062580][T10716] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 308.070580][T10716] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 308.078598][T10716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 308.086598][T10716] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 308.094593][T10716] [ 311.352555][T10762] sit0: entered allmulticast mode [ 311.384229][T10748] sit0: entered promiscuous mode [ 311.612648][T10779] validate_nla: 2 callbacks suppressed [ 311.649074][T10779] netlink: 'syz.3.1644': attribute type 10 has an invalid length. [ 311.657344][T10779] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1644'. [ 311.692955][T10779] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 314.322002][T10858] netlink: 14 bytes leftover after parsing attributes in process `syz.2.1668'. [ 315.042191][T10895] netlink: 10 bytes leftover after parsing attributes in process `syz.1.1683'. [ 315.714241][T10916] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1688'. [ 315.768454][T10918] netlink: 'syz.3.1690': attribute type 10 has an invalid length. [ 315.795174][T10918] team0: Device wg1 is of different type [ 316.342142][T10929] netlink: 'syz.1.1693': attribute type 1 has an invalid length. [ 317.627129][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.639060][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 318.340363][T10963] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.691940][T10975] netlink: 'syz.0.1709': attribute type 29 has an invalid length. [ 318.708826][T10975] netlink: 'syz.0.1709': attribute type 29 has an invalid length. [ 318.710913][T10958] delete_channel: no stack [ 318.814980][T10975] netlink: 'syz.0.1709': attribute type 29 has an invalid length. [ 318.850927][T10975] netlink: 'syz.0.1709': attribute type 29 has an invalid length. [ 318.876798][T10975] netlink: 'syz.0.1709': attribute type 29 has an invalid length. [ 320.945837][T11042] delete_channel: no stack [ 320.951000][T11042] delete_channel: no stack [ 321.530672][T11050] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.1732'. [ 321.543563][T11062] netlink: 'syz.3.1735': attribute type 29 has an invalid length. [ 321.584224][T11062] netlink: 'syz.3.1735': attribute type 29 has an invalid length. [ 324.030825][T11106] netlink: 'syz.0.1751': attribute type 39 has an invalid length. [ 324.551977][T11115] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1 [ 325.550979][T11133] netlink: 'syz.0.1762': attribute type 1 has an invalid length. [ 325.571387][T11133] netlink: 128 bytes leftover after parsing attributes in process `syz.0.1762'. [ 325.915644][T11158] netlink: 'syz.2.1771': attribute type 10 has an invalid length. [ 325.975946][T11158] team0: Device wg1 is of different type [ 325.989425][T11154] sit0: left promiscuous mode [ 326.706249][T11174] netlink: 'syz.0.1778': attribute type 10 has an invalid length. [ 326.779377][T11174] wg1: entered allmulticast mode [ 326.784589][T11174] team0: Device wg1 is of different type [ 327.607200][T11195] netlink: 'syz.2.1784': attribute type 39 has an invalid length. [ 328.027938][T11204] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.1787'. [ 328.133531][T11206] netlink: 'syz.0.1788': attribute type 10 has an invalid length. [ 328.142567][T11206] FAULT_INJECTION: forcing a failure. [ 328.142567][T11206] name failslab, interval 1, probability 0, space 0, times 0 [ 328.155880][T11206] CPU: 1 PID: 11206 Comm: syz.0.1788 Not tainted syzkaller #0 [ 328.163394][T11206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 328.173488][T11206] Call Trace: [ 328.176792][T11206] [ 328.179761][T11206] dump_stack_lvl+0x18c/0x250 [ 328.184479][T11206] ? lockdep_hardirqs_on+0x98/0x150 [ 328.189698][T11206] ? show_regs_print_info+0x20/0x20 [ 328.194920][T11206] ? load_image+0x420/0x420 [ 328.199442][T11206] ? wg_packet_send_staged_packets+0x285/0x1850 [ 328.205725][T11206] should_fail_ex+0x394/0x4c0 [ 328.210425][T11206] should_failslab+0x9/0x20 [ 328.214948][T11206] slab_pre_alloc_hook+0x59/0x300 [ 328.220008][T11206] kmem_cache_alloc_node+0x5e/0x310 [ 328.225232][T11206] ? __alloc_skb+0x103/0x2c0 [ 328.229931][T11206] __alloc_skb+0x103/0x2c0 [ 328.234456][T11206] wg_packet_send_keepalive+0x65/0x2b0 [ 328.239936][T11206] wg_open+0x2d6/0x420 [ 328.244048][T11206] __dev_open+0x2cb/0x430 [ 328.248445][T11206] ? dev_open+0x190/0x190 [ 328.252797][T11206] ? ref_tracker_dir_exit+0x510/0x510 [ 328.258208][T11206] dev_open+0xab/0x190 [ 328.262296][T11206] ? netdev_notify_peers+0x180/0x180 [ 328.267600][T11206] ? team_add_slave+0x2a2/0x28a0 [ 328.272550][T11206] ? rcu_is_watching+0x15/0xb0 [ 328.277330][T11206] ? team_add_slave+0x2a2/0x28a0 [ 328.282399][T11206] ? __kmalloc+0xe5/0x240 [ 328.286760][T11206] team_add_slave+0x703/0x28a0 [ 328.291565][T11206] ? team_netpoll_cleanup+0xf0/0xf0 [ 328.296774][T11206] ? __dev_change_flags+0x4d2/0x6a0 [ 328.302008][T11206] ? dev_get_flags+0x1c0/0x1c0 [ 328.306811][T11206] ? printk_sprint+0x460/0x460 [ 328.311698][T11206] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 328.317628][T11206] ? mutex_is_locked+0x12/0x40 [ 328.322417][T11206] do_setlink+0xcde/0x3f40 [ 328.326901][T11206] ? load_image+0x420/0x420 [ 328.331508][T11206] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 328.337679][T11206] ? stack_trace_save+0xaa/0x100 [ 328.342639][T11206] ? stack_trace_snprint+0xf0/0xf0 [ 328.347789][T11206] ? __nla_validate+0x50/0x50 [ 328.352513][T11206] ? validate_linkmsg+0x719/0x910 [ 328.357554][T11206] rtnl_newlink+0x1848/0x2170 [ 328.362262][T11206] ? rtnl_newlink+0x4a1/0x2170 [ 328.367081][T11206] ? rtnl_setlink+0x4e0/0x4e0 [ 328.371887][T11206] ? __rwlock_init+0x150/0x150 [ 328.376668][T11206] ? do_raw_spin_unlock+0x121/0x230 [ 328.381884][T11206] ? __mutex_lock+0x923/0xc80 [ 328.386573][T11206] ? __mutex_lock+0x4d2/0xc80 [ 328.391283][T11206] ? rtnl_setlink+0x4e0/0x4e0 [ 328.395981][T11206] rtnetlink_rcv_msg+0x843/0xf90 [ 328.400941][T11206] ? rtnetlink_rcv_msg+0x220/0xf90 [ 328.406088][T11206] ? rtnetlink_bind+0x80/0x80 [ 328.410791][T11206] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 328.416813][T11206] ? lock_chain_count+0x20/0x20 [ 328.421706][T11206] ? __local_bh_enable_ip+0x13a/0x1c0 [ 328.427115][T11206] ? lockdep_hardirqs_on+0x98/0x150 [ 328.432331][T11206] ? __local_bh_enable_ip+0x13a/0x1c0 [ 328.437718][T11206] ? _local_bh_enable+0xa0/0xa0 [ 328.442678][T11206] ? __dev_queue_xmit+0x272/0x37e0 [ 328.447824][T11206] ? __dev_queue_xmit+0x1329/0x37e0 [ 328.453035][T11206] ? __dev_queue_xmit+0x272/0x37e0 [ 328.458252][T11206] ? ref_tracker_free+0x686/0x830 [ 328.463331][T11206] netlink_rcv_skb+0x235/0x4c0 [ 328.468253][T11206] ? rtnetlink_bind+0x80/0x80 [ 328.472963][T11206] ? netlink_ack+0x1160/0x1160 [ 328.477761][T11206] ? __lock_acquire+0x7d80/0x7d80 [ 328.482807][T11206] ? netlink_deliver_tap+0x2e/0x1b0 [ 328.488029][T11206] netlink_unicast+0x7b1/0x930 [ 328.492816][T11206] netlink_sendmsg+0x8d0/0xbf0 [ 328.497613][T11206] ? netlink_getsockopt+0x590/0x590 [ 328.502835][T11206] ? apparmor_socket_sendmsg+0x8e/0x330 [ 328.508412][T11206] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 328.513714][T11206] ? security_socket_sendmsg+0x80/0xa0 [ 328.519210][T11206] ? netlink_getsockopt+0x590/0x590 [ 328.524439][T11206] ____sys_sendmsg+0x61b/0x980 [ 328.529226][T11206] ? __asan_memset+0x22/0x40 [ 328.533830][T11206] ? __sys_sendmsg_sock+0x30/0x30 [ 328.538869][T11206] ? __import_iovec+0x5f2/0x850 [ 328.543765][T11206] ? import_iovec+0x73/0xa0 [ 328.548466][T11206] ___sys_sendmsg+0x2a6/0x360 [ 328.553162][T11206] ? get_pid_task+0x20/0x1e0 [ 328.557855][T11206] ? __sys_sendmsg+0x2b0/0x2b0 [ 328.562680][T11206] ? __lock_acquire+0x7d80/0x7d80 [ 328.567781][T11206] __se_sys_sendmsg+0x1d0/0x2c0 [ 328.572674][T11206] ? __x64_sys_sendmsg+0x80/0x80 [ 328.577647][T11206] ? lockdep_hardirqs_on+0x98/0x150 [ 328.582986][T11206] do_syscall_64+0x55/0xb0 [ 328.587426][T11206] ? clear_bhb_loop+0x40/0x90 [ 328.592133][T11206] ? clear_bhb_loop+0x40/0x90 [ 328.596859][T11206] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 328.602770][T11206] RIP: 0033:0x7f81b1d9e159 [ 328.607229][T11206] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 328.626948][T11206] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 328.635470][T11206] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 328.643542][T11206] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 328.651545][T11206] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 328.659528][T11206] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 328.667512][T11206] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 328.675539][T11206] [ 328.694166][T11206] team0: Device wg1 is of different type [ 328.906670][T11214] netlink: 'syz.3.1790': attribute type 11 has an invalid length. [ 329.218771][T11223] netlink: 144 bytes leftover after parsing attributes in process `syz.2.1793'. [ 329.384634][T11223] team0: Port device C removed [ 329.404033][T11223] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 330.288273][T11255] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1805'. [ 330.455772][T11257] netlink: 'syz.1.1806': attribute type 39 has an invalid length. [ 332.939235][T11315] netlink: 'syz.3.1822': attribute type 39 has an invalid length. [ 333.382431][T11325] netlink: 'syz.0.1832': attribute type 21 has an invalid length. [ 334.998209][T11371] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1843'. [ 335.165913][T11371] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 335.408370][T11378] netlink: 'syz.1.1846': attribute type 21 has an invalid length. [ 335.977134][T11387] netlink: 'syz.1.1846': attribute type 10 has an invalid length. [ 336.169880][T11387] team0: Port device dummy0 added [ 336.447332][T11395] netlink: 'syz.2.1849': attribute type 10 has an invalid length. [ 336.456837][T11395] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1849'. [ 336.468024][T11395] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 338.503961][T11449] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.1864'. [ 338.599982][T11449] netlink: del zone limit has 8 unknown bytes [ 338.819177][T11453] netlink: 'syz.3.1867': attribute type 10 has an invalid length. [ 338.858080][T11453] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1867'. [ 338.903883][T11453] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 341.348435][T11497] netlink: 'syz.1.1881': attribute type 10 has an invalid length. [ 341.395409][T11497] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1881'. [ 341.456425][T11497] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 348.224894][T11588] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1909'. [ 348.226653][T11577] delete_channel: no stack [ 348.777895][T11613] FAULT_INJECTION: forcing a failure. [ 348.777895][T11613] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 348.797115][T11613] CPU: 0 PID: 11613 Comm: syz.1.1917 Not tainted syzkaller #0 [ 348.804661][T11613] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 348.814778][T11613] Call Trace: [ 348.818113][T11613] [ 348.821051][T11613] dump_stack_lvl+0x18c/0x250 [ 348.825823][T11613] ? show_regs_print_info+0x20/0x20 [ 348.831031][T11613] ? load_image+0x420/0x420 [ 348.835558][T11613] ? __might_fault+0xaa/0x120 [ 348.840362][T11613] should_fail_ex+0x394/0x4c0 [ 348.845164][T11613] copyin+0x1a/0x90 [ 348.849024][T11613] _copy_from_iter+0x3ec/0x1290 [ 348.853940][T11613] ? sock_alloc_send_pskb+0x8a1/0x9a0 [ 348.859434][T11613] ? copyout_mc+0x70/0x70 [ 348.863818][T11613] ? __virt_addr_valid+0x10c/0x380 [ 348.869010][T11613] ? __virt_addr_valid+0x10c/0x380 [ 348.874168][T11613] ? __virt_addr_valid+0x10c/0x380 [ 348.879440][T11613] ? __check_object_size+0x4fc/0xa40 [ 348.884803][T11613] skb_copy_datagram_from_iter+0xf2/0x6f0 [ 348.890637][T11613] ? dev_get_by_index+0x22/0x2d0 [ 348.895647][T11613] ? skb_put+0x112/0x210 [ 348.899922][T11613] packet_sendmsg+0x3323/0x4a30 [ 348.904859][T11613] ? aa_sk_perm+0x970/0x970 [ 348.909548][T11613] ? __might_sleep+0xe0/0xe0 [ 348.914175][T11613] ? verify_lock_unused+0x140/0x140 [ 348.919402][T11613] ? perf_trace_lock_acquire+0x105/0x400 [ 348.925075][T11613] ? aa_sk_perm+0x83c/0x970 [ 348.929604][T11613] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 348.936258][T11613] ? packet_getsockopt+0xad0/0xad0 [ 348.941404][T11613] ? tomoyo_check_open_permission+0x340/0x460 [ 348.947612][T11613] ? aa_sock_msg_perm+0x94/0x150 [ 348.952581][T11613] ? apparmor_socket_sendmsg+0x8e/0x330 [ 348.958177][T11613] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 348.963551][T11613] ? security_socket_sendmsg+0x80/0xa0 [ 348.969167][T11613] ? packet_getsockopt+0xad0/0xad0 [ 348.974340][T11613] ____sys_sendmsg+0x61b/0x980 [ 348.979226][T11613] ? __asan_memset+0x22/0x40 [ 348.983879][T11613] ? __sys_sendmsg_sock+0x30/0x30 [ 348.989047][T11613] ? __import_iovec+0x3fa/0x850 [ 348.993976][T11613] ? import_iovec+0x73/0xa0 [ 348.998554][T11613] ___sys_sendmsg+0x2a6/0x360 [ 349.003297][T11613] ? __sys_sendmsg+0x2b0/0x2b0 [ 349.008139][T11613] ? trace_call_bpf+0xc3/0x6c0 [ 349.012994][T11613] __se_sys_sendmsg+0x1d0/0x2c0 [ 349.017915][T11613] ? __x64_sys_sendmsg+0x80/0x80 [ 349.022927][T11613] ? lockdep_hardirqs_on+0x98/0x150 [ 349.028235][T11613] do_syscall_64+0x55/0xb0 [ 349.032698][T11613] ? clear_bhb_loop+0x40/0x90 [ 349.037528][T11613] ? clear_bhb_loop+0x40/0x90 [ 349.042256][T11613] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 349.048293][T11613] RIP: 0033:0x7f10b559e159 [ 349.052986][T11613] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.072663][T11613] RSP: 002b:00007f10b643a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 349.081144][T11613] RAX: ffffffffffffffda RBX: 00007f10b5825fa0 RCX: 00007f10b559e159 [ 349.089161][T11613] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 349.097168][T11613] RBP: 00007f10b643a090 R08: 0000000000000000 R09: 0000000000000000 [ 349.105224][T11613] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.113304][T11613] R13: 00007f10b5826038 R14: 00007f10b5825fa0 R15: 00007ffd830f4d78 [ 349.121310][T11613] [ 349.227278][T11616] syzkaller0: entered promiscuous mode [ 349.233085][T11616] syzkaller0: entered allmulticast mode [ 351.261353][T11639] netlink: 'syz.2.1927': attribute type 10 has an invalid length. [ 351.272592][T11639] team0: Device wg1 is of different type [ 354.898215][T11746] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1961'. [ 355.272648][T11760] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1964'. [ 355.493990][T11773] netlink: 121460 bytes leftover after parsing attributes in process `syz.1.1968'. [ 355.504661][T11773] netlink: 22856 bytes leftover after parsing attributes in process `syz.1.1968'. [ 356.423418][T11800] netlink: 68 bytes leftover after parsing attributes in process `syz.2.1979'. [ 356.691311][T11811] FAULT_INJECTION: forcing a failure. [ 356.691311][T11811] name failslab, interval 1, probability 0, space 0, times 0 [ 356.705792][T11811] CPU: 1 PID: 11811 Comm: syz.2.1983 Not tainted syzkaller #0 [ 356.713320][T11811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 356.723416][T11811] Call Trace: [ 356.726729][T11811] [ 356.729690][T11811] dump_stack_lvl+0x18c/0x250 [ 356.734432][T11811] ? show_regs_print_info+0x20/0x20 [ 356.740028][T11811] ? load_image+0x420/0x420 [ 356.744681][T11811] ? __lock_acquire+0x7d80/0x7d80 [ 356.749934][T11811] should_fail_ex+0x394/0x4c0 [ 356.754676][T11811] should_failslab+0x9/0x20 [ 356.759234][T11811] slab_pre_alloc_hook+0x59/0x300 [ 356.764324][T11811] ? __lock_acquire+0x7d80/0x7d80 [ 356.769398][T11811] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 356.775535][T11811] kmem_cache_alloc+0x5a/0x2c0 [ 356.780370][T11811] ? rxrpc_alloc_call+0x274/0xc60 [ 356.785537][T11811] ? rxrpc_alloc_call+0x79/0xc60 [ 356.790617][T11811] rxrpc_alloc_call+0x274/0xc60 [ 356.795517][T11811] rxrpc_new_client_call+0xea/0x1400 [ 356.801042][T11811] rxrpc_do_sendmsg+0xe03/0x12d0 [ 356.806060][T11811] ? rxrpc_propose_abort+0x1f0/0x1f0 [ 356.811434][T11811] ? __local_bh_enable_ip+0x13a/0x1c0 [ 356.816870][T11811] ? rxrpc_sendmsg+0x373/0x5b0 [ 356.821727][T11811] ? rxrpc_getsockopt+0x150/0x150 [ 356.826805][T11811] ____sys_sendmsg+0x61b/0x980 [ 356.831721][T11811] ? __sys_sendmsg_sock+0x30/0x30 [ 356.836817][T11811] ? __import_iovec+0x5f2/0x850 [ 356.841735][T11811] ? import_iovec+0x73/0xa0 [ 356.846390][T11811] ___sys_sendmsg+0x2a6/0x360 [ 356.851122][T11811] ? get_pid_task+0x20/0x1e0 [ 356.855789][T11811] ? __sys_sendmsg+0x2b0/0x2b0 [ 356.857672][T11814] syzkaller0: entered promiscuous mode [ 356.860604][T11811] ? __lock_acquire+0x7d80/0x7d80 [ 356.860682][T11811] __se_sys_sendmsg+0x1d0/0x2c0 [ 356.860712][T11811] ? __x64_sys_sendmsg+0x80/0x80 [ 356.860752][T11811] ? lockdep_hardirqs_on+0x98/0x150 [ 356.860778][T11811] do_syscall_64+0x55/0xb0 [ 356.891905][T11811] ? clear_bhb_loop+0x40/0x90 [ 356.893998][T11814] syzkaller0: entered allmulticast mode [ 356.896706][T11811] ? clear_bhb_loop+0x40/0x90 [ 356.907241][T11811] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 356.913254][T11811] RIP: 0033:0x7f622fb9e159 [ 356.918152][T11811] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 356.938264][T11811] RSP: 002b:00007f6230b44028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 356.946744][T11811] RAX: ffffffffffffffda RBX: 00007f622fe25fa0 RCX: 00007f622fb9e159 [ 356.954768][T11811] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 356.962875][T11811] RBP: 00007f6230b44090 R08: 0000000000000000 R09: 0000000000000000 [ 356.971067][T11811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 356.979085][T11811] R13: 00007f622fe26038 R14: 00007f622fe25fa0 R15: 00007fff312aaa18 [ 356.987229][T11811] [ 361.123718][T11844] netlink: 'syz.1.1993': attribute type 29 has an invalid length. [ 361.132363][T11844] netlink: 'syz.1.1993': attribute type 29 has an invalid length. [ 361.146160][T11844] netlink: 'syz.1.1993': attribute type 29 has an invalid length. [ 361.168314][T11844] netlink: 'syz.1.1993': attribute type 29 has an invalid length. [ 361.335986][T11856] netlink: 'syz.1.1998': attribute type 10 has an invalid length. [ 361.357234][T11856] FAULT_INJECTION: forcing a failure. [ 361.357234][T11856] name failslab, interval 1, probability 0, space 0, times 0 [ 361.389194][T11856] CPU: 1 PID: 11856 Comm: syz.1.1998 Not tainted syzkaller #0 [ 361.396748][T11856] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 361.406836][T11856] Call Trace: [ 361.410130][T11856] [ 361.413075][T11856] dump_stack_lvl+0x18c/0x250 [ 361.417784][T11856] ? lockdep_hardirqs_on+0x98/0x150 [ 361.423004][T11856] ? show_regs_print_info+0x20/0x20 [ 361.428235][T11856] ? load_image+0x420/0x420 [ 361.432758][T11856] ? wg_packet_send_staged_packets+0x285/0x1850 [ 361.439068][T11856] should_fail_ex+0x394/0x4c0 [ 361.443785][T11856] should_failslab+0x9/0x20 [ 361.448307][T11856] slab_pre_alloc_hook+0x59/0x300 [ 361.453357][T11856] kmem_cache_alloc_node+0x5e/0x310 [ 361.458594][T11856] ? __alloc_skb+0x103/0x2c0 [ 361.463295][T11856] __alloc_skb+0x103/0x2c0 [ 361.467731][T11856] wg_packet_send_keepalive+0x65/0x2b0 [ 361.473307][T11856] wg_open+0x2d6/0x420 [ 361.477412][T11856] __dev_open+0x2cb/0x430 [ 361.481766][T11856] ? dev_open+0x190/0x190 [ 361.486200][T11856] ? ref_tracker_dir_exit+0x510/0x510 [ 361.491601][T11856] dev_open+0xab/0x190 [ 361.495688][T11856] ? netdev_notify_peers+0x180/0x180 [ 361.501016][T11856] ? team_add_slave+0x2a2/0x28a0 [ 361.505970][T11856] ? rcu_is_watching+0x15/0xb0 [ 361.510758][T11856] ? team_add_slave+0x2a2/0x28a0 [ 361.515703][T11856] ? __kmalloc+0xe5/0x240 [ 361.520050][T11856] team_add_slave+0x703/0x28a0 [ 361.524887][T11856] ? team_netpoll_cleanup+0xf0/0xf0 [ 361.530145][T11856] ? __dev_change_flags+0x4d2/0x6a0 [ 361.535395][T11856] ? dev_get_flags+0x1c0/0x1c0 [ 361.540180][T11856] ? printk_sprint+0x460/0x460 [ 361.544967][T11856] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 361.550884][T11856] ? mutex_is_locked+0x12/0x40 [ 361.555667][T11856] do_setlink+0xcde/0x3f40 [ 361.560191][T11856] ? load_image+0x420/0x420 [ 361.564711][T11856] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 361.571090][T11856] ? stack_trace_save+0xaa/0x100 [ 361.576133][T11856] ? stack_trace_snprint+0xf0/0xf0 [ 361.581289][T11856] ? __nla_validate+0x50/0x50 [ 361.586109][T11856] ? validate_linkmsg+0x719/0x910 [ 361.591156][T11856] rtnl_newlink+0x1848/0x2170 [ 361.595864][T11856] ? rtnl_newlink+0x4a1/0x2170 [ 361.600656][T11856] ? rtnl_setlink+0x4e0/0x4e0 [ 361.605346][T11856] ? trace_raw_output_contention_end+0xd0/0xd0 [ 361.611607][T11856] ? rcu_is_watching+0x15/0xb0 [ 361.616395][T11856] ? trace_contention_end+0x39/0xe0 [ 361.622077][T11856] ? __mutex_lock+0x30d/0xc80 [ 361.626970][T11856] ? rtnl_setlink+0x4e0/0x4e0 [ 361.631688][T11856] rtnetlink_rcv_msg+0x843/0xf90 [ 361.636643][T11856] ? rtnetlink_rcv_msg+0x220/0xf90 [ 361.641780][T11856] ? rtnetlink_bind+0x80/0x80 [ 361.646507][T11856] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 361.652592][T11856] ? lock_chain_count+0x20/0x20 [ 361.657466][T11856] ? __local_bh_enable_ip+0x13a/0x1c0 [ 361.662856][T11856] ? lockdep_hardirqs_on+0x98/0x150 [ 361.668095][T11856] ? __local_bh_enable_ip+0x13a/0x1c0 [ 361.673483][T11856] ? _local_bh_enable+0xa0/0xa0 [ 361.678353][T11856] ? __dev_queue_xmit+0x272/0x37e0 [ 361.683477][T11856] ? __dev_queue_xmit+0x1329/0x37e0 [ 361.688691][T11856] ? __dev_queue_xmit+0x272/0x37e0 [ 361.693837][T11856] ? ref_tracker_free+0x686/0x830 [ 361.698896][T11856] netlink_rcv_skb+0x235/0x4c0 [ 361.703844][T11856] ? rtnetlink_bind+0x80/0x80 [ 361.708540][T11856] ? netlink_ack+0x1160/0x1160 [ 361.713334][T11856] ? __lock_acquire+0x7d80/0x7d80 [ 361.718381][T11856] ? netlink_deliver_tap+0x2e/0x1b0 [ 361.723687][T11856] netlink_unicast+0x7b1/0x930 [ 361.728481][T11856] netlink_sendmsg+0x8d0/0xbf0 [ 361.733271][T11856] ? netlink_getsockopt+0x590/0x590 [ 361.738485][T11856] ? apparmor_socket_sendmsg+0x8e/0x330 [ 361.744135][T11856] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 361.749436][T11856] ? security_socket_sendmsg+0x80/0xa0 [ 361.754907][T11856] ? netlink_getsockopt+0x590/0x590 [ 361.760125][T11856] ____sys_sendmsg+0x61b/0x980 [ 361.764923][T11856] ? __asan_memset+0x22/0x40 [ 361.769553][T11856] ? __sys_sendmsg_sock+0x30/0x30 [ 361.774612][T11856] ? __import_iovec+0x5f2/0x850 [ 361.779590][T11856] ? import_iovec+0x73/0xa0 [ 361.784126][T11856] ___sys_sendmsg+0x2a6/0x360 [ 361.788851][T11856] ? get_pid_task+0x20/0x1e0 [ 361.793554][T11856] ? __sys_sendmsg+0x2b0/0x2b0 [ 361.798377][T11856] ? __lock_acquire+0x7d80/0x7d80 [ 361.803445][T11856] __se_sys_sendmsg+0x1d0/0x2c0 [ 361.808322][T11856] ? __x64_sys_sendmsg+0x80/0x80 [ 361.813378][T11856] ? lockdep_hardirqs_on+0x98/0x150 [ 361.818682][T11856] do_syscall_64+0x55/0xb0 [ 361.823147][T11856] ? clear_bhb_loop+0x40/0x90 [ 361.827843][T11856] ? clear_bhb_loop+0x40/0x90 [ 361.832574][T11856] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 361.838487][T11856] RIP: 0033:0x7f10b559e159 [ 361.843021][T11856] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 361.862647][T11856] RSP: 002b:00007f10b643a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 361.871250][T11856] RAX: ffffffffffffffda RBX: 00007f10b5825fa0 RCX: 00007f10b559e159 [ 361.879432][T11856] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 361.887511][T11856] RBP: 00007f10b643a090 R08: 0000000000000000 R09: 0000000000000000 [ 361.895670][T11856] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 361.903659][T11856] R13: 00007f10b5826038 R14: 00007f10b5825fa0 R15: 00007ffd830f4d78 [ 361.911749][T11856] [ 361.926330][T11856] team0: Device wg1 is of different type [ 361.946040][T11854] netlink: 'syz.0.1997': attribute type 4 has an invalid length. [ 362.032621][T11861] netlink: 192 bytes leftover after parsing attributes in process `syz.0.1997'. [ 362.278078][T11876] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.2006'. [ 363.116899][T11900] netlink: 'syz.1.2015': attribute type 4 has an invalid length. [ 363.302222][T11905] netlink: 192 bytes leftover after parsing attributes in process `syz.1.2015'. [ 363.433833][T11909] netlink: 'syz.3.2019': attribute type 25 has an invalid length. [ 363.446206][T11909] netlink: 'syz.3.2019': attribute type 10 has an invalid length. [ 363.620576][T11913] netlink: 'syz.3.2020': attribute type 29 has an invalid length. [ 366.332743][T11922] FAULT_INJECTION: forcing a failure. [ 366.332743][T11922] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 366.346102][T11922] CPU: 1 PID: 11922 Comm: syz.2.2021 Not tainted syzkaller #0 [ 366.353624][T11922] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 366.363820][T11922] Call Trace: [ 366.367135][T11922] [ 366.370109][T11922] dump_stack_lvl+0x18c/0x250 [ 366.374853][T11922] ? show_regs_print_info+0x20/0x20 [ 366.380104][T11922] ? load_image+0x420/0x420 [ 366.384678][T11922] ? __might_fault+0xaa/0x120 [ 366.389755][T11922] ? __lock_acquire+0x7d80/0x7d80 [ 366.394915][T11922] should_fail_ex+0x394/0x4c0 [ 366.399639][T11922] _copy_from_user+0x2f/0xe0 [ 366.404272][T11922] ___sys_sendmsg+0x1c7/0x360 [ 366.409015][T11922] ? get_pid_task+0x20/0x1e0 [ 366.413640][T11922] ? __sys_sendmsg+0x2b0/0x2b0 [ 366.418437][T11922] ? __lock_acquire+0x7d80/0x7d80 [ 366.423501][T11922] __se_sys_sendmsg+0x1d0/0x2c0 [ 366.428456][T11922] ? __x64_sys_sendmsg+0x80/0x80 [ 366.433507][T11922] ? lockdep_hardirqs_on+0x98/0x150 [ 366.438738][T11922] do_syscall_64+0x55/0xb0 [ 366.443236][T11922] ? clear_bhb_loop+0x40/0x90 [ 366.447938][T11922] ? clear_bhb_loop+0x40/0x90 [ 366.452848][T11922] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 366.458797][T11922] RIP: 0033:0x7f622fb9e159 [ 366.463246][T11922] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 366.483333][T11922] RSP: 002b:00007f6230b44028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 366.491854][T11922] RAX: ffffffffffffffda RBX: 00007f622fe25fa0 RCX: 00007f622fb9e159 [ 366.499935][T11922] RDX: 0000000000098010 RSI: 0000200000000240 RDI: 0000000000000003 [ 366.507950][T11922] RBP: 00007f6230b44090 R08: 0000000000000000 R09: 0000000000000000 [ 366.516049][T11922] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 366.524487][T11922] R13: 00007f622fe26038 R14: 00007f622fe25fa0 R15: 00007fff312aaa18 [ 366.532505][T11922] [ 367.213913][T11946] FAULT_INJECTION: forcing a failure. [ 367.213913][T11946] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 367.229099][T11946] CPU: 0 PID: 11946 Comm: syz.0.2032 Not tainted syzkaller #0 [ 367.236617][T11946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 367.246716][T11946] Call Trace: [ 367.250077][T11946] [ 367.253040][T11946] dump_stack_lvl+0x18c/0x250 [ 367.257781][T11946] ? show_regs_print_info+0x20/0x20 [ 367.263029][T11946] ? load_image+0x420/0x420 [ 367.267594][T11946] ? __might_fault+0xaa/0x120 [ 367.272330][T11946] should_fail_ex+0x394/0x4c0 [ 367.277099][T11946] copyin+0x1a/0x90 [ 367.280969][T11946] _copy_from_iter+0x532/0x1290 [ 367.285895][T11946] ? copyout_mc+0x70/0x70 [ 367.290264][T11946] ? __virt_addr_valid+0x10c/0x380 [ 367.295414][T11946] ? __virt_addr_valid+0x10c/0x380 [ 367.300548][T11946] ? __virt_addr_valid+0x10c/0x380 [ 367.305680][T11946] ? __check_object_size+0x4fc/0xa40 [ 367.310992][T11946] skb_copy_datagram_from_iter+0xf2/0x6f0 [ 367.316849][T11946] ? dev_get_by_index+0x22/0x2d0 [ 367.321848][T11946] ? skb_put+0x112/0x210 [ 367.326144][T11946] packet_sendmsg+0x3323/0x4a30 [ 367.331043][T11946] ? aa_sk_perm+0x970/0x970 [ 367.335619][T11946] ? __might_sleep+0xe0/0xe0 [ 367.340261][T11946] ? verify_lock_unused+0x140/0x140 [ 367.345519][T11946] ? aa_sk_perm+0x83c/0x970 [ 367.350089][T11946] ? packet_getsockopt+0xad0/0xad0 [ 367.355343][T11946] ? tomoyo_check_open_permission+0x340/0x460 [ 367.361548][T11946] ? aa_sock_msg_perm+0x94/0x150 [ 367.366540][T11946] ? apparmor_socket_sendmsg+0x8e/0x330 [ 367.372143][T11946] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 367.377485][T11946] ? security_socket_sendmsg+0x80/0xa0 [ 367.382996][T11946] ? packet_getsockopt+0xad0/0xad0 [ 367.388174][T11946] ____sys_sendmsg+0x61b/0x980 [ 367.392999][T11946] ? __asan_memset+0x22/0x40 [ 367.397637][T11946] ? __sys_sendmsg_sock+0x30/0x30 [ 367.402788][T11946] ? __import_iovec+0x3fa/0x850 [ 367.407698][T11946] ? import_iovec+0x73/0xa0 [ 367.412255][T11946] ___sys_sendmsg+0x2a6/0x360 [ 367.417341][T11946] ? __sys_sendmsg+0x2b0/0x2b0 [ 367.422175][T11946] ? trace_call_bpf+0xc3/0x6c0 [ 367.427004][T11946] __se_sys_sendmsg+0x1d0/0x2c0 [ 367.431896][T11946] ? perf_trace_preemptirq_template+0x269/0x330 [ 367.438184][T11946] ? __x64_sys_sendmsg+0x80/0x80 [ 367.443185][T11946] ? lockdep_hardirqs_on+0x98/0x150 [ 367.448438][T11946] do_syscall_64+0x55/0xb0 [ 367.452899][T11946] ? clear_bhb_loop+0x40/0x90 [ 367.457620][T11946] ? clear_bhb_loop+0x40/0x90 [ 367.462348][T11946] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 367.468460][T11946] RIP: 0033:0x7f81b1d9e159 [ 367.472929][T11946] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 367.492778][T11946] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 367.501466][T11946] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 367.509497][T11946] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 367.517784][T11946] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 367.526051][T11946] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 367.534235][T11946] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 367.542295][T11946] [ 368.141810][T11976] netlink: 'syz.1.2044': attribute type 21 has an invalid length. [ 368.156741][T11976] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2044'. [ 368.167942][T11976] netlink: 'syz.1.2044': attribute type 1 has an invalid length. [ 370.812121][T11983] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2045'. [ 371.032129][T11990] netlink: 'syz.2.2050': attribute type 10 has an invalid length. [ 371.061876][T11990] team0: Device wg1 is of different type [ 371.430345][T12001] syzkaller0: entered promiscuous mode [ 371.436116][T12001] syzkaller0: entered allmulticast mode [ 374.339289][T12042] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2064'. [ 374.348654][T12042] ipvlan0: entered promiscuous mode [ 374.373222][T12042] ipvlan0: left allmulticast mode [ 375.899037][T12070] FAULT_INJECTION: forcing a failure. [ 375.899037][T12070] name failslab, interval 1, probability 0, space 0, times 0 [ 375.919999][T12070] CPU: 0 PID: 12070 Comm: syz.0.2073 Not tainted syzkaller #0 [ 375.927717][T12070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 375.937801][T12070] Call Trace: [ 375.941121][T12070] [ 375.944176][T12070] dump_stack_lvl+0x18c/0x250 [ 375.948927][T12070] ? show_regs_print_info+0x20/0x20 [ 375.954149][T12070] ? load_image+0x420/0x420 [ 375.958785][T12070] ? __lock_acquire+0x7d80/0x7d80 [ 375.963916][T12070] should_fail_ex+0x394/0x4c0 [ 375.968624][T12070] should_failslab+0x9/0x20 [ 375.973228][T12070] slab_pre_alloc_hook+0x59/0x300 [ 375.978453][T12070] ? __lock_acquire+0x7d80/0x7d80 [ 375.983508][T12070] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 375.989517][T12070] kmem_cache_alloc+0x5a/0x2c0 [ 375.994490][T12070] ? rxrpc_alloc_call+0x274/0xc60 [ 375.999574][T12070] ? rxrpc_alloc_call+0x79/0xc60 [ 376.004645][T12070] rxrpc_alloc_call+0x274/0xc60 [ 376.009721][T12070] rxrpc_new_client_call+0xea/0x1400 [ 376.015076][T12070] rxrpc_do_sendmsg+0xe03/0x12d0 [ 376.020107][T12070] ? rxrpc_propose_abort+0x1f0/0x1f0 [ 376.025462][T12070] ? __local_bh_enable_ip+0x13a/0x1c0 [ 376.030875][T12070] ? rxrpc_sendmsg+0x373/0x5b0 [ 376.035764][T12070] ? rxrpc_getsockopt+0x150/0x150 [ 376.040812][T12070] ____sys_sendmsg+0x61b/0x980 [ 376.045600][T12070] ? __sys_sendmsg_sock+0x30/0x30 [ 376.050625][T12070] ? __import_iovec+0x5f2/0x850 [ 376.055520][T12070] ? import_iovec+0x73/0xa0 [ 376.060142][T12070] ___sys_sendmsg+0x2a6/0x360 [ 376.064866][T12070] ? get_pid_task+0x20/0x1e0 [ 376.069514][T12070] ? __sys_sendmsg+0x2b0/0x2b0 [ 376.074373][T12070] ? __lock_acquire+0x7d80/0x7d80 [ 376.079482][T12070] __se_sys_sendmsg+0x1d0/0x2c0 [ 376.084386][T12070] ? __x64_sys_sendmsg+0x80/0x80 [ 376.089345][T12070] ? lockdep_hardirqs_on+0x98/0x150 [ 376.094923][T12070] do_syscall_64+0x55/0xb0 [ 376.099370][T12070] ? clear_bhb_loop+0x40/0x90 [ 376.104095][T12070] ? clear_bhb_loop+0x40/0x90 [ 376.108827][T12070] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 376.114770][T12070] RIP: 0033:0x7f81b1d9e159 [ 376.119231][T12070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 376.138964][T12070] RSP: 002b:00007f81b2ba7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 376.147435][T12070] RAX: ffffffffffffffda RBX: 00007f81b2025fa0 RCX: 00007f81b1d9e159 [ 376.155457][T12070] RDX: 0000000000008000 RSI: 0000200000000000 RDI: 0000000000000003 [ 376.163460][T12070] RBP: 00007f81b2ba7090 R08: 0000000000000000 R09: 0000000000000000 [ 376.171467][T12070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 376.179698][T12070] R13: 00007f81b2026038 R14: 00007f81b2025fa0 R15: 00007ffffb14e5b8 [ 376.187831][T12070] [ 376.694814][T12091] netlink: 'syz.3.2080': attribute type 10 has an invalid length. [ 376.802880][T12091] team0: Device wg1 is of different type [ 377.700445][T12126] bond0: entered promiscuous mode [ 377.720342][T12126] bond_slave_0: entered promiscuous mode [ 377.726240][T12126] bond_slave_1: entered promiscuous mode [ 377.733070][T12126] bond0: entered allmulticast mode [ 377.738241][T12126] bond_slave_0: entered allmulticast mode [ 377.754277][T12126] bond_slave_1: entered allmulticast mode [ 378.973654][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.981238][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.253881][T12183] netlink: 'syz.1.2106': attribute type 29 has an invalid length. [ 379.291218][T12183] netlink: 'syz.1.2106': attribute type 29 has an invalid length. [ 379.477035][T12187] netlink: 'syz.1.2106': attribute type 29 has an invalid length. [ 379.507542][T12168] delete_channel: no stack [ 379.520434][T12168] delete_channel: no stack [ 379.525839][T12183] netlink: 'syz.1.2106': attribute type 29 has an invalid length. [ 379.633844][T12168] delete_channel: no stack [ 379.651461][T12168] delete_channel: no stack [ 379.664542][T12168] delete_channel: no stack [ 379.669766][T12185] netlink: 'syz.1.2106': attribute type 29 has an invalid length. [ 379.678305][T12168] delete_channel: no stack [ 379.684358][T12168] delete_channel: no stack [ 379.690547][T12168] delete_channel: no stack [ 379.699447][T12168] delete_channel: no stack [ 379.704304][T12168] delete_channel: no stack [ 379.719604][T12168] delete_channel: no stack [ 379.726537][T12168] delete_channel: no stack [ 379.740514][T12168] delete_channel: no stack [ 379.752330][T12168] delete_channel: no stack [ 379.757931][T12168] delete_channel: no stack [ 379.764901][T12168] delete_channel: no stack [ 379.770485][T12168] delete_channel: no stack [ 379.775877][T12168] delete_channel: no stack [ 379.781806][T12168] delete_channel: no stack [ 379.786564][T12168] delete_channel: no stack [ 379.791872][T12168] delete_channel: no stack [ 379.796589][T12168] delete_channel: no stack [ 379.801713][T12168] delete_channel: no stack [ 379.806483][T12168] delete_channel: no stack [ 379.817967][T12168] delete_channel: no stack [ 379.835585][T12168] delete_channel: no stack [ 379.841253][T12168] delete_channel: no stack [ 379.846045][T12168] delete_channel: no stack [ 379.851365][T12168] delete_channel: no stack [ 379.856070][T12168] delete_channel: no stack [ 379.862810][T12168] delete_channel: no stack [ 379.870431][T12168] delete_channel: no stack [ 379.887409][T12168] delete_channel: no stack [ 380.600174][T12211] netlink: 'syz.3.2115': attribute type 25 has an invalid length. [ 380.608354][T12211] netlink: 'syz.3.2115': attribute type 10 has an invalid length. [ 381.295351][T12232] netlink: 144 bytes leftover after parsing attributes in process `syz.1.2124'. [ 381.505416][T12232] team0: Port device team_slave_0 removed [ 381.517989][T12232] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 382.736893][T12278] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2138'. [ 383.041579][T12283] netlink: 'syz.0.2140': attribute type 29 has an invalid length. [ 383.066453][T12283] netlink: 'syz.0.2140': attribute type 29 has an invalid length. [ 383.098665][T12289] netlink: 'syz.0.2140': attribute type 29 has an invalid length. [ 383.191151][T12290] netlink: 'syz.0.2140': attribute type 29 has an invalid length. [ 383.208764][T12283] netlink: 'syz.0.2140': attribute type 29 has an invalid length. [ 384.375315][T12320] netlink: 64859 bytes leftover after parsing attributes in process `syz.1.2148'. [ 385.247686][T12334] netlink: 'syz.2.2155': attribute type 21 has an invalid length. [ 385.256550][T12334] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2155'. [ 385.412974][T12338] netlink: 'syz.0.2157': attribute type 46 has an invalid length. [ 385.542831][T12344] netlink: 'syz.2.2160': attribute type 10 has an invalid length. [ 386.498342][T12373] netlink: 'syz.0.2169': attribute type 10 has an invalid length. [ 386.551412][T12373] team0: Device wg1 is of different type [ 386.881231][T12392] netlink: 'syz.0.2175': attribute type 39 has an invalid length. [ 388.032486][T12423] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2183'. [ 391.338978][T12485] bridge0: port 3(syz_tun) entered blocking state [ 391.466671][T12485] bridge0: port 3(syz_tun) entered disabled state [ 391.474162][T12485] syz_tun: entered allmulticast mode [ 391.481538][T12485] syz_tun: entered promiscuous mode [ 391.487847][T12485] bridge0: port 3(syz_tun) entered blocking state [ 391.494867][T12485] bridge0: port 3(syz_tun) entered forwarding state [ 392.936593][T12531] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2211'. [ 393.051695][T12530] delete_channel: no stack [ 393.277800][T12539] netlink: 'syz.2.2212': attribute type 21 has an invalid length. [ 393.296626][T12539] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2212'. [ 393.395752][T12533] virt_wifi0: entered promiscuous mode [ 393.402433][T12533] virt_wifi0: entered allmulticast mode [ 394.886388][T12580] netlink: 192436 bytes leftover after parsing attributes in process `syz.3.2225'. [ 394.940727][T12580] openvswitch: netlink: Duplicate key (type 0). [ 395.711122][T12589] bridge0: port 3(syz_tun) entered blocking state [ 395.718232][T12589] bridge0: port 3(syz_tun) entered disabled state [ 395.736267][T12589] syz_tun: entered allmulticast mode [ 395.770879][T12589] syz_tun: entered promiscuous mode [ 395.779814][T12589] bridge0: port 3(syz_tun) entered blocking state [ 395.786471][T12589] bridge0: port 3(syz_tun) entered forwarding state [ 399.400825][T12654] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.2246'. [ 399.467259][T12654] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.2246'. [ 399.480990][T12659] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.2246'. [ 400.383324][T12683] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2258'. [ 400.500712][T12693] sit0: left promiscuous mode [ 400.814035][T12694] sit0: entered promiscuous mode [ 401.366806][T12718] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2268'. [ 402.148884][T12740] netlink: 'syz.0.2276': attribute type 1 has an invalid length. [ 402.175860][T12740] netlink: 'syz.0.2276': attribute type 3 has an invalid length. [ 402.208900][T12740] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2276'. [ 403.625190][T12750] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2278'. [ 405.853851][T12778] FAULT_INJECTION: forcing a failure. [ 405.853851][T12778] name failslab, interval 1, probability 0, space 0, times 0 [ 405.879189][T12778] CPU: 1 PID: 12778 Comm: syz.3.2288 Not tainted syzkaller #0 [ 405.886734][T12778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 405.896923][T12778] Call Trace: [ 405.900412][T12778] [ 405.903378][T12778] dump_stack_lvl+0x18c/0x250 [ 405.908106][T12778] ? show_regs_print_info+0x20/0x20 [ 405.913373][T12778] ? load_image+0x420/0x420 [ 405.918016][T12778] ? __might_sleep+0xe0/0xe0 [ 405.922735][T12778] ? __lock_acquire+0x7d80/0x7d80 [ 405.927799][T12778] should_fail_ex+0x394/0x4c0 [ 405.932526][T12778] should_failslab+0x9/0x20 [ 405.937347][T12778] slab_pre_alloc_hook+0x59/0x300 [ 405.942434][T12778] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 405.948197][T12778] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 405.954037][T12778] __kmem_cache_alloc_node+0x53/0x250 [ 405.959541][T12778] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 405.965338][T12778] __kmalloc+0xa7/0x240 [ 405.969749][T12778] tomoyo_realpath_from_path+0xe6/0x5c0 [ 405.975517][T12778] ? tomoyo_domain+0xd6/0x120 [ 405.980244][T12778] tomoyo_path_number_perm+0x248/0x5e0 [ 405.985754][T12778] ? tomoyo_path_number_perm+0x217/0x5e0 [ 405.991449][T12778] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 405.996959][T12778] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 406.002819][T12778] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 406.008858][T12778] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 406.015062][T12778] ? tomoyo_file_ioctl+0x11/0x30 [ 406.020051][T12778] security_file_ioctl+0x70/0xa0 [ 406.025030][T12778] __se_sys_ioctl+0x48/0x170 [ 406.029687][T12778] do_syscall_64+0x55/0xb0 [ 406.034164][T12778] ? clear_bhb_loop+0x40/0x90 [ 406.038964][T12778] ? clear_bhb_loop+0x40/0x90 [ 406.043677][T12778] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 406.049617][T12778] RIP: 0033:0x7fad2c79e159 [ 406.054155][T12778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.074054][T12778] RSP: 002b:00007fad2d73e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 406.082615][T12778] RAX: ffffffffffffffda RBX: 00007fad2ca25fa0 RCX: 00007fad2c79e159 [ 406.090701][T12778] RDX: 0000000000000003 RSI: 0000000000002400 RDI: 0000000000000003 [ 406.098796][T12778] RBP: 00007fad2d73e090 R08: 0000000000000000 R09: 0000000000000000 [ 406.106798][T12778] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.114810][T12778] R13: 00007fad2ca26038 R14: 00007fad2ca25fa0 R15: 00007fffefce0768 [ 406.122832][T12778] [ 406.229270][T12778] ERROR: Out of memory at tomoyo_realpath_from_path. [ 406.500615][T12786] FAULT_INJECTION: forcing a failure. [ 406.500615][T12786] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 406.546777][T12786] CPU: 0 PID: 12786 Comm: syz.1.2291 Not tainted syzkaller #0 [ 406.554327][T12786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 406.564424][T12786] Call Trace: [ 406.567765][T12786] [ 406.570743][T12786] dump_stack_lvl+0x18c/0x250 [ 406.575484][T12786] ? show_regs_print_info+0x20/0x20 [ 406.580737][T12786] ? load_image+0x420/0x420 [ 406.585295][T12786] ? __might_fault+0xaa/0x120 [ 406.590023][T12786] should_fail_ex+0x394/0x4c0 [ 406.594764][T12786] copyin+0x1a/0x90 [ 406.598630][T12786] _copy_from_iter+0x532/0x1290 [ 406.603639][T12786] ? copyout_mc+0x70/0x70 [ 406.608024][T12786] ? __virt_addr_valid+0x10c/0x380 [ 406.613191][T12786] ? __virt_addr_valid+0x10c/0x380 [ 406.618523][T12786] ? __virt_addr_valid+0x10c/0x380 [ 406.624036][T12786] ? __check_object_size+0x4fc/0xa40 [ 406.629366][T12786] skb_copy_datagram_from_iter+0xf2/0x6f0 [ 406.635261][T12786] ? dev_get_by_index+0x22/0x2d0 [ 406.640257][T12786] ? skb_put+0x112/0x210 [ 406.644636][T12786] packet_sendmsg+0x3323/0x4a30 [ 406.649535][T12786] ? aa_sk_perm+0x970/0x970 [ 406.651833][T12784] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2290'. [ 406.654178][T12786] ? __might_sleep+0xe0/0xe0 [ 406.654219][T12786] ? verify_lock_unused+0x140/0x140 [ 406.654251][T12786] ? aa_sk_perm+0x83c/0x970 [ 406.678060][T12786] ? packet_getsockopt+0xad0/0xad0 [ 406.683251][T12786] ? tomoyo_check_open_permission+0x340/0x460 [ 406.689477][T12786] ? aa_sock_msg_perm+0x94/0x150 [ 406.694458][T12786] ? apparmor_socket_sendmsg+0x8e/0x330 [ 406.700078][T12786] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 406.705401][T12786] ? security_socket_sendmsg+0x80/0xa0 [ 406.710887][T12786] ? packet_getsockopt+0xad0/0xad0 [ 406.716140][T12786] ____sys_sendmsg+0x61b/0x980 [ 406.720948][T12786] ? __asan_memset+0x22/0x40 [ 406.725657][T12786] ? __sys_sendmsg_sock+0x30/0x30 [ 406.730800][T12786] ? __import_iovec+0x3fa/0x850 [ 406.735734][T12786] ? import_iovec+0x73/0xa0 [ 406.740271][T12786] ___sys_sendmsg+0x2a6/0x360 [ 406.745020][T12786] ? __sys_sendmsg+0x2b0/0x2b0 [ 406.749844][T12786] ? trace_call_bpf+0xc3/0x6c0 [ 406.754673][T12786] __se_sys_sendmsg+0x1d0/0x2c0 [ 406.759560][T12786] ? perf_trace_preemptirq_template+0x269/0x330 [ 406.765844][T12786] ? __x64_sys_sendmsg+0x80/0x80 [ 406.770943][T12786] ? lockdep_hardirqs_on+0x98/0x150 [ 406.776223][T12786] do_syscall_64+0x55/0xb0 [ 406.780684][T12786] ? clear_bhb_loop+0x40/0x90 [ 406.785397][T12786] ? clear_bhb_loop+0x40/0x90 [ 406.790215][T12786] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 406.796257][T12786] RIP: 0033:0x7f10b559e159 [ 406.800709][T12786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 406.820443][T12786] RSP: 002b:00007f10b643a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 406.828900][T12786] RAX: ffffffffffffffda RBX: 00007f10b5825fa0 RCX: 00007f10b559e159 [ 406.836986][T12786] RDX: 0000000000040000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 406.844982][T12786] RBP: 00007f10b643a090 R08: 0000000000000000 R09: 0000000000000000 [ 406.852977][T12786] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 406.860986][T12786] R13: 00007f10b5826038 R14: 00007f10b5825fa0 R15: 00007ffd830f4d78 [ 406.869015][T12786] [ 407.653980][T12804] netlink: 'syz.1.2299': attribute type 46 has an invalid length. [ 409.323804][T12823] netlink: 'syz.3.2304': attribute type 10 has an invalid length. [ 410.852461][T12855] netlink: 'syz.3.2314': attribute type 10 has an invalid length. [ 410.902946][T12855] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2314'. [ 411.003707][T12855] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 412.623217][T12882] netlink: 'syz.0.2321': attribute type 39 has an invalid length. [ 412.957841][T12893] netlink: 'syz.1.2326': attribute type 3 has an invalid length. [ 412.989175][T12893] netlink: 'syz.1.2326': attribute type 16 has an invalid length. [ 412.997088][T12893] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2326'. [ 413.156398][T12899] sit0: left promiscuous mode [ 413.158317][T12893] netlink: 'syz.1.2326': attribute type 29 has an invalid length. [ 413.473732][T12903] sit0: entered promiscuous mode [ 413.627748][T12893] netlink: 'syz.1.2326': attribute type 29 has an invalid length. [ 417.574592][T12979] syzkaller0: entered promiscuous mode [ 417.603648][T12979] syzkaller0: entered allmulticast mode [ 418.034863][ T5787] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 418.044872][ T5787] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 418.054607][ T5787] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 418.078590][ T5787] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 418.086805][ T5787] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 418.094610][ T5787] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 420.173702][ T5787] Bluetooth: hci4: command tx timeout [ 420.699166][T13002] netlink: 4068 bytes leftover after parsing attributes in process `syz.2.2353'. [ 420.958930][T12990] chnl_net:caif_netlink_parms(): no params data found [ 421.092532][T13021] netlink: 'syz.0.2359': attribute type 21 has an invalid length. [ 421.235272][T12990] bridge0: port 1(bridge_slave_0) entered blocking state [ 421.245090][T12990] bridge0: port 1(bridge_slave_0) entered disabled state [ 421.256141][T12990] bridge_slave_0: entered allmulticast mode [ 421.266403][T12990] bridge_slave_0: entered promiscuous mode [ 421.277380][T12990] bridge0: port 2(bridge_slave_1) entered blocking state [ 421.285777][T12990] bridge0: port 2(bridge_slave_1) entered disabled state [ 421.296292][T12990] bridge_slave_1: entered allmulticast mode [ 421.304364][T12990] bridge_slave_1: entered promiscuous mode [ 421.359970][T12990] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 421.377584][T12990] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.427361][T12990] team0: Port device team_slave_0 added [ 421.438398][T12990] team0: Port device team_slave_1 added [ 421.483015][T12990] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 421.493443][T12990] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 421.523137][T12990] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 421.537533][T12990] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 421.546359][T12990] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 421.579665][T12990] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 421.734861][T12990] hsr_slave_0: entered promiscuous mode [ 421.744066][T12990] hsr_slave_1: entered promiscuous mode [ 422.249189][ T5787] Bluetooth: hci4: command tx timeout [ 422.414683][T12990] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.543676][T12990] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 422.663071][T12990] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 423.323911][T13057] sit0: left promiscuous mode [ 423.716248][T12990] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 423.740044][T13061] sit0: entered promiscuous mode [ 423.873341][T12990] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 423.901397][T12990] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 423.977275][T12990] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 424.314801][T13083] syzkaller0: entered promiscuous mode [ 424.323376][T13083] syzkaller0: entered allmulticast mode [ 424.329810][ T5787] Bluetooth: hci4: command tx timeout [ 426.409494][ T5787] Bluetooth: hci4: command tx timeout [ 429.542301][T12990] 8021q: adding VLAN 0 to HW filter on device bond0 [ 429.673176][T12990] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.697550][ T8407] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.704877][ T8407] bridge0: port 1(bridge_slave_0) entered forwarding state [ 429.730289][ T8407] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.737519][ T8407] bridge0: port 2(bridge_slave_1) entered forwarding state [ 430.051982][T12990] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 430.091210][T12990] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 431.221207][T10665] vlan0: left allmulticast mode [ 431.226467][T10665] veth0_vlan: left allmulticast mode [ 431.260160][T10665] vlan0: left promiscuous mode [ 431.277333][T10665] À: port 1(vlan0) entered disabled state [ 434.285038][T10665] bridge_slave_0: left allmulticast mode [ 434.299208][T10665] bridge_slave_0: left promiscuous mode [ 434.305188][T10665] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.361738][T10665] veth1_macvtap: left promiscuous mode [ 434.367910][T10665] veth1_vlan: left promiscuous mode [ 434.373973][T10665] veth0_vlan: left promiscuous mode [ 435.094335][T10665] team0 (unregistering): Port device team_slave_1 removed [ 435.183000][T10665] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 435.229950][T10665] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 435.281766][T10665] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 435.531919][T10665] team0 (unregistering): Port device dummy0 removed [ 435.560381][T10665] team0 (unregistering): Port device bond0 removed [ 435.593097][T10665] bond0 (unregistering): Released all slaves [ 435.916378][T12990] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.148785][T12990] veth0_vlan: entered promiscuous mode [ 436.196777][T12990] veth1_vlan: entered promiscuous mode [ 436.275016][T12990] veth0_macvtap: entered promiscuous mode [ 436.301168][T12990] veth1_macvtap: entered promiscuous mode [ 436.342794][T13181] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2422'. [ 436.383372][T12990] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 436.413084][T13185] netlink: 830 bytes leftover after parsing attributes in process `syz.0.2424'. [ 436.445270][T12990] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 436.496450][T12990] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.506814][T12990] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.517003][T12990] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.528133][T12990] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 436.879480][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.897644][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 437.104860][T10665] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 437.114219][T10665] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 438.515105][T13224] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2436'. [ 438.818156][T13230] bridge0: port 3(syz_tun) entered blocking state [ 438.827537][T13230] bridge0: port 3(syz_tun) entered disabled state [ 438.834830][T13230] syz_tun: entered allmulticast mode [ 438.843325][T13230] syz_tun: entered promiscuous mode [ 438.865503][T13230] bridge0: port 3(syz_tun) entered blocking state [ 438.872285][T13230] bridge0: port 3(syz_tun) entered listening state [ 438.934783][ T5783] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 438.944321][ T5783] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 438.956722][ T5783] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 438.971229][ T5783] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 438.981821][ T5783] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 438.990926][ T5783] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 439.312979][ T5780] bridge0: port 3(syz_tun) entered disabled state [ 439.348222][ T5780] syz_tun (unregistering): left allmulticast mode [ 439.354976][ T5780] syz_tun (unregistering): left promiscuous mode [ 439.370339][ T5780] bridge0: port 3(syz_tun) entered disabled state [ 439.589811][T13232] chnl_net:caif_netlink_parms(): no params data found [ 439.749642][T13232] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.757152][T13232] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.764833][T13232] bridge_slave_0: entered allmulticast mode [ 439.773969][T13232] bridge_slave_0: entered promiscuous mode [ 439.793709][T13232] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.801454][T13232] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.812354][T13232] bridge_slave_1: entered allmulticast mode [ 439.824102][T13232] bridge_slave_1: entered promiscuous mode [ 439.865744][ T5787] Bluetooth: hci4: SCO packet for unknown connection handle 0 [ 439.876410][T13232] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 439.900029][T13232] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 439.953162][T13232] team0: Port device team_slave_0 added [ 439.968208][T13232] team0: Port device team_slave_1 added [ 440.057105][T13232] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 440.066785][T13232] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 440.103635][T13232] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 440.119740][T13232] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 440.136783][T13232] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 440.167434][T13232] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 440.242405][T13232] hsr_slave_0: entered promiscuous mode [ 440.260285][T13232] hsr_slave_1: entered promiscuous mode [ 440.266815][T13232] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 440.286151][T13232] Cannot create hsr debugfs directory [ 440.383666][T13268] mac80211_hwsim hwsim15 ..ãc¤±: renamed from wlan1 (while UP) [ 440.425820][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.432502][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.883475][T13232] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.200628][T13232] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.228995][ T5787] Bluetooth: hci0: command tx timeout [ 441.531867][T13232] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 441.945660][T13232] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 442.758090][T13232] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 442.775002][T13232] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 442.787922][T13232] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 443.303837][ T5787] Bluetooth: hci0: command tx timeout [ 443.402325][T13232] 8021q: adding VLAN 0 to HW filter on device bond0 [ 443.444668][T13232] 8021q: adding VLAN 0 to HW filter on device team0 [ 443.493573][ T2920] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.501007][ T2920] bridge0: port 1(bridge_slave_0) entered forwarding state [ 443.531887][ T2920] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.539140][ T2920] bridge0: port 2(bridge_slave_1) entered forwarding state [ 443.634163][T13340] netlink: 'syz.3.2483': attribute type 1 has an invalid length. [ 443.642868][T13340] netlink: 'syz.3.2483': attribute type 4 has an invalid length. [ 443.661980][T13346] netlink: 1057 bytes leftover after parsing attributes in process `syz.1.2484'. [ 443.677848][T13340] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2483'. [ 443.691044][T13346] netlink: 121460 bytes leftover after parsing attributes in process `syz.1.2484'. [ 443.723800][T13346] netlink: 21068 bytes leftover after parsing attributes in process `syz.1.2484'. [ 443.736607][T13346] tipc: Started in network mode [ 443.742394][T13346] tipc: Node identity b, cluster identity 73 [ 443.748658][T13346] tipc: Node number set to 11 [ 444.256331][T13232] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 444.341425][T13232] veth0_vlan: entered promiscuous mode [ 444.368334][T13232] veth1_vlan: entered promiscuous mode [ 444.436763][T13232] veth0_macvtap: entered promiscuous mode [ 444.459928][T13232] veth1_macvtap: entered promiscuous mode [ 444.496308][T13232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 444.510406][T13232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 444.524606][T13232] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 444.545575][T13232] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 444.558247][T13232] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 444.583911][T13232] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 444.606926][T13232] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.617274][T13232] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.631336][T13232] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.640709][T13232] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 444.814420][T10665] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.832796][T10665] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 444.890808][T10665] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 444.901518][T10665] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.143982][T13380] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2434'. [ 445.207691][T13380] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2434'. [ 445.293452][T13380] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2434'. [ 445.344678][T13380] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2434'. [ 445.389388][ T5787] Bluetooth: hci0: command tx timeout [ 445.407529][T13380] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2434'. [ 445.494090][T13380] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2434'. [ 445.879607][T13390] netlink: 'syz.3.2499': attribute type 10 has an invalid length. [ 445.905695][T13390] team0: Device wg1 is of different type [ 446.259476][ T5782] bridge0: port 3(syz_tun) entered disabled state [ 446.317502][ T5783] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 446.330428][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 446.338785][ T5783] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 446.366156][ T5782] syz_tun (unregistering): left allmulticast mode [ 446.373964][ T5783] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 446.390180][ T5783] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 446.397367][ T5782] syz_tun (unregistering): left promiscuous mode [ 446.399104][ T5783] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 446.415330][ T5782] bridge0: port 3(syz_tun) entered disabled state [ 446.584860][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.736514][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.854968][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.363668][ T12] netdevsim netdevsim0 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.407666][T13398] chnl_net:caif_netlink_parms(): no params data found [ 447.450556][ T5787] Bluetooth: hci0: command tx timeout [ 447.779865][T13398] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.814443][T13398] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.851731][T13398] bridge_slave_0: entered allmulticast mode [ 447.901398][T13398] bridge_slave_0: entered promiscuous mode [ 448.164153][T13398] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.230033][T13398] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.295146][T13398] bridge_slave_1: entered allmulticast mode [ 448.389974][T13398] bridge_slave_1: entered promiscuous mode [ 448.503393][ T5787] Bluetooth: hci2: command tx timeout [ 448.703298][T13398] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.753152][T13398] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 449.002262][T13447] netlink: 'syz.3.2521': attribute type 21 has an invalid length. [ 449.094909][T13398] team0: Port device team_slave_0 added [ 449.134202][T13398] team0: Port device team_slave_1 added [ 449.317408][T13398] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 449.342824][T13398] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 449.409218][T13398] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 449.620089][T13398] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 449.637467][T13398] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 449.714505][T13398] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 450.111940][T13398] hsr_slave_0: entered promiscuous mode [ 450.126872][T13398] hsr_slave_1: entered promiscuous mode [ 450.165226][T13398] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 450.195740][T13398] Cannot create hsr debugfs directory [ 450.302914][T13485] __nla_validate_parse: 59 callbacks suppressed [ 450.302933][T13485] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2530'. [ 450.369038][T13485] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2530'. [ 450.569158][ T5787] Bluetooth: hci2: command tx timeout [ 450.594760][T13488] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2530'. [ 450.605301][T13485] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2530'. [ 450.686157][T13492] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.694151][T13492] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.707775][T13492] bridge0: entered allmulticast mode [ 450.762279][T13494] bridge_slave_1: left allmulticast mode [ 450.769269][T13494] bridge_slave_1: left promiscuous mode [ 450.790310][T13494] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.809146][T13494] bridge_slave_0: left allmulticast mode [ 450.815250][T13494] bridge_slave_0: left promiscuous mode [ 450.835861][T13494] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.649296][ T5787] Bluetooth: hci2: command tx timeout [ 453.434440][ T12] bridge_slave_1: left allmulticast mode [ 453.464880][ T12] bridge_slave_1: left promiscuous mode [ 453.486643][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 453.536960][ T12] bridge_slave_0: left allmulticast mode [ 453.555985][ T12] bridge_slave_0: left promiscuous mode [ 453.573243][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 453.645112][ T12] veth1_macvtap: left promiscuous mode [ 453.652159][ T12] veth0_macvtap: left promiscuous mode [ 453.663951][ T12] veth1_vlan: left promiscuous mode [ 453.671966][ T12] veth0_vlan: left promiscuous mode [ 454.505087][ C1] bridge0: port 3(syz_tun) entered learning state [ 454.744512][ T5787] Bluetooth: hci2: command tx timeout [ 455.340974][ T12] team_slave_1 (unregistering): left allmulticast mode [ 455.352795][ T12] team0 (unregistering): Port device team_slave_1 removed [ 455.428051][ T12] team_slave_0 (unregistering): left allmulticast mode [ 455.449912][ T12] team0 (unregistering): Port device team_slave_0 removed [ 455.517528][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 455.992608][ T12] bond0 (unregistering): Released all slaves [ 456.219348][T13611] sit0: entered allmulticast mode [ 456.257298][T13613] sit0: entered promiscuous mode [ 456.439117][T13398] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 456.705302][T13398] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 456.949750][T13398] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 457.319531][T13398] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 457.470561][ T5787] Bluetooth: hci0: unexpected subevent 0x01 length: 150 > 18 [ 457.633313][T13398] 8021q: adding VLAN 0 to HW filter on device bond0 [ 457.941487][T13649] sctp: [Deprecated]: syz.3.2576 (pid 13649) Use of int in maxseg socket option. [ 457.941487][T13649] Use struct sctp_assoc_value instead [ 458.003618][T13398] 8021q: adding VLAN 0 to HW filter on device team0 [ 458.056849][ T8412] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.064104][ T8412] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.114408][ T8398] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.121647][ T8398] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.866649][T13398] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 458.953106][T13398] veth0_vlan: entered promiscuous mode [ 458.988835][T13398] veth1_vlan: entered promiscuous mode [ 459.039455][T13398] veth0_macvtap: entered promiscuous mode [ 459.063026][T13398] veth1_macvtap: entered promiscuous mode [ 459.094678][T13398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 459.106708][T13398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.120816][T13398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 459.133748][T13398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.152534][T13398] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 459.176863][T13398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 459.190520][T13398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.204605][T13398] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 459.218314][T13398] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 459.234136][T13398] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 459.261948][T13398] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.277941][T13398] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.287703][T13398] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.301067][T13398] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.493102][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 459.525002][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.529267][ T5783] Bluetooth: hci0: command tx timeout [ 459.592954][T10665] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 459.601563][T10665] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.794251][T13685] syzkaller0: entered promiscuous mode [ 459.812829][T13685] syzkaller0: entered allmulticast mode [ 460.881008][ C1] [ 460.883428][ C1] ====================================================== [ 460.890572][ C1] WARNING: possible circular locking dependency detected [ 460.897882][ C1] syzkaller #0 Not tainted [ 460.899548][ T5781] bridge0: port 3(syz_tun) entered disabled state [ 460.902303][ C1] ------------------------------------------------------ [ 460.902312][ C1] syz.2.2599/13709 is trying to acquire lock: [ 460.922189][ C1] ffff88805f51e238 (&trie->lock){-.-.}-{2:2}, at: trie_delete_elem+0x94/0x630 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 460.931149][ C1] [ 460.931149][ C1] but task is already holding lock: [ 460.938565][ C1] ffff8880b8f37da8 (stock_lock){-.-.}-{2:2}, at: refill_obj_stock+0xef/0x6a0 [ 460.947454][ C1] [ 460.947454][ C1] which lock already depends on the new lock. [ 460.947454][ C1] [ 460.957886][ C1] [ 460.957886][ C1] the existing dependency chain (in reverse order) is: [ 460.966935][ C1] [ 460.966935][ C1] -> #1 (stock_lock){-.-.}-{2:2}: [ 460.974169][ C1] try_charge_memcg+0x237/0x17c0 [ 460.979910][ C1] __memcg_kmem_charge_page+0x224/0x380 [ 460.986172][ C1] __alloc_pages+0x222/0x460 [ 460.991496][ C1] __kmalloc_large_node+0x8c/0x1f0 [ 460.997140][ C1] __kmalloc_node+0x112/0x240 [ 461.002363][ C1] bpf_map_kmalloc_node+0xbc/0x1b0 [ 461.008005][ C1] trie_update_elem+0x172/0xd60 [ 461.013387][ C1] bpf_map_update_value+0x64b/0x710 [ 461.019394][ C1] map_update_elem+0x586/0x710 [ 461.024780][ C1] __sys_bpf+0x6b5/0x890 [ 461.029576][ C1] __x64_sys_bpf+0x7c/0x90 [ 461.034624][ C1] do_syscall_64+0x55/0xb0 [ 461.039707][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 461.046241][ C1] [ 461.046241][ C1] -> #0 (&trie->lock){-.-.}-{2:2}: [ 461.053645][ C1] __lock_acquire+0x37ef/0x7d80 [ 461.059042][ C1] lock_acquire+0x19e/0x420 [ 461.064074][ C1] _raw_spin_lock_irqsave+0xb4/0x100 [ 461.069918][ C1] trie_delete_elem+0x94/0x630 [ 461.075216][ C1] bpf_prog_b23e3725e72cf264+0x4a/0x4e [ 461.081209][ C1] trace_call_bpf+0x333/0x6c0 [ 461.086419][ C1] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 461.092502][ C1] perf_trace_lock_acquire+0x342/0x400 [ 461.098494][ C1] lock_acquire+0x3ef/0x420 [ 461.103523][ C1] mod_objcg_mlstate+0xad/0x320 [ 461.108902][ C1] drain_obj_stock+0x1e3/0x3a0 [ 461.114208][ C1] refill_obj_stock+0x1fc/0x6a0 [ 461.119589][ C1] memcg_slab_free_hook+0x123/0x200 [ 461.125316][ C1] kmem_cache_free+0xe1/0x290 [ 461.130527][ C1] rcu_core+0x9c1/0x17f0 [ 461.135318][ C1] handle_softirqs+0x27d/0x820 [ 461.140661][ C1] do_softirq+0xfa/0x1a0 [ 461.145479][ C1] __local_bh_enable_ip+0x184/0x1c0 [ 461.151242][ C1] tipc_sk_rcv+0x252a/0x2ae0 [ 461.156435][ C1] tipc_node_xmit+0x22f/0x1040 [ 461.161827][ C1] tipc_node_xmit_skb+0x11f/0x190 [ 461.167383][ C1] __tipc_shutdown+0xee1/0x1590 [ 461.172760][ C1] tipc_release+0x2fd/0x20e0 [ 461.177882][ C1] sock_close+0xa7/0x210 [ 461.182870][ C1] __fput+0x221/0x940 [ 461.187728][ C1] __se_sys_close+0x15c/0x1e0 [ 461.192934][ C1] do_syscall_64+0x55/0xb0 [ 461.197882][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 461.204305][ C1] [ 461.204305][ C1] other info that might help us debug this: [ 461.204305][ C1] [ 461.214567][ C1] Possible unsafe locking scenario: [ 461.214567][ C1] [ 461.222031][ C1] CPU0 CPU1 [ 461.227414][ C1] ---- ---- [ 461.232807][ C1] lock(stock_lock); [ 461.236915][ C1] lock(&trie->lock); [ 461.243524][ C1] lock(stock_lock); [ 461.250122][ C1] lock(&trie->lock); [ 461.254199][ C1] [ 461.254199][ C1] *** DEADLOCK *** [ 461.254199][ C1] [ 461.262450][ C1] 5 locks held by syz.2.2599/13709: [ 461.267650][ C1] #0: ffff88805eb05620 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x82/0x210 [ 461.277950][ C1] #1: ffff8880510b8f30 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: tipc_release+0xbe/0x20e0 [ 461.287638][ C1] #2: ffffffff8d132200 (rcu_callback){....}-{0:0}, at: rcu_core+0x951/0x17f0 [ 461.296535][ C1] #3: ffff8880b8f37da8 (stock_lock){-.-.}-{2:2}, at: refill_obj_stock+0xef/0x6a0 [ 461.305797][ C1] #4: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xc3/0x6c0 [ 461.315119][ C1] [ 461.315119][ C1] stack backtrace: [ 461.321101][ C1] CPU: 1 PID: 13709 Comm: syz.2.2599 Not tainted syzkaller #0 [ 461.328588][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 461.338667][ C1] Call Trace: [ 461.341963][ C1] [ 461.344824][ C1] dump_stack_lvl+0x18c/0x250 [ 461.349526][ C1] ? load_image+0x420/0x420 [ 461.354062][ C1] ? show_regs_print_info+0x20/0x20 [ 461.359308][ C1] ? print_circular_bug+0x12b/0x1a0 [ 461.364609][ C1] check_noncircular+0x2fc/0x400 [ 461.369657][ C1] ? print_deadlock_bug+0x5d0/0x5d0 [ 461.374863][ C1] ? lockdep_lock+0x195/0x230 [ 461.379579][ C1] ? _find_first_zero_bit+0xd6/0x100 [ 461.384905][ C1] __lock_acquire+0x37ef/0x7d80 [ 461.389885][ C1] ? perf_trace_buf_alloc+0x131/0x290 [ 461.395356][ C1] ? verify_lock_unused+0x140/0x140 [ 461.400665][ C1] ? perf_trace_lock_acquire+0x1a7/0x400 [ 461.406312][ C1] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 461.412919][ C1] lock_acquire+0x19e/0x420 [ 461.417530][ C1] ? trie_delete_elem+0x94/0x630 [ 461.422490][ C1] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 461.429089][ C1] ? read_lock_is_recursive+0x20/0x20 [ 461.434481][ C1] _raw_spin_lock_irqsave+0xb4/0x100 [ 461.439787][ C1] ? trie_delete_elem+0x94/0x630 [ 461.444739][ C1] ? _raw_spin_lock+0x40/0x40 [ 461.449430][ C1] trie_delete_elem+0x94/0x630 [ 461.454205][ C1] ? perf_trace_lock_acquire+0x1a7/0x400 [ 461.459935][ C1] bpf_prog_b23e3725e72cf264+0x4a/0x4e [ 461.465409][ C1] trace_call_bpf+0x333/0x6c0 [ 461.470098][ C1] ? trace_call_bpf+0xc3/0x6c0 [ 461.474870][ C1] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 461.480959][ C1] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 461.486612][ C1] perf_trace_lock_acquire+0x342/0x400 [ 461.492150][ C1] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 461.498880][ C1] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 461.504715][ C1] lock_acquire+0x3ef/0x420 [ 461.509241][ C1] ? mod_objcg_mlstate+0x8c/0x320 [ 461.514288][ C1] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 461.520883][ C1] ? __lock_acquire+0x1262/0x7d80 [ 461.527324][ C1] ? read_lock_is_recursive+0x20/0x20 [ 461.532831][ C1] mod_objcg_mlstate+0xad/0x320 [ 461.540148][ C1] ? mod_objcg_mlstate+0x8c/0x320 [ 461.545404][ C1] ? mod_objcg_mlstate+0x8c/0x320 [ 461.550444][ C1] ? drain_obj_stock+0x3a0/0x3a0 [ 461.555433][ C1] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 461.561280][ C1] ? read_lock_is_recursive+0x20/0x20 [ 461.566788][ C1] ? perf_trace_lock_acquire+0x342/0x400 [ 461.572451][ C1] drain_obj_stock+0x1e3/0x3a0 [ 461.577257][ C1] refill_obj_stock+0x1fc/0x6a0 [ 461.582132][ C1] ? refill_obj_stock+0xef/0x6a0 [ 461.587173][ C1] ? obj_cgroup_charge+0x630/0x630 [ 461.592581][ C1] memcg_slab_free_hook+0x123/0x200 [ 461.597788][ C1] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 461.603786][ C1] ? rcu_core+0x9c1/0x17f0 [ 461.608210][ C1] kmem_cache_free+0xe1/0x290 [ 461.612992][ C1] ? put_cred+0x60/0x60 [ 461.617165][ C1] ? rcu_core+0x951/0x17f0 [ 461.622379][ C1] rcu_core+0x9c1/0x17f0 [ 461.626737][ C1] ? rcu_cpu_kthread_park+0x90/0x90 [ 461.631942][ C1] ? __run_timers+0x780/0x810 [ 461.636644][ C1] ? detach_timer+0x2b0/0x2b0 [ 461.641440][ C1] ? lock_chain_count+0x20/0x20 [ 461.646306][ C1] handle_softirqs+0x27d/0x820 [ 461.651169][ C1] ? do_softirq+0xfa/0x1a0 [ 461.655600][ C1] ? do_softirq+0x1a0/0x1a0 [ 461.660312][ C1] ? tipc_sk_rcv+0x252a/0x2ae0 [ 461.665099][ C1] do_softirq+0xfa/0x1a0 [ 461.669350][ C1] [ 461.672377][ C1] [ 461.675323][ C1] ? __local_bh_enable_ip+0x1c0/0x1c0 [ 461.680984][ C1] ? lockdep_hardirqs_on_prepare+0x7d0/0x7d0 [ 461.687250][ C1] ? rcu_is_watching+0x15/0xb0 [ 461.692289][ C1] __local_bh_enable_ip+0x184/0x1c0 [ 461.697495][ C1] ? _local_bh_enable+0xa0/0xa0 [ 461.702372][ C1] ? tipc_sk_rcv+0x252a/0x2ae0 [ 461.707157][ C1] tipc_sk_rcv+0x252a/0x2ae0 [ 461.711767][ C1] ? perf_trace_lock_acquire+0x342/0x400 [ 461.717410][ C1] ? arch_stack_walk+0x160/0x190 [ 461.722389][ C1] ? __skb_queue_purge+0x160/0x160 [ 461.727516][ C1] ? __asan_memset+0x22/0x40 [ 461.732122][ C1] ? lockdep_init_map_type+0x9c/0x8e0 [ 461.737593][ C1] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 461.743765][ C1] ? net_generic+0x1e/0x240 [ 461.748366][ C1] ? __raw_spin_lock_init+0x45/0x100 [ 461.753685][ C1] tipc_node_xmit+0x22f/0x1040 [ 461.758469][ C1] ? tipc_node_get_linkname+0x190/0x190 [ 461.764037][ C1] ? rcu_is_watching+0x15/0xb0 [ 461.768832][ C1] tipc_node_xmit_skb+0x11f/0x190 [ 461.773902][ C1] ? __skb_queue_purge+0x160/0x160 [ 461.779034][ C1] ? tipc_msg_create+0x23d/0x4c0 [ 461.783984][ C1] __tipc_shutdown+0xee1/0x1590 [ 461.788890][ C1] ? tipc_recvstream+0xe70/0xe70 [ 461.793931][ C1] ? wait_woken+0x180/0x180 [ 461.798668][ C1] ? _local_bh_enable+0xa0/0xa0 [ 461.803638][ C1] tipc_release+0x2fd/0x20e0 [ 461.808510][ C1] ? ima_get_current_hash_algo+0x10/0x10 [ 461.814197][ C1] ? tipc_sock_destruct+0x180/0x180 [ 461.819417][ C1] ? down_write+0x16e/0x200 [ 461.823930][ C1] ? down_read_killable+0x340/0x340 [ 461.829151][ C1] sock_close+0xa7/0x210 [ 461.833412][ C1] ? sock_mmap+0xa0/0xa0 [ 461.837681][ C1] __fput+0x221/0x940 [ 461.841680][ C1] __se_sys_close+0x15c/0x1e0 [ 461.846550][ C1] do_syscall_64+0x55/0xb0 [ 461.850978][ C1] ? clear_bhb_loop+0x40/0x90 [ 461.855777][ C1] ? clear_bhb_loop+0x40/0x90 [ 461.860488][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 461.866836][ C1] RIP: 0033:0x7f7e6a59e159 [ 461.871264][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 461.891139][ C1] RSP: 002b:00007f7e6b4bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 461.899665][ C1] RAX: ffffffffffffffda RBX: 00007f7e6a826090 RCX: 00007f7e6a59e159 [ 461.907843][ C1] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 461.915851][ C1] RBP: 00007f7e6a63506b R08: 0000000000000000 R09: 0000000000000000 [ 461.923846][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 461.931824][ C1] R13: 00007f7e6a826128 R14: 00007f7e6a826090 R15: 00007fffe9da60d8 [ 461.939910][ C1] [ 461.979221][ T5087] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 462.019741][ T5787] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 462.029558][ T5787] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 462.038055][ T5787] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 462.047584][ T5787] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 462.068702][ T5787] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 462.152951][ T5781] syz_tun (unregistering): left allmulticast mode [ 462.173867][ T5781] syz_tun (unregistering): left promiscuous mode [ 462.182273][ T5781] bridge0: port 3(syz_tun) entered disabled state [ 462.548011][ T8398] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.721036][ T8398] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.834730][ T8398] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 462.922962][ T8398] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.833809][ T8398] bridge_slave_1: left allmulticast mode [ 463.841651][ T8398] bridge_slave_1: left promiscuous mode [ 463.848051][ T8398] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.858765][ T8398] bridge_slave_0: left allmulticast mode [ 463.865756][ T8398] bridge_slave_0: left promiscuous mode [ 463.873337][ T8398] bridge0: port 1(bridge_slave_0) entered disabled state [ 463.886014][ T8398] veth1_macvtap: left promiscuous mode [ 463.892936][ T8398] veth0_macvtap: left promiscuous mode [ 463.898603][ T8398] veth1_vlan: left promiscuous mode [ 463.904734][ T8398] veth0_vlan: left promiscuous mode [ 464.051167][ T8398] team0 (unregistering): Port device team_slave_1 removed [ 464.079296][ T8398] team0 (unregistering): Port device team_slave_0 removed [ 464.100780][ T8398] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 464.109599][ T8398] bond_slave_1 (unregistering): left promiscuous mode [ 464.116450][ T8398] bond_slave_1 (unregistering): left allmulticast mode [ 464.129323][ T8398] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 464.138209][ T8398] bond_slave_0 (unregistering): left promiscuous mode [ 464.146242][ T8398] bond_slave_0 (unregistering): left allmulticast mode [ 464.247494][ T8398] bond0 (unregistering): Released all slaves [ 464.570144][ T8398] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.630497][ T8398] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.702033][ T8398] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.746013][ T8398] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.875884][ T8398] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 464.937456][ T8398] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.006694][ T8398] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.070652][ T8398] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.198483][ T8398] tipc: Left network mode [ 466.189638][ T8398] hsr_slave_0: left promiscuous mode [ 466.195750][ T8398] hsr_slave_1: left promiscuous mode [ 466.204468][ T8398] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 466.212380][ T8398] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.222130][ T8398] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 466.238899][ T8398] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 466.246942][ T8398] bridge_slave_1: left allmulticast mode [ 466.253858][ T8398] bridge_slave_1: left promiscuous mode [ 466.259914][ T8398] bridge0: port 2(bridge_slave_1) entered disabled state [ 466.269090][ T8398] bridge_slave_0: left allmulticast mode [ 466.274777][ T8398] bridge_slave_0: left promiscuous mode [ 466.282092][ T8398] bridge0: port 1(bridge_slave_0) entered disabled state [ 466.295940][ T8398] hsr_slave_0: left promiscuous mode [ 466.303799][ T8398] hsr_slave_1: left promiscuous mode [ 466.310116][ T8398] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 466.317566][ T8398] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.326934][ T8398] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 466.335145][ T8398] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 466.349376][ T8398] veth1_macvtap: left promiscuous mode [ 466.354956][ T8398] veth0_macvtap: left promiscuous mode [ 466.361376][ T8398] veth1_vlan: left promiscuous mode [ 466.366718][ T8398] veth0_vlan: left promiscuous mode [ 466.374308][ T8398] veth1_macvtap: left promiscuous mode [ 466.380142][ T8398] veth0_macvtap: left promiscuous mode [ 466.385811][ T8398] veth1_vlan: left promiscuous mode [ 466.391625][ T8398] veth0_vlan: left promiscuous mode [ 466.673036][ T8398] team0 (unregistering): Port device team_slave_1 removed [ 466.702762][ T8398] team0 (unregistering): Port device team_slave_0 removed [ 466.733772][ T8398] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 466.764229][ T8398] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 466.852076][ T8398] bond0 (unregistering): Released all slaves [ 467.040565][ T8398] team0 (unregistering): Port device team_slave_1 removed [ 467.067565][ T8398] team0 (unregistering): Port device team_slave_0 removed [ 467.093492][ T8398] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 467.123698][ T8398] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 467.213263][ T8398] bond0 (unregistering): Released all slaves [ 467.841726][ T8398] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.887113][ T8398] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.935382][ T8398] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.985858][ T8398] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.729666][ T8398] hsr_slave_0: left promiscuous mode [ 468.735935][ T8398] hsr_slave_1: left promiscuous mode [ 468.742908][ T8398] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 468.750779][ T8398] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 468.758588][ T8398] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 468.768600][ T8398] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 468.776647][ T8398] bridge_slave_1: left allmulticast mode [ 468.783291][ T8398] bridge_slave_1: left promiscuous mode [ 468.789355][ T8398] bridge0: port 2(bridge_slave_1) entered disabled state [ 468.798510][ T8398] bridge_slave_0: left allmulticast mode [ 468.805236][ T8398] bridge_slave_0: left promiscuous mode [ 468.811397][ T8398] bridge0: port 1(bridge_slave_0) entered disabled state [ 468.823895][ T8398] veth1_macvtap: left promiscuous mode [ 468.830308][ T8398] veth0_macvtap: left promiscuous mode [ 468.835965][ T8398] veth1_vlan: left promiscuous mode [ 468.843261][ T8398] veth0_vlan: left promiscuous mode [ 469.070968][ T8398] team0 (unregistering): Port device team_slave_1 removed [ 469.102635][ T8398] team0 (unregistering): Port device team_slave_0 removed [ 469.127927][ T8398] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 469.155680][ T8398] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 469.222877][ T8398] bond0 (unregistering): Released all slaves