last executing test programs: 5.792930104s ago: executing program 2 (id=1253): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x200, 0x3, 0x8, 0x2, 0x4b9, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x6}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) r0 = getpid() perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x6, 0x0, 0x1, 0x420, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x20010000, 0xa573}, 0x0, 0x0, 0xfffffffc, 0x5}, r0, 0x8, 0xffffffffffffffff, 0x5) r1 = socket$kcm(0xa, 0x6, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000002280)=ANY=[@ANYBLOB="18020000e2ffffff00000000000000c685000000360000009500001800000000922ae83713ab9600010000801b10fb54a8cb72d232ad558c46fff4208d4990ec11ce9413ac30e00bd0081f8504e19a5183d769676520e98a263345e44d5ad12bca35510100c4d86abeb12303ff1c9fe0d0020000d60400000007d3670000008aff66d6b3181ffc1d62a3954c1198bbc4fa13aee48ca9e8969faebf3183fe803ab3f5024b52dc265b36fc9dae00a09404f01f9504d0976d252bd8d24538556e5e57bee3b8cf464ef3c6a7def8bad3ca6e3abdb21696e340bb8e2a093add57196b40def3858ef569147fa4108328392d322ab5df10a2f69a6bdf72ee7944e810d0223917c3d042410f57466f59544047d6d8ac44060000000000ee16c729300d2301800000000000002b5a8b05fcc154ad5290a8cdb97c343f454ff69dd6cbde49b28a6cb5f4fc0001745cff6e00e7ffffff0000acf3209a08439f1ff01779b6f6df7e02aa6d7760525b595fe1f697bc114ed1778e97a3f0395f946974cfb458be2a34cf924dc37b5592bf17956f3547497aba814382ff67b345b677a9d6523d87008000000400000000003fe8613ca29ff92be0d8deffff7b68136b0046d535dd39c0f35408869e9b342b953f91447e6b9eab304f134306320600a44095254b45a6c1312a13696c7202df5f764713504facc532c5a6d44d99ec7530ed7b0311000000000000e54e9072a22d911f4a2c2e2fa806e63c5cd98a8569a6d6bcfb000064885117e2ad910eae67e0ebe380d0f648713e68153579e02d71c58d147b00821ab9a6475b31e1ebf1369a04000000fbf3983f283f2f00000000992774814d63c933912d000006000000a66acb0a38856929e7d8b1b06c9bd5d7e5490f3b8596b694ea9483bd4bd287c83dd998a74694d18bdd8ad0983bc90770bbd26a82b9d99d5fc04563b523c47ef8c33400e90d02000000000000000edf1147a7afe772cd45af8aeffe2753088e02ca6bb2feec446ce7dbce66f0a93a03371320980865c7c62ea4d8f8a864dce9fa85aeb0454349100296ee2dba39c3f6fd6cf96714e11fe03b5062809a7418b165dd0336d226bac1e1223be1c97b15175d0e664beb126000e96549e1a1228c686edb475b705eaa9515c96f4fc6b3c925ea404e0f1de61026dc6c6618580fd6ce9eac602c1756f6d1056712412131ed9925989e01eae489ec7052e0ed72c326c7a8aa63999e2297c54ce1822d14b7c7699a9d0600f11f2e7f474cffbc35bc8623cd5eb68af82275a940be0400000000423346da092cbe220de96d6a8e9f32f18d1f606b381e4903b500000000000000000000004a2357ba5f03000000000000005dcf4f2aaee86d4802000000000000007cdb686d5da2a42e4b5024b6535811f362201d4f82012e6af704973d04ea923c19e6cb723c1923b3eea2d73e176dff383c9fbbac53dfdcb1a68c98e96fe39eec23963faf3ebed3409144c7c53d6318ced678a621450a9b01e9f2772e5f2999d3435da02556e36c3215d2bd4e96c93bff3ad04a82ff3cfadcf65eb92adc6c68d66b11cb2d7556414a86dfa94bb7aa52c7febb1e9b2efcbbc5bccf9d39bed802f4f056976a9a362ee9cc624ec454b90200fd9603f96908bddc14500000000000000000000000000044d917c62b27679913075731e8fddb07c10c82002d60181588ae63a440454287de9e340f611267f37bdd0f2d21cb06fcaf45a0a297e396f428d43371424b307eef82c5d6d19f3ef0d3b8f7fa51957e3099caab31133b34a1d3eebc0f0c9056df2e9667ba0b55695c7894010079b07e7aef7785e248deb8c83ab6eb2c72c484241dc3b66da78260f800fffd39368b952f6f4a10295c50c887a31d8b543c5d10f2dbd4d0b84eaad43feb6e169a9f2fcff7000000000000000000e011bc6366f56fa787f212c1f8c0f47f5078191c8a02ad436725771738a2a98891971e3b932352896e1ea10f62e8ef7a87e16151b39d6c27575714540d8c293a3fa4b5a825360423c1cbc8b5d19167152823ed853140edda002c16c842b168bb55f6bb713deb57d0aa78d6d4e5fc5be2c402bd77125d98120358900000892b135a92e8c844938aa98ba4839a1408a696454d40e5eed4d4dce481ca86bfac54c330331b7f2cde17cbaeb0377696faf546ecbe742d73d47d726a50f6e752f3325255bd7e8b5923aa3cfb6f7e06494f21ca450139c558000000000000000000000800000000000000000075aa0000000000000000000000005560bd9eb81e839e4992e64b074a66cccccf00334fa94da8477be7d99b558ec6a5b1596ac1e7617c6b32eed0cc70286caf2c5189a103f4b0b04aff171c4d388ccf67fea37e782f025c94c853cde330a193a967d907a8c88fcb033e680f559a72150cb900bafcd536f48797915a2fe9922ce27300009e1b36aa4730117d9b00000000003c630000000000008fbbd11b015c415ca04192fbfb1a8b0e3460af35771dbac10062835c9bab3ad09f7a022c52d8000000000000000000004000000000000000000000000000000000000000000400000000000000000000000000006ec473c54399b7b8aa1ee46132fc45da8292631178cecf19550108b8b8423de4295777a17bf4dfdfee5de0f3e4dadf51ab9562827b762fa611ba5f32861c19dffe1dc9fd5c41cd46cf131fd6b0c2ddad90ac33f768f9ecc70327c59918fa5a249befe98262f53c8182d95f6da3698a6a88c2c31d801a8f1f5e0ce05138d5422da0a6a62b9dfe1f39775d1d0c9186096415f544aaf76b0a1c877a6c826a5adcfb22c4a0e5a46271caa3eaf4f389dd5f3c20dbddc0377a4266d7b9fd61b9287e9b4be0a413ee31be0ddecab0ef7b25cba1fb3654ddf291ecb7768ac1e177042cb4c452fa6b3966950000000000000000c187da23d6855500fe8510b51e13a890e394b84a6ea2cc8d42b97c697c29122298d55e2e1cca8e07abda2606a3f381c64b9fec0000000a7965e4854e8e3572ad5149b3872342dea9252132860c9af1bd5fe263c0313dea5d6e0c11a466d6892ed65f34667dd79b07b5cbdd8aa7dd561a26b5562d4861a7e1b0f48930e0b696ea3bee7eb72794e163d7aeac9a0fa5403ac9cb421eae283b0550f1d0d339cd7b96e71d3ab48ad9d7975e0c9b117f71d3ab80a0c9b0284ecc469fa6181c9c71fce07a6ffb23296a107763138e8d9876291af2076890c47925ac773d95d2ca42acb3e5f3a1550665b898462c139ffd0106bc8a61b6117d252efcab7106b4c3a3c13a70ff452e9d2096142c517b0e91b5cf88332faca5b3ee96363065c3ce32d3d39ec36e20d597e05664f2526bd918090649da11f7299789d00f502cdf1e99d3efecb9b457642fe810370ba4fbe00fa60a28af966a27a1659e448bbe43a1dcd2ea760018b57a36ac41ef2051a7b703d55c0602540663016e20d50385766df4dac47802a55bd38dd767ee9960c6daa704fc5d01a14591f26b7b538c9bb22f6a2f7a34d1b9edfd125a9e25a110228c64253588ff420644dbc0854e69a7bdda72f93ceaccf92cfe7dd6296c950db10f6dd8a5ef9b73cf6a12a1ba16fdc7e35b805f4fd2fcff0a623722149c1465e4de2d53f0f10b14c21865027abc71a12cb1e9f8029c7a20000000eeb0d53a83e518c8d2052c08b515d9d0bde24ac4e798040c7db0bb03c019507d6377f3d5dd94a27abc6d6b120d61f772407e0d2cb50d29168b68aef9f176b4c3aa8b21279d4ea9c1f669aa8c2c17d5b3a8d1dda58d26f1019af04b7774c85d5bce8be010f27c5211938031c3404680b01279c778bd1fe1b48c4b5b8e0fe756e54a8d76b7cec5e3407d93b4eadc446440607de844acf5524a4657e33af2115547b735b57b5092d0bc8fa6acb832509abe0882d570ce400aaebd7baff88526608d6991aac95751671174129457e4a03aca69d82b64b89e6ad6ed1e275ec5002e48170e4c7b4f3971481098dedb88fba90770e44bf404d5a97fefe2fe8e459fe45933b78c7ab5fe985a480193a20fb07da1455fb283df68af569ac82aa6dc703e29bf158931fb79f2abfa6ff7eb8c4f381c9da58bea460e2ead969933e5391970ca4fddd64da2e5df9c4d82044068caaaab771b37bb06bbe673056d849825525f1120b2250f6b8520381f7a74b1c687781cb6b23e67b918844b83dbaeeb559ec8520d710dd6d6b4e64838bd434a36ed03fc0c488b24571032ffbc9f8ce97041e1bc4729d539358dc9599c1266b9ce2cb6dd0ad57a6e9d3d4a11a27f70b2934c96237e2ba09c58eeda678d4d08b6da99b7a86e946215afb1b48792fde54492e306cb5342e2589874b603a1de972b1f09cc350096f5c3e814118af9ba0793cfdf20c77b34eacfdf63ce59ec4d2f867bf884e941559b068d908325667672b5e1cf71f4829c0493e8b141399ed926b822becead7a0a2b4a4c008ab16b616d60f347e4da54f06443507efe57ea62399ef4eb11b2f559e1b056456a53998bf1c6d13c92e75136147f91ae3a75ca15eb1b51bf700b3c0bf54bc3745ff313c5e75dc66386897f6ee45429371b8d0878c442ad2fe9baf85c1390da13efc353ccbef950c29f39ddf436f0d9bf1be1515ed251d8b6f11ecb16b1e8d1ed04196e9b6c2f9e068b7749bb6c1f533e493f22c901662c65cb761dc2eeff2f698bd4dbae83e2dfdc4f1c7f918a00515c1bc189d10ec22b35c92725cbf0ba244fd029c4f026f68e000000060000ab0476c3fd7f7c1e5c000000000000000000000011e43e39d3f4394fbfa13c416b1c443c5e52eea726491ad75100ebad7c6d5a665c59a3fb158e43da904f19e7e8daa4e90390b8da945f6cd78536c0d2be07221f85ad46b180f256d4d84592691d15d65896b66b63a46705338b67b72dc1c3075fcdc5cbffb0366151632ba5be8ae815dfea9fadfd31c473a24a73d3e5116c3023b3563c72d26fbd59877132bde5ca4ef8d92fd3613c768b35223f6fd0b5e9a8b98cccf1e2b4612e620e3a159d6365c9045aaa826aa0ee6d26cf0397ce674c20824584b464ebdc2f3ea26a7aec4570b242a6677a4e9187f8591c3a9bdc0000001a002364bbd93964a8d0bdc802b9be2500"/3636], &(0x7f0000000040)='GPL\x00', 0x4, 0xfdc0, &(0x7f0000000300)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000100)="2b678fcd8622384bd8735f8e5288", 0x0, 0x2000, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2545, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x8}, 0x400, 0x5, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r6, 0x4004743d, 0x110e22fff6) close(r6) sendmsg$inet(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000780)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac008001900030002000600060000800000005883c64d251e638294ff0051f60a84c9f4d4938037e7000000000000000000d1c566a000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x98010) sendmsg(r1, &(0x7f0000001880)={0x0, 0x0, &(0x7f0000001780)=[{&(0x7f0000000180)="9e3238ba2cb4ca7fcc7ef19cb20d0807c60f69e184ebc2ea6beb1bd8b38a83504cbb12011f476586d77bcbd973496f563b202fc558d536a0f5ac388959d44784c79eaf368edd784c2be2ffc0b54f", 0x4e}, {&(0x7f0000001380)="ff9d5e0f00b428fc55b48992d4ba412e949568f9a72af1a2ed111d4ddaa8d11a55232f7649b4ad6c5339b5f9b0dc157af1e5050017265af76e6521c5bda97a89f5c4619a93d5fc0619461d878480910aeab251849a3289358395fd39e22fad2f865f2050aa59e066906b08aa223d7fec02e487e8698b6394a0fc70a45bfe8bd314c0d50444a8", 0x86}, {&(0x7f0000001980)="6fd769d5b0e84afaafb36dd48185650af06bee59e59018e85606f8bfb61df11b38bee6a9f57a6adf12c439ec6b64eda82347f56cf7b0c97884a857773e19cd37304b5f85c92a2686a2539b9f552c46eef8485f612d69b3129b5d944e3e964c518e8b31da2ed5291b03171c85f271233128900162d58003960ecddff3537a93ed8a32855f32bb3367f8be05c7bb9ab2990f44195400c8165e74f71fb5eee252c426aff9c408b6b5d4f782c63eb81b4d60e67cb9a544fcca5782f0eb6a409ae37b471b6fc4c1602cdabbb9711d3e404b0f536c0b7fdaecc0e34a5b00e651e48fb4acf4773b1628045015ba5f6af08cf9d156b519b832acdde05f3132196e306188cdd1fe2477f737f8947b28d8c412d7477b", 0x111}, {&(0x7f0000001540)="780f149d5148b28d72f368743c0304fa6d1f6578db4c5cffa2442cba7bdcafba0892b5a0f2b2fb53cada47413db5ee7acc4a31b74449f48e00d24d5bebe2701acbbc2cffbf483cf9e8f21da08d0bb3f0a3924afed54b9b84475dfc1faeedf50d357523987156508cb684d768879ffe6899266cfc27cefe040faaddcacb7826b374142bac3632033710a2", 0x8a}, {&(0x7f0000001600)="36dbcba7c50c51c6c2263551346d3a489e809938", 0x14}, {&(0x7f0000001640)="4360ede8d7997675afce9726b33ad741319dc1c062d77fe61567b87354928ac46dac9381239c242b66f3f3aadbab250589b22a776362bd2f3855cd9b5edaa58ebba28e23330ccbfb68b692f09f933def9704d9ef2a05f0f4c142b5619b0ee02eb3e1246e21e02ff2757828d626a0d4c775b9feaa4934df6ac1525c17c99e2329e0fd7577b20c3f96b61495e79fd74d5b83d375fe4ddc3ba2f69b7829325b82de81e0a9fcfa6a5b861e698ca442", 0xad}, {&(0x7f0000001300)="f9145e12e11101f6cc312c54d15f996e943ffe37159f27ff9ef5341b777631ae2d2750cc6148f677673dcb7b668e0c71be1b1cff95ec96ebb923abd10c7d00000000000000", 0x45}, {&(0x7f0000001740)="5aa444958c39fbf7c6c048", 0xb}], 0x8, &(0x7f0000001440)=ANY=[@ANYBLOB="48000000000000003a000000050000040bb2b5750db7922d01fee5bff0f6f8d863e819f99c61d553da8f27947ca304f551c280dd8fc0721b8af31e5c7e74fe7be080c53a6afd22edcb8b918173fb07b2ebdedc53f9de0000"], 0x48}, 0x4044050) setsockopt$sock_attach_bpf(r1, 0x29, 0x1b, &(0x7f0000000100)=r2, 0x120) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r7}, 0x4) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xa1, 0xffffffffffffff80}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000), 0xef) 4.401307135s ago: executing program 3 (id=1255): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x3, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) recvmsg$unix(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/253, 0xfd}, {&(0x7f0000000300)=""/218, 0xda}, {&(0x7f0000000440)=""/61, 0x3d}, {&(0x7f0000000480)=""/20, 0x14}, {&(0x7f00000004c0)=""/67, 0x43}, {&(0x7f0000000540)=""/32, 0x20}, {&(0x7f0000000580)=""/26, 0x1a}, {&(0x7f00000005c0)=""/31, 0x1f}], 0x8, &(0x7f0000000680)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x130}, 0x40010262) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffec0", @ANYRESDEC], 0xffdd) 4.215629979s ago: executing program 2 (id=1257): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc00, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001800000000000000100100000c000000e8000000288670966c"], 0x30}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) r3 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000240)={r3, &(0x7f00000001c0), 0x0}, 0x20) socket$kcm(0x2, 0x200000000000001, 0x106) r4 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x8000, 0x10000, 0x364, 0x5, 0x4, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) close(0x3) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1a69, 0x5}, 0x0, 0x5, 0x0, 0x0, 0x1}, 0x0, 0xb, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) write$cgroup_devices(r2, &(0x7f0000000200)=ANY=[@ANYBLOB='r\x00'], 0x8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) recvmsg$unix(r0, &(0x7f0000004b80)={&(0x7f00000000c0), 0x6e, &(0x7f0000004a40)=[{&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000000340)=""/245, 0xf5}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)}, {&(0x7f0000003a40)=""/4096, 0x1000}], 0x5, &(0x7f0000004ac0)=[@rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x68}, 0x20) 2.404160948s ago: executing program 2 (id=1262): bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000080)={0x7}, 0x8) r0 = perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0, 0x2}, 0x90, 0xa4, 0x2, 0x5, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107383, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x7af, 0x7, 0xa, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB], 0xfe33) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="1400000028000b6394f90509a16dd8e50000cc57", 0x14}], 0x1}, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000001500)={0x0, 0x0, 0x0}, 0x40000240) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000280)="d8000000180081064e81f782db4cb904021d0800fd027c05e8fe55a10a000b000140020203600e41b0000900ac0006031100000016000500000000000004015c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed", 0xa2}], 0x1}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) bpf$OBJ_PIN_MAP(0x6, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r4) syz_clone(0x2300, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4a}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x15, 0xf, &(0x7f0000000000)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x3}, {{}, {}, {0x7, 0x0, 0xb, 0x6, 0x0, 0x0, 0xffffff1f}, {0x85, 0x0, 0x0, 0x5}}, {{0x6, 0x0, 0x2}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x1, &(0x7f0000000040)=ANY=[@ANYBLOB="6a38f0ff10"], 0x0, 0x42, 0x0, 0x0, 0x41000, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ff}, 0x94) 2.378162959s ago: executing program 1 (id=1263): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000240), 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000480)=ANY=[@ANYBLOB="9feb01001800000000000000400000004000000003e2ffffff000000001300090300000000000000000000010500000008000000010000000000000f000000010098f6fd30a15182a1ed8f"], 0x0, 0x5b, 0x0, 0x0, 0x0, 0x10000, @value=r0}, 0x28) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="9feb01001800280000000000340000003400000002000000000000000000000d03000000000000000000000105002000800000000000000000000003000000000200000002"], &(0x7f0000000340)=""/142, 0x4e, 0xfeaf, 0x1}, 0x20) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0x1f, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8481f0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0xfffff000, 0xfe71, 0xffffffffffffff40, &(0x7f0000000080)="85d77444c5a569f1e21b08c0f264", 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, 0x3b) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$kcm(0x11, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000640)=ANY=[@ANYBLOB="b70700000000000063117c000000000007000000002a98725d3add6660b34a960000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xcd, &(0x7f0000000740)=""/205, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r3, 0x58, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b70300001800000085000000330000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r4, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000400)="b9ff03076804268c989e14f088a8", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5}, 0x50) bpf$ITER_CREATE(0xb, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) close(r6) socket$kcm(0xa, 0x2, 0x0) 2.31994461s ago: executing program 3 (id=1264): perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0xe, &(0x7f0000000040), 0x3b) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x86bf2056334f3ae6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x5, 0x111, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffc}, 0x9006, 0xa, 0x0, 0x0, 0x0, 0x0, 0x3000, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb790700117df37538e486dd6317ce2200fc"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001f00)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xec}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 1.995149337s ago: executing program 2 (id=1266): perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x200, 0x3, 0x8, 0x2, 0x4b9, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xf, 0x6}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) r0 = getpid() perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xde, 0x0, 0x0, 0x6, 0x0, 0x1, 0x420, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x20010000, 0xa573}, 0x0, 0x0, 0xfffffffc, 0x5}, r0, 0x8, 0xffffffffffffffff, 0x5) r1 = socket$kcm(0xa, 0x6, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x6, 0x4, &(0x7f0000002280)=ANY=[@ANYBLOB="18020000e2ffffff00000000000000c685000000360000009500001800000000922ae83713ab9600010000801b10fb54a8cb72d232ad558c46fff4208d4990ec11ce9413ac30e00bd0081f8504e19a5183d769676520e98a263345e44d5ad12bca35510100c4d86abeb12303ff1c9fe0d0020000d60400000007d3670000008aff66d6b3181ffc1d62a3954c1198bbc4fa13aee48ca9e8969faebf3183fe803ab3f5024b52dc265b36fc9dae00a09404f01f9504d0976d252bd8d24538556e5e57bee3b8cf464ef3c6a7def8bad3ca6e3abdb21696e340bb8e2a093add57196b40def3858ef569147fa4108328392d322ab5df10a2f69a6bdf72ee7944e810d0223917c3d042410f57466f59544047d6d8ac44060000000000ee16c729300d2301800000000000002b5a8b05fcc154ad5290a8cdb97c343f454ff69dd6cbde49b28a6cb5f4fc0001745cff6e00e7ffffff0000acf3209a08439f1ff01779b6f6df7e02aa6d7760525b595fe1f697bc114ed1778e97a3f0395f946974cfb458be2a34cf924dc37b5592bf17956f3547497aba814382ff67b345b677a9d6523d87008000000400000000003fe8613ca29ff92be0d8deffff7b68136b0046d535dd39c0f35408869e9b342b953f91447e6b9eab304f134306320600a44095254b45a6c1312a13696c7202df5f764713504facc532c5a6d44d99ec7530ed7b0311000000000000e54e9072a22d911f4a2c2e2fa806e63c5cd98a8569a6d6bcfb000064885117e2ad910eae67e0ebe380d0f648713e68153579e02d71c58d147b00821ab9a6475b31e1ebf1369a04000000fbf3983f283f2f00000000992774814d63c933912d000006000000a66acb0a38856929e7d8b1b06c9bd5d7e5490f3b8596b694ea9483bd4bd287c83dd998a74694d18bdd8ad0983bc90770bbd26a82b9d99d5fc04563b523c47ef8c33400e90d02000000000000000edf1147a7afe772cd45af8aeffe2753088e02ca6bb2feec446ce7dbce66f0a93a03371320980865c7c62ea4d8f8a864dce9fa85aeb0454349100296ee2dba39c3f6fd6cf96714e11fe03b5062809a7418b165dd0336d226bac1e1223be1c97b15175d0e664beb126000e96549e1a1228c686edb475b705eaa9515c96f4fc6b3c925ea404e0f1de61026dc6c6618580fd6ce9eac602c1756f6d1056712412131ed9925989e01eae489ec7052e0ed72c326c7a8aa63999e2297c54ce1822d14b7c7699a9d0600f11f2e7f474cffbc35bc8623cd5eb68af82275a940be0400000000423346da092cbe220de96d6a8e9f32f18d1f606b381e4903b500000000000000000000004a2357ba5f03000000000000005dcf4f2aaee86d4802000000000000007cdb686d5da2a42e4b5024b6535811f362201d4f82012e6af704973d04ea923c19e6cb723c1923b3eea2d73e176dff383c9fbbac53dfdcb1a68c98e96fe39eec23963faf3ebed3409144c7c53d6318ced678a621450a9b01e9f2772e5f2999d3435da02556e36c3215d2bd4e96c93bff3ad04a82ff3cfadcf65eb92adc6c68d66b11cb2d7556414a86dfa94bb7aa52c7febb1e9b2efcbbc5bccf9d39bed802f4f056976a9a362ee9cc624ec454b90200fd9603f96908bddc14500000000000000000000000000044d917c62b27679913075731e8fddb07c10c82002d60181588ae63a440454287de9e340f611267f37bdd0f2d21cb06fcaf45a0a297e396f428d43371424b307eef82c5d6d19f3ef0d3b8f7fa51957e3099caab31133b34a1d3eebc0f0c9056df2e9667ba0b55695c7894010079b07e7aef7785e248deb8c83ab6eb2c72c484241dc3b66da78260f800fffd39368b952f6f4a10295c50c887a31d8b543c5d10f2dbd4d0b84eaad43feb6e169a9f2fcff7000000000000000000e011bc6366f56fa787f212c1f8c0f47f5078191c8a02ad436725771738a2a98891971e3b932352896e1ea10f62e8ef7a87e16151b39d6c27575714540d8c293a3fa4b5a825360423c1cbc8b5d19167152823ed853140edda002c16c842b168bb55f6bb713deb57d0aa78d6d4e5fc5be2c402bd77125d98120358900000892b135a92e8c844938aa98ba4839a1408a696454d40e5eed4d4dce481ca86bfac54c330331b7f2cde17cbaeb0377696faf546ecbe742d73d47d726a50f6e752f3325255bd7e8b5923aa3cfb6f7e06494f21ca450139c558000000000000000000000800000000000000000075aa0000000000000000000000005560bd9eb81e839e4992e64b074a66cccccf00334fa94da8477be7d99b558ec6a5b1596ac1e7617c6b32eed0cc70286caf2c5189a103f4b0b04aff171c4d388ccf67fea37e782f025c94c853cde330a193a967d907a8c88fcb033e680f559a72150cb900bafcd536f48797915a2fe9922ce27300009e1b36aa4730117d9b00000000003c630000000000008fbbd11b015c415ca04192fbfb1a8b0e3460af35771dbac10062835c9bab3ad09f7a022c52d8000000000000000000004000000000000000000000000000000000000000000400000000000000000000000000006ec473c54399b7b8aa1ee46132fc45da8292631178cecf19550108b8b8423de4295777a17bf4dfdfee5de0f3e4dadf51ab9562827b762fa611ba5f32861c19dffe1dc9fd5c41cd46cf131fd6b0c2ddad90ac33f768f9ecc70327c59918fa5a249befe98262f53c8182d95f6da3698a6a88c2c31d801a8f1f5e0ce05138d5422da0a6a62b9dfe1f39775d1d0c9186096415f544aaf76b0a1c877a6c826a5adcfb22c4a0e5a46271caa3eaf4f389dd5f3c20dbddc0377a4266d7b9fd61b9287e9b4be0a413ee31be0ddecab0ef7b25cba1fb3654ddf291ecb7768ac1e177042cb4c452fa6b3966950000000000000000c187da23d6855500fe8510b51e13a890e394b84a6ea2cc8d42b97c697c29122298d55e2e1cca8e07abda2606a3f381c64b9fec0000000a7965e4854e8e3572ad5149b3872342dea9252132860c9af1bd5fe263c0313dea5d6e0c11a466d6892ed65f34667dd79b07b5cbdd8aa7dd561a26b5562d4861a7e1b0f48930e0b696ea3bee7eb72794e163d7aeac9a0fa5403ac9cb421eae283b0550f1d0d339cd7b96e71d3ab48ad9d7975e0c9b117f71d3ab80a0c9b0284ecc469fa6181c9c71fce07a6ffb23296a107763138e8d9876291af2076890c47925ac773d95d2ca42acb3e5f3a1550665b898462c139ffd0106bc8a61b6117d252efcab7106b4c3a3c13a70ff452e9d2096142c517b0e91b5cf88332faca5b3ee96363065c3ce32d3d39ec36e20d597e05664f2526bd918090649da11f7299789d00f502cdf1e99d3efecb9b457642fe810370ba4fbe00fa60a28af966a27a1659e448bbe43a1dcd2ea760018b57a36ac41ef2051a7b703d55c0602540663016e20d50385766df4dac47802a55bd38dd767ee9960c6daa704fc5d01a14591f26b7b538c9bb22f6a2f7a34d1b9edfd125a9e25a110228c64253588ff420644dbc0854e69a7bdda72f93ceaccf92cfe7dd6296c950db10f6dd8a5ef9b73cf6a12a1ba16fdc7e35b805f4fd2fcff0a623722149c1465e4de2d53f0f10b14c21865027abc71a12cb1e9f8029c7a20000000eeb0d53a83e518c8d2052c08b515d9d0bde24ac4e798040c7db0bb03c019507d6377f3d5dd94a27abc6d6b120d61f772407e0d2cb50d29168b68aef9f176b4c3aa8b21279d4ea9c1f669aa8c2c17d5b3a8d1dda58d26f1019af04b7774c85d5bce8be010f27c5211938031c3404680b01279c778bd1fe1b48c4b5b8e0fe756e54a8d76b7cec5e3407d93b4eadc446440607de844acf5524a4657e33af2115547b735b57b5092d0bc8fa6acb832509abe0882d570ce400aaebd7baff88526608d6991aac95751671174129457e4a03aca69d82b64b89e6ad6ed1e275ec5002e48170e4c7b4f3971481098dedb88fba90770e44bf404d5a97fefe2fe8e459fe45933b78c7ab5fe985a480193a20fb07da1455fb283df68af569ac82aa6dc703e29bf158931fb79f2abfa6ff7eb8c4f381c9da58bea460e2ead969933e5391970ca4fddd64da2e5df9c4d82044068caaaab771b37bb06bbe673056d849825525f1120b2250f6b8520381f7a74b1c687781cb6b23e67b918844b83dbaeeb559ec8520d710dd6d6b4e64838bd434a36ed03fc0c488b24571032ffbc9f8ce97041e1bc4729d539358dc9599c1266b9ce2cb6dd0ad57a6e9d3d4a11a27f70b2934c96237e2ba09c58eeda678d4d08b6da99b7a86e946215afb1b48792fde54492e306cb5342e2589874b603a1de972b1f09cc350096f5c3e814118af9ba0793cfdf20c77b34eacfdf63ce59ec4d2f867bf884e941559b068d908325667672b5e1cf71f4829c0493e8b141399ed926b822becead7a0a2b4a4c008ab16b616d60f347e4da54f06443507efe57ea62399ef4eb11b2f559e1b056456a53998bf1c6d13c92e75136147f91ae3a75ca15eb1b51bf700b3c0bf54bc3745ff313c5e75dc66386897f6ee45429371b8d0878c442ad2fe9baf85c1390da13efc353ccbef950c29f39ddf436f0d9bf1be1515ed251d8b6f11ecb16b1e8d1ed04196e9b6c2f9e068b7749bb6c1f533e493f22c901662c65cb761dc2eeff2f698bd4dbae83e2dfdc4f1c7f918a00515c1bc189d10ec22b35c92725cbf0ba244fd029c4f026f68e000000060000ab0476c3fd7f7c1e5c000000000000000000000011e43e39d3f4394fbfa13c416b1c443c5e52eea726491ad75100ebad7c6d5a665c59a3fb158e43da904f19e7e8daa4e90390b8da945f6cd78536c0d2be07221f85ad46b180f256d4d84592691d15d65896b66b63a46705338b67b72dc1c3075fcdc5cbffb0366151632ba5be8ae815dfea9fadfd31c473a24a73d3e5116c3023b3563c72d26fbd59877132bde5ca4ef8d92fd3613c768b35223f6fd0b5e9a8b98cccf1e2b4612e620e3a159d6365c9045aaa826aa0ee6d26cf0397ce674c20824584b464ebdc2f3ea26a7aec4570b242a6677a4e9187f8591c3a9bdc0000001a002364bbd93964a8d0bdc802b9be2500"/3636], &(0x7f0000000040)='GPL\x00', 0x4, 0xfdc0, &(0x7f0000000300)=""/4096, 0x0, 0x0, '\x00', 0x0, @xdp}, 0x70) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000100)="2b678fcd8622384bd8735f8e5288", 0x0, 0x2000, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xee, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2545, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1, 0x8}, 0x400, 0x5, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r6, 0x4004743d, 0x110e22fff6) close(r6) sendmsg$inet(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000780)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514001ac008001900030002000600060000800000005883c64d251e638294ff0051f60a84c9f4d4938037e7000000000000000000d1c566a000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x98010) setsockopt$sock_attach_bpf(r1, 0x29, 0x1b, &(0x7f0000000100)=r2, 0x120) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000001d00)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8fff7ff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001000000b70500000000e000720a23fe000000008500000012000000b70000000000000095000000000000004e6258941c823b7505608556ba4ababb42684e890d31ae450400373a0a5447a801b8c1c4f0c4bd97c6555e61345400f9bd42abeb9ade0105000000000000a21902ff07000094a2b51c21df74924f5436a6ed89b98f75e800230c49c90fe1336481f3b92a63336c36fcd745d61d7739c6554ca201000000bebbe8282f8b1e26407437a397bf8f50e87ed4d27adfd876bffc402887781979461c4363bc5c9b6202ea471428197ef88bc333fbcec0ea4334844d232279ae95a90fd41d528f58d305000000435883df6c10ce86188c92292b2d0226082960be682836bdff8b0971f2a5405e453228e7b1005bd73479358a90df3e481947de6453736aa572158af6ea63d6d418fbbd2bba050000001da000ef78df03000000d19913a5fb03c79dac2e489f68127892658115e7ffb588a71dffffff951b8535167ab8069a2c92a3aa18e22517000026637b4c34bf2d0aa304ed42bf70480e9e97203fd169411f37fddd1f7fbe16dbbc0f307bceb5064f388a0350c3dc928b0e638b1e2b2a9d25264233e5d45eb377f56b95241024dbe30f67191c2b56b70328d6d3215dfffe5d89af1d10599bd494d921d1fb2db99b6aba0fa978f41eb1d4c553e5a9326ed550c13f8dd36716a899a1e79234294707c5312b924d142c17b20bb80ee202222c03fa84ccc374e717f694018630366397266090a82343aedfbf7afe892390c2eb775b0d16073da2229958db05de7df6ab7600004000010000006d8081cb3bf251d906c00da0e23b50465f8394820be571e3592d0000c7ef10fdc462e7040e7074ec43aa461fc54401a76406db718d4efd6c1bd10ce1d087cf9bba461162555a95524c84df0952d32093082b7aa71304e0d2d9ec310d1b676b378a5879e47941de1a28c3a8f400000000000000000e032b7d2badd0bc6617a859b7ac273b6304555f664469cec152030f06cc0ca1765838eb5590264736fbccfc3a8f4e3b10daf6a275daf5db2dac7096fe8ac8876acaad043663b3b0fedb05e6d31408fa20140c9d2db1c59ac8a3ce28e489d67d87d3a107ccea3007f58f2c5017e8807107f79ac50cc1d4f546b4443d137eb706b71b1767a10cca7a7c82b76c96e874aff249f36329a6526b354b6e674b08f7ef492b804c4b08fb10de807d79fd782027318cd7632e22d2faa16209272b39b5ec8d239832ea02cc88e249a2e77753a58987547571fbc8de747faab724bebb6401412b496e078fcb6c78ab447e871b76a8b0506f49594aa1d610567e14d739a60ff3ce04d0d2e5681e787c7e1ad25467bb81f2f448128207fe07a83759ec30cf9e0a3fd3f2fcee97fe8d273f8e712a8a64eaf2d89a1fa44554357fcd7ab531ff7a41c27164fca430a62d015b477de61853f5ee2e25b00a63642ec32ece2ff3bb5883deb895f52a923b5c744d8dccdd6a09ded8b90f1eeda8e6e884a4f090edb6ab9fc8107846508d51f3735493d5860cf80200ce31b92eb3563d485b5a7d192092d7a9fd2bc67d305d1d4573aad5f6501d1cd27657ce17330402dacb78d72d776330711645eed7d4c292f4448733c0826c4eb950f3d40457f82d7f792d106518f6bde874aff9e2bea7d73f74bebeeacfc700000000000000000000d40d73be47803297db004264c8c70b7761b22a7114a078a87d63d63b0c9dcc263a5b773bfeba212abef4181ad9e4872e328c0f105d51e3d167a2b717051d7681ba04552eeba18a000000b22b50d76d85040c9000ea68a528049a60d5e26b20455194f4be3b8466fd66d0e6cefcff7891c485d61cb66f4076cd60a22733cb00cf7cc12ca7d9bb864c0e650236a79a5c85349a9b1e6bbc3bace197e72490c566431cd3a08e9d1b641c1ba1f661d01573b904c3fa1427370fa15cecd294ac21fefe3d161fdf58e8bc5957ef145839f4370176e1be88d2e3516a1998c1621a00b4438b85a4dfee6f61827a1e50e158038b037dfda3ffb35069e41fc740ae720800de53948f176c3c15f3a529c02434b920d87f12a6e3420a2fdcb3559e7a5b1ddbb06b7a5977f63bfac701e673bf626d126b213c92e7169a930beb8d76f9db34e8098bea301baa96916d6458c923866dc192928b320738d1b298fb55f2a64500000000000000000000000000509885a38d9d995a46817e7ff7acddcc5f9253c63f86baf33f92820c9ff497cf76b6482c3ab53fb6ecea6d220b91b99b2fb4279ab09ae0645ab92df309000000000000a4868411948f8e3e259b717d722a1eebd3f6860a17f1ae9e10a1178f6aef4951b192d13e9600c1f700ca7b1d127e451034469bf2a8f93dbae6ad8e932e431dc18323794156238625bb9c45c5a76a68a8646e701b29a71ffbd854f50f195823106a5625ff94221f1f04c72525b50aae69081de9626de9847bf53475d90642d9730101d80b1b0000000000000000822b0641698d60160d9157548302dd2636d12c431f96728ae4a45361e6d47a1c4a52d67c0f0a62585c09fcfd70d0f249f87c44b47283c1c6f2430d70c751e4ada9b646e6e7c1719faee476d88a2943c71a21db55b7497dd7ed385ac2e8cb916390a3a0ed52e7371e1a141e69afa07b46ac20f3521fb251b72c82ee1c7eb4f67c0deed5618d0db925ce7a7c50a99835544c540f5d528587d1a26e78df1bc9a8e4d90c57d0b8122eae7b23e4456624f5337c16c42648c7a3d0b799ad409befe0cbe2aa781ba826918df7aa80dff4f62258e54419629eb1d37de7f6a3512bd618781d1ad3a4d4b0da44df9f9a93f0487f79a9b16dfa6f68b06ce6a96ca344d194cded05702c2300d1a4f451b33830765f8131f6c28fada65701851bba089b8a8347900e72d68cea965feb6a06225dd3f0e135323a5bde3b43c9d242b73abf9e05336af040a4a6bb5918146393f1d50705c1d1e986bf2f690de51ee8727d37339df5391db535bb1e9bb3e5dadb6e5a2bb4faa2dcbc6ca9b40ac96e448b9dadeb08fc2cf3a960f22bf20b9e967b7a75687372b8e3edc543896c360674d901a7f56b07ba1479b46eea3d94026a9c7e670ab40bb2c1ca1a7c90299361239bef773140af974c7efc285a64633d21513481b3ac62dec9fa3e8ce6156d76b82baa145bc550b0ccbc0934ccfea45292caa2f0654fe18dc0669a4f2af9fa232a293ad94261f55675cc686db72783a6bacc0df6a1ea943ae266af112f35319980cd681811a369e0d03cf7d22bed7cbe1afe498b88942b1bf7edae441a0d0d88fce65cb4e848793a28cbd7373f6acd3b5a48c034e487750388929d37fa3165f205dab3be5f3e5781a84298687cbf02dcaf0e14a2b260293f349d076eb75a2ddc5382d106f0beea02aa45018fe36d1176cf7704383b6922d10dc80bc7feca3982ae232d4bb47c722c83a7cf6ee8832f038b072eb803a47cd7f753e80c9f6eedb8"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0xfffffffd}, 0x8}, 0x94) r7 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000080)={r7}, 0x4) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xa1, 0xffffffffffffff80}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000), 0xef) 1.195915014s ago: executing program 1 (id=1267): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000340)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='io.stat\x00', 0x26e1, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x40, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xd3c0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x7e}, 0x0, 0xffffffffffffffff, r1, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x13, 0x5, &(0x7f0000000380)=ANY=[@ANYRESDEC=r2], &(0x7f00000000c0)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000}, 0x94) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, 0x0, 0x200000c0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0xc1842, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000003c0)={r5, &(0x7f0000000340)}, 0x20) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x3, 0xc, &(0x7f00000007c0)=ANY=[], &(0x7f0000000680)='GPL\x00', 0x4, 0x0, 0x0, 0x41100, 0x29, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7ffffff8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4}, 0x50) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[], 0x48) r7 = socket$kcm(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="140000002e000b12d25a80648c2594f90224fc60", 0x14}], 0x1}, 0x2000d084) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r7, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)=r7}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000200)={0x1, 0x58, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r10 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r10, 0x1, 0x7, &(0x7f0000000040), 0x4) r11 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400), 0x4) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0300000004000000040000000a000000", @ANYRES32=r8, @ANYRES32=r9, @ANYRES32=r11, @ANYBLOB="00000000010000000300"/21], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x0, 0x0, &(0x7f0000000140)='GPL\x00', 0x2000, 0x0, 0x0, 0x0, 0x0, '\x00', r9, @fallback=0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00'}) socketpair(0x1, 0x6, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r12, 0x8946, 0x0) openat$cgroup_int(r0, &(0x7f00000002c0)='blkio.throttle.write_iops_device\x00', 0x2, 0x0) 1.195651204s ago: executing program 0 (id=1268): socket$kcm(0x10, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed5de7e91cd360a136ce6203c23c00fe82000000000400875a"], 0xfe1b) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) close(0x4) 1.185396874s ago: executing program 3 (id=1269): socket$kcm(0x10, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed5de7e91cd360a136ce6203c23c00fe82000000000400875a65969f7e750701810000000000000029"], 0xfe1b) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB], 0x0}, 0x94) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) 1.058746087s ago: executing program 3 (id=1270): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc00, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001800000000000000100100000c000000e8000000288670966c"], 0x30}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) r3 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000240)={r3, &(0x7f00000001c0), 0x0}, 0x20) socket$kcm(0x2, 0x200000000000001, 0x106) r4 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x8000, 0x10000, 0x364, 0x5, 0x4, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) close(0x3) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1a69, 0x5}, 0x0, 0x5, 0x0, 0x0, 0x1}, 0x0, 0xb, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) write$cgroup_devices(r2, &(0x7f0000000200)=ANY=[@ANYBLOB='r\x00'], 0x8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) recvmsg$unix(r0, &(0x7f0000004b80)={&(0x7f00000000c0), 0x6e, &(0x7f0000004a40)=[{&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000000340)=""/245, 0xf5}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)}, {&(0x7f0000003a40)=""/4096, 0x1000}], 0x5, &(0x7f0000004ac0)=[@rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x68}, 0x20) 1.025435288s ago: executing program 0 (id=1271): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030033000b35d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c06", 0x27}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1b, 0x4, 0x0, 0x0}, 0x90) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x800}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000040)="e03f030033000b35d25a806c8c6f94f90324fc601000050000", 0x19}], 0x1}, 0x40040) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) 931.97786ms ago: executing program 1 (id=1272): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000000104000000991805166700a6ba63ffd4c20f7e6e2041913031ebf6b28c5f907d22d1fb966970660b0057c8bd1b30272c88e7e401020ece230d9c0f069e672bfd032df7b396d1ec89849ff2f90444d217"], 0x50) r0 = socket$kcm(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000180)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000080)=ANY=[@ANYBLOB='c *:', @ANYRESDEC], 0x1d) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b06d25a806c8c6f94f90424fc600400037a0a000920050282c137153e370e0c1180fc0b10000300", 0x33fe0}], 0x1}, 0x0) 931.73253ms ago: executing program 2 (id=1273): r0 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x9081, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x9, 0x2}, 0x0, 0x32, 0x43a1bd76, 0x2, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x22, 0x2, 0x21) write$cgroup_subtree(r4, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r2) ioctl$PERF_EVENT_IOC_QUERY_BPF(r1, 0xc008240a, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r3) socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x1) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0xfffffffc}, 0x50) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000840)={&(0x7f00000004c0), 0x0, 0x0, 0x0, 0x8, r6}, 0x38) 822.009782ms ago: executing program 3 (id=1274): r0 = socket$kcm(0x11, 0xa, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$tipc(r1, &(0x7f0000003a00)={&(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x1, 0x0, 0x9}}, 0x10, &(0x7f0000000b40)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000001a00), 0x101d0}], 0x4}, 0x0) recvmsg(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x1}, 0x0) (fail_nth: 5) 784.785923ms ago: executing program 0 (id=1275): write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) r0 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r0, &(0x7f0000000240)={&(0x7f0000000000)=@in6={0xa, 0x41, 0x0, @loopback, 0x2}, 0x80, 0x0}, 0xe07e872424dfefca) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10305, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0x7}, 0x104101, 0x6, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x3) sendmsg$inet(r1, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x0, @remote}, 0x10, 0x0}, 0x3000c041) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x258, &(0x7f0000000140)=[{&(0x7f0000000280)="89000000120081ae08060cdc030ec0007f03e3f7ff1f000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120800030006010000bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) 685.461255ms ago: executing program 1 (id=1276): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x4, 0x7fe2, 0x1, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r1, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000340)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmsg$kcm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4135, 0x1027}], 0x1}, 0x42) perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0xf0, 0x5f, 0x9f, 0x4, 0x0, 0x6, 0x30531, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800009, 0x2, @perf_config_ext={0x1, 0x8}, 0x10002, 0x9dd, 0x80000020, 0x6, 0x400, 0x0, 0x8, 0x0, 0x100, 0x0, 0x201}, 0x0, 0x8, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b03d25a806f8c6394f90524fc6004", 0x15}], 0x1}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe000030"], 0xfe33) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000002280)={r7, &(0x7f00000020c0)="ea9f1a222343e6e771fcff18800beb56ffa4bc9d45893449b9c0c47b7a032ce729e217f0343747899cf01afb8e80960c0eb4bf9d7a91d3e24e7ae77b615cefeacbac9c0c8f5d5d034c423e7603b118292173f064ddd24081e392f3c0664d13daa3cb7bd5d7d68605ebe7efcdd5fa76b0aadd6eac3e2c360e9fe36abeb209d2a656b9c2ac0876d21b54cf761a28f9f417", &(0x7f0000002180)=""/244, 0x4}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={0xffffffffffffffff, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000180), &(0x7f00000001c0)=[0x0, 0x0], 0x0, 0xc2, 0x0, 0x0, 0x10, &(0x7f0000000240), &(0x7f00000002c0), 0x8, 0x80, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) close(r7) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x5452, &(0x7f0000000400)='lo\x00\x96o\xd6Q\xb4Y\xa9\xc87,%\x81\xfe\x00\xd2\xd1|\x00\x00\x00\x00\x00\x00\xe3\xd8Yk\xdf\x85\xaac{\x8c\x8ffp`-\xcd\xd9\xd5\xf4\xe68\xe6O\xc2\xf1V0\x8b\t\xed\x13q2\xdd\xcc\xeeR\xf2/\xba\fE>k\a\xe7>t7\x8e(\xf0\x87d\xaf\x93\xfa`\xa6,o\x81.\x1cR\xa5\t\x00\x00\x00\x00\x00\x00\x00|pT\x15\xbc\f*d\xcb\xc2\xcd\x8f\x98\xdf\x00\x00\x1cM\x9c\xa5\xe0\xa8\x00\x00\x00\x80V\xf6\x80\x86\x1b\x05\xe6\"\x1d\f\xaey\x06\xd9$H!w\xa6m\xd8\x7f\xc6\x837\x83/\x9a\xdf\x01\xf2\x9e\xbb\xca\x04\x00\x05\xeb\xb8{7[\xf9\xe9\x15\xdc0]\x89\x9b~\x04\xb4\xa5\xad\v.\xd0*%`\xb0\x03\x00\x00\x00\x00\x00\x00\x00\xab\xf4\xa7\x83r\xa4\x80|\x03C\x9c\x00\xac\xba\xcb\xa4h\x86w_Eu\xbfy%,\xe5\n\xc1\xb3\xa4g\xa3P\x0f\x11\x93\xc7\xf3\xcf\x17\xf5\x86%\x7f\xec\xb2\xc5E\x00\xb2e\xa8\xf1<\xb2\xc82\xbf=o\x00\x00\x00\x00E\x00\xc6X\x92\x0e[\x19\xaa?\x06\xe5\x9d\xd1\x87\x922A\x95\x8e\xbc\xc80xffffffffffffffff}) setsockopt$sock_attach_bpf(r0, 0x1, 0xe, &(0x7f0000000040), 0x3b) bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000000000"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext, 0x86bf2056334f3ae6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x5, 0x111, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffc}, 0x9006, 0xa, 0x0, 0x0, 0x0, 0x0, 0x3000, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd630080fc00082c00db5b6861589bcfe8875a060300000023000000000000000000000000ac1414aa"], 0xfdef) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb790700117df37538e486dd6317ce2200fc"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001f00)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xec}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) 370.183862ms ago: executing program 0 (id=1278): socket$kcm(0x10, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed5de7e91cd360a136ce6203c23c00fe82000000000400875a65969f7e750701810000000000000029"], 0xfe1b) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB], 0x0}, 0x94) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) 244.025325ms ago: executing program 1 (id=1279): socket$kcm(0x10, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed5de7e91cd360a136ce6203c23c00fe82000000000400875a"], 0xfe1b) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) close(0x4) 234.881045ms ago: executing program 0 (id=1280): r0 = socket$kcm(0xa, 0x922000000003, 0x11) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f0000000cc0)=@l2tp6={0xa, 0xb00, 0x1001000, @mcast2, 0x47}, 0x80, 0x0}, 0x800) 209.295446ms ago: executing program 2 (id=1281): r0 = socket$kcm(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000240)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000181c0000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100030000009500000000000000bf71000000000000b7020000000000008500000000000000b70000000000000095000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x8}, 0x94) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$kcm(0x2, 0x1, 0x84) r4 = socket$kcm(0x2b, 0x1, 0x0) close(r4) socket$kcm(0xa, 0x2, 0x73) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000240)="29000000250005000000b6eb1405000000a48cdfb11301b355000000", 0x1c}, {&(0x7f0000000580)="1c7e17c4b3dfa62dd13c405faf", 0xd}], 0x2}, 0x4000) setsockopt$sock_attach_bpf(r4, 0x1, 0xd, &(0x7f00000001c0), 0x45) close(r4) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x2b, 0x1, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x5411, &(0x7f0000000000)) setsockopt$sock_attach_bpf(r3, 0x84, 0x6b, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000a40)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x2f, &(0x7f0000000480), 0x4) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f00000000c0)={r0}) socket$kcm(0x10, 0x3, 0x10) r8 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x1, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r8, 0x40042408, r9) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3, 0x0, 0x0, 0x8, 0x1, 0x1002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x50) r10 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48283, 0x0) r11 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_devices(r11, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000100)={'\x00', 0x52d35ce30131f272}) 154.646117ms ago: executing program 1 (id=1282): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc00, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000100100000100000000000000000000001800000000000000100100000c000000e8000000288670966c"], 0x30}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) r3 = bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000240)={r3, &(0x7f00000001c0), 0x0}, 0x20) socket$kcm(0x2, 0x200000000000001, 0x106) r4 = perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x8000, 0x10000, 0x364, 0x5, 0x4, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r5 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001540)={&(0x7f0000000040)=@qipcrtr={0x2a, 0x1, 0x4000}, 0x80, 0x0}, 0x0) close(0x3) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x1a69, 0x5}, 0x0, 0x5, 0x0, 0x0, 0x1}, 0x0, 0xb, 0xffffffffffffffff, 0xb) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) write$cgroup_devices(r2, &(0x7f0000000200)=ANY=[@ANYBLOB='r\x00'], 0x8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b04, &(0x7f0000000000)={'wlan1\x00', @random="0200"}) recvmsg$unix(r0, &(0x7f0000004b80)={&(0x7f00000000c0), 0x6e, &(0x7f0000004a40)=[{&(0x7f00000001c0)=""/11, 0xb}, {&(0x7f0000000340)=""/245, 0xf5}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000003a00)}, {&(0x7f0000003a40)=""/4096, 0x1000}], 0x5, &(0x7f0000004ac0)=[@rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}], 0x68}, 0x20) 0s ago: executing program 0 (id=1283): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, &(0x7f0000000140)='GPL\x00'}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030033000b35d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c06", 0x27}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x1b, 0x4, 0x0, 0x0}, 0x90) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth0_to_hsr\x00', 0x800}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080)) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000040)="e03f030033000b35d25a806c8c6f94f90324fc601000050000", 0x19}], 0x1}, 0x40040) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)=ANY=[@ANYBLOB="7c00000000000000000000000700000044140001ac1414aa00000000ac1414000000000000441c0003e0000001000000007f000001000000000000000000000000442c00000000000000000f883816814100000000000000000000000000000000000000000000000000000000000000000000440c0001000000000000000000000000000000a400000000000000000000000700000044280000000000000000000000000000000000000000000000000000000000000000000000000000071700e0000002ac1414bb00000000e0000002ac1414bb018616000000000010c986d78e6c4b9394b247217b87cb00830b00000000007f000001861f0000000000020010421487f84baabcbcfb42a4d90bab000748c68c4c31001089ca45d9612e5b5c11f12bc78a41000000000000006c000000000000000000000007000000441c0003ffffffff000000000000000000000000e00000010000000044340001ac1414bb0000000000000000000000000000000000000000ac1414aa00000000ac1414aa00000000ac1e000100000000830b0000000000e000000200000000001c000000000000000000", @ANYRES32=0x0, @ANYBLOB="ac1414aa00000000000000001400000000000018000000000200000000000000000000001c000000000000000000000008", @ANYRES32=0x0, @ANYBLOB="7f0000017f00000a0000000800"/28, @ANYRES32, @ANYBLOB="7f000001ac141400000000011c0e0000000000000000000007006fc946f1f569c01801"], 0x230}, 0x0) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000720000001801"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe0000180091c8b14a0778a8123d181d"], 0xfe33) kernel console output (not intermixed with test programs): 700 [ 212.451315][ T7375] array_map_alloc+0x28a/0x700 [ 212.456110][ T7375] map_create+0x877/0x12f0 [ 212.460552][ T7375] __sys_bpf+0x651/0x890 [ 212.464830][ T7375] ? bpf_link_show_fdinfo+0x390/0x390 [ 212.470239][ T7375] ? lock_chain_count+0x20/0x20 [ 212.475220][ T7375] __x64_sys_bpf+0x7c/0x90 [ 212.479666][ T7375] do_syscall_64+0x55/0xb0 [ 212.484119][ T7375] ? clear_bhb_loop+0x40/0x90 [ 212.488819][ T7375] ? clear_bhb_loop+0x40/0x90 [ 212.493573][ T7375] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 212.499500][ T7375] RIP: 0033:0x7f83c859de99 [ 212.503943][ T7375] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 212.523624][ T7375] RSP: 002b:00007f83c939b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 212.532072][ T7375] RAX: ffffffffffffffda RBX: 00007f83c8825fa0 RCX: 00007f83c859de99 [ 212.540084][ T7375] RDX: 0000000000000050 RSI: 00002000000001c0 RDI: 0000000000000000 [ 212.548090][ T7375] RBP: 00007f83c939b090 R08: 0000000000000000 R09: 0000000000000000 [ 212.556113][ T7375] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 212.564113][ T7375] R13: 00007f83c8826038 R14: 00007f83c8825fa0 R15: 00007ffcf16656b8 [ 212.572130][ T7375] [ 213.239815][ T7385] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 215.521822][ T7384] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.548'. [ 215.534233][ T7387] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.548'. [ 215.546201][ T7398] netlink: 14 bytes leftover after parsing attributes in process `syz.1.553'. [ 215.558259][ T7399] netlink: 14 bytes leftover after parsing attributes in process `syz.1.553'. [ 215.734767][ T7403] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 215.905226][ T7408] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 218.074171][ T2932] wlan1: Trigger new scan to find an IBSS to join [ 218.074879][ T42] wlan1: Trigger new scan to find an IBSS to join [ 218.091907][ T7426] netlink: 14 bytes leftover after parsing attributes in process `syz.2.564'. [ 218.196712][ T7431] netlink: 14 bytes leftover after parsing attributes in process `syz.2.564'. [ 218.220936][ T7436] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.566'. [ 218.256723][ T7438] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.566'. [ 218.276852][ T7435] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.566'. [ 218.451708][ T7443] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 218.835152][ T7448] netlink: 'syz.3.569': attribute type 3 has an invalid length. [ 218.849573][ T7448] netlink: 'syz.3.569': attribute type 1 has an invalid length. [ 218.860374][ T7448] netlink: 181400 bytes leftover after parsing attributes in process `syz.3.569'. [ 218.937161][ T7448] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 218.971431][ T7448] openvswitch: netlink: Message has 18430 unknown bytes. [ 219.543273][ T7462] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 220.995835][ T7478] __nla_validate_parse: 1 callbacks suppressed [ 220.995851][ T7478] netlink: 14 bytes leftover after parsing attributes in process `syz.3.579'. [ 221.043329][ T7478] netlink: 14 bytes leftover after parsing attributes in process `syz.3.579'. [ 221.418460][ T7485] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.578'. [ 221.455200][ T7482] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.578'. [ 221.615524][ T7479] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.578'. [ 221.651022][ T7491] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.583'. [ 221.701960][ T7491] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 221.737793][ T7491] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 221.818026][ T7494] netlink: 'syz.3.583': attribute type 17 has an invalid length. [ 221.856648][ T7494] netlink: 152 bytes leftover after parsing attributes in process `syz.3.583'. [ 221.886356][ T7494] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 222.068368][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 222.272800][ T7500] Illegal XDP return value 4294967274 on prog (id 625) dev N/A, expect packet loss! [ 222.294909][ T2932] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 222.525399][ T7500] netlink: 14 bytes leftover after parsing attributes in process `syz.1.586'. [ 222.599848][ T7505] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 222.721118][ T7508] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 222.931524][ T7515] netlink: 14 bytes leftover after parsing attributes in process `syz.0.591'. [ 222.975898][ T7515] netlink: 14 bytes leftover after parsing attributes in process `syz.0.591'. [ 223.363533][ T7524] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 223.675176][ T7529] syz.1.596 uses obsolete (PF_INET,SOCK_PACKET) [ 223.796046][ T7529] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 223.803942][ T7529] IPv6: NLM_F_CREATE should be set when creating new route [ 223.812049][ T7529] IPv6: NLM_F_CREATE should be set when creating new route [ 223.819499][ T7529] IPv6: NLM_F_CREATE should be set when creating new route [ 223.879152][ T7533] netlink: 'syz.1.596': attribute type 9 has an invalid length. [ 223.953445][ T7535] netlink: 'syz.0.598': attribute type 16 has an invalid length. [ 224.336156][ T7545] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 224.920657][ T7563] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 225.116747][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 225.570595][ T7578] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 226.066762][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 226.254564][ T7589] __nla_validate_parse: 8 callbacks suppressed [ 226.254599][ T7589] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.616'. [ 226.295960][ T7589] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 226.303474][ T7589] IPv6: NLM_F_CREATE should be set when creating new route [ 226.311181][ T7589] IPv6: NLM_F_CREATE should be set when creating new route [ 226.318668][ T7589] IPv6: NLM_F_CREATE should be set when creating new route [ 226.365481][ T7589] netlink: 'syz.2.616': attribute type 9 has an invalid length. [ 226.385150][ T7589] netlink: 179768 bytes leftover after parsing attributes in process `syz.2.616'. [ 226.622768][ T7599] netlink: 14 bytes leftover after parsing attributes in process `syz.0.628'. [ 226.831493][ T7604] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 227.116653][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 227.125833][ T7608] netlink: 'syz.0.622': attribute type 29 has an invalid length. [ 227.153094][ T7608] netlink: 'syz.0.622': attribute type 29 has an invalid length. [ 229.106891][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 229.113518][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 229.879186][ T7610] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 230.016176][ T7617] syzkaller0: entered promiscuous mode [ 230.053325][ T7617] syzkaller0: entered allmulticast mode [ 232.068066][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 232.074667][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 232.996425][ T41] wlan1: Creating new IBSS network, BSSID 6e:11:c5:56:2b:4a [ 233.029726][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 233.182349][ T7629] netlink: 14 bytes leftover after parsing attributes in process `syz.2.627'. [ 233.191628][ T7631] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 233.354522][ T7641] netlink: 14 bytes leftover after parsing attributes in process `syz.1.631'. [ 233.514933][ T7645] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.633'. [ 233.557158][ T7645] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 233.564840][ T7645] IPv6: NLM_F_CREATE should be set when creating new route [ 233.572710][ T7645] IPv6: NLM_F_CREATE should be set when creating new route [ 233.580447][ T7645] IPv6: NLM_F_CREATE should be set when creating new route [ 233.645843][ T7645] netlink: 'syz.3.633': attribute type 9 has an invalid length. [ 233.661639][ T7645] netlink: 179768 bytes leftover after parsing attributes in process `syz.3.633'. [ 234.123609][ T7658] netlink: 763 bytes leftover after parsing attributes in process `syz.0.639'. [ 234.339588][ T7663] netlink: 'syz.1.640': attribute type 13 has an invalid length. [ 234.683034][ T7663] netlink: 194236 bytes leftover after parsing attributes in process `syz.1.640'. [ 234.695089][ T7672] FAULT_INJECTION: forcing a failure. [ 234.695089][ T7672] name failslab, interval 1, probability 0, space 0, times 0 [ 234.695343][ T7672] CPU: 0 PID: 7672 Comm: syz.0.642 Not tainted syzkaller #0 [ 234.695368][ T7672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 234.695382][ T7672] Call Trace: [ 234.695401][ T7672] [ 234.695415][ T7672] dump_stack_lvl+0x18c/0x250 [ 234.695449][ T7672] ? sctp_sendmsg+0x1519/0x27b0 [ 234.695474][ T7672] ? ___sys_sendmsg+0x2a6/0x360 [ 234.695508][ T7672] ? show_regs_print_info+0x20/0x20 [ 234.695542][ T7672] ? load_image+0x420/0x420 [ 234.695620][ T7672] should_fail_ex+0x394/0x4c0 [ 234.695667][ T7672] should_failslab+0x9/0x20 [ 234.695694][ T7672] slab_pre_alloc_hook+0x59/0x300 [ 234.695731][ T7672] ? sctp_add_bind_addr+0x8c/0x360 [ 234.695762][ T7672] __kmem_cache_alloc_node+0x53/0x250 [ 234.695803][ T7672] ? sctp_add_bind_addr+0x8c/0x360 [ 234.695830][ T7672] kmalloc_trace+0x2a/0xe0 [ 234.695869][ T7672] sctp_add_bind_addr+0x8c/0x360 [ 234.695909][ T7672] sctp_copy_local_addr_list+0x31b/0x4e0 [ 234.695945][ T7672] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 234.695975][ T7672] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 234.696017][ T7672] ? sctp_v4_is_any+0x35/0x60 [ 234.696040][ T7672] ? sctp_copy_one_addr+0x8c/0x350 [ 234.696080][ T7672] sctp_bind_addr_copy+0xb3/0x3c0 [ 234.696112][ T7672] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 234.696154][ T7672] sctp_connect_new_asoc+0x2f9/0x6a0 [ 234.696193][ T7672] ? __sctp_connect+0xd80/0xd80 [ 234.696215][ T7672] ? __local_bh_enable_ip+0x13a/0x1c0 [ 234.696262][ T7672] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 234.696287][ T7672] ? security_sctp_bind_connect+0x89/0xb0 [ 234.696327][ T7672] sctp_sendmsg+0x1519/0x27b0 [ 234.696403][ T7672] ? sctp_getsockopt+0xb60/0xb60 [ 234.696427][ T7672] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 234.696474][ T7672] ? aa_af_perm+0x330/0x330 [ 234.696513][ T7672] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 234.696558][ T7672] ? sock_rps_record_flow+0x19/0x3f0 [ 234.696598][ T7672] ? inet_sendmsg+0xce/0x2a0 [ 234.696626][ T7672] ? inet_send_prepare+0x250/0x250 [ 234.696661][ T7672] ____sys_sendmsg+0x61b/0x980 [ 234.696716][ T7672] ? __asan_memset+0x22/0x40 [ 234.696746][ T7672] ? __sys_sendmsg_sock+0x30/0x30 [ 234.696772][ T7672] ? __import_iovec+0x5f2/0x850 [ 234.696832][ T7672] ? import_iovec+0x73/0xa0 [ 234.696875][ T7672] ___sys_sendmsg+0x2a6/0x360 [ 234.696928][ T7672] ? __sys_sendmsg+0x2b0/0x2b0 [ 234.697029][ T7672] ? __lock_acquire+0x7d80/0x7d80 [ 234.697134][ T7672] __se_sys_sendmsg+0x1d0/0x2c0 [ 234.697177][ T7672] ? __x64_sys_sendmsg+0x80/0x80 [ 234.697264][ T7672] ? lockdep_hardirqs_on+0x98/0x150 [ 234.697305][ T7672] do_syscall_64+0x55/0xb0 [ 234.697331][ T7672] ? clear_bhb_loop+0x40/0x90 [ 234.697352][ T7672] ? clear_bhb_loop+0x40/0x90 [ 234.697382][ T7672] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 234.697417][ T7672] RIP: 0033:0x7f1927b9de99 [ 234.697444][ T7672] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 234.697463][ T7672] RSP: 002b:00007f1928a38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 234.697492][ T7672] RAX: ffffffffffffffda RBX: 00007f1927e25fa0 RCX: 00007f1927b9de99 [ 234.697510][ T7672] RDX: 0000000000000040 RSI: 00002000000003c0 RDI: 0000000000000003 [ 234.697526][ T7672] RBP: 00007f1928a38090 R08: 0000000000000000 R09: 0000000000000000 [ 234.697542][ T7672] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 234.697558][ T7672] R13: 00007f1927e26038 R14: 00007f1927e25fa0 R15: 00007ffc5be74838 [ 234.697629][ T7672] [ 235.213588][ T7666] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 235.251303][ T7663] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 235.478765][ T7678] netlink: 14 bytes leftover after parsing attributes in process `syz.0.646'. [ 236.028352][ T7691] netlink: 'syz.2.650': attribute type 29 has an invalid length. [ 236.053945][ T7691] netlink: 'syz.2.650': attribute type 29 has an invalid length. [ 236.815121][ T7695] FAULT_INJECTION: forcing a failure. [ 236.815121][ T7695] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 236.862506][ T7695] CPU: 0 PID: 7695 Comm: syz.1.652 Not tainted syzkaller #0 [ 236.869860][ T7695] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 236.879952][ T7695] Call Trace: [ 236.883300][ T7695] [ 236.886249][ T7695] dump_stack_lvl+0x18c/0x250 [ 236.890963][ T7695] ? show_regs_print_info+0x20/0x20 [ 236.896184][ T7695] ? load_image+0x420/0x420 [ 236.900706][ T7695] ? __might_fault+0xaa/0x120 [ 236.905431][ T7695] ? __lock_acquire+0x7d80/0x7d80 [ 236.910479][ T7695] should_fail_ex+0x394/0x4c0 [ 236.915166][ T7695] _copy_from_user+0x2f/0xe0 [ 236.919768][ T7695] ___sys_sendmsg+0x1c7/0x360 [ 236.924452][ T7695] ? get_pid_task+0x20/0x1e0 [ 236.929043][ T7695] ? __sys_sendmsg+0x2b0/0x2b0 [ 236.933833][ T7695] ? __lock_acquire+0x7d80/0x7d80 [ 236.938889][ T7695] __se_sys_sendmsg+0x1d0/0x2c0 [ 236.943762][ T7695] ? __x64_sys_sendmsg+0x80/0x80 [ 236.948723][ T7695] ? lockdep_hardirqs_on+0x98/0x150 [ 236.953929][ T7695] do_syscall_64+0x55/0xb0 [ 236.958356][ T7695] ? clear_bhb_loop+0x40/0x90 [ 236.963040][ T7695] ? clear_bhb_loop+0x40/0x90 [ 236.967716][ T7695] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 236.973626][ T7695] RIP: 0033:0x7fc67759de99 [ 236.978056][ T7695] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 236.997664][ T7695] RSP: 002b:00007fc678480028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 237.006103][ T7695] RAX: ffffffffffffffda RBX: 00007fc677825fa0 RCX: 00007fc67759de99 [ 237.014079][ T7695] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 000000000000000d [ 237.022051][ T7695] RBP: 00007fc678480090 R08: 0000000000000000 R09: 0000000000000000 [ 237.030017][ T7695] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 237.037995][ T7695] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 237.045981][ T7695] [ 237.109626][ T41] wlan1: Trigger new scan to find an IBSS to join [ 237.167800][ T7700] netlink: 'syz.3.653': attribute type 9 has an invalid length. [ 237.185823][ T7700] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.653'. [ 237.278207][ T7697] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.651'. [ 237.288796][ T7699] netlink: 'syz.3.653': attribute type 9 has an invalid length. [ 237.321801][ T7697] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 237.329292][ T7697] IPv6: NLM_F_CREATE should be set when creating new route [ 237.336828][ T7697] IPv6: NLM_F_CREATE should be set when creating new route [ 237.344277][ T7697] IPv6: NLM_F_CREATE should be set when creating new route [ 237.370031][ T7699] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.653'. [ 237.658256][ T7702] netlink: 'syz.0.651': attribute type 9 has an invalid length. [ 237.999478][ T7711] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 238.112863][ T7714] netlink: 'syz.0.657': attribute type 13 has an invalid length. [ 238.306160][ T7716] __nla_validate_parse: 1 callbacks suppressed [ 238.306181][ T7716] netlink: 14 bytes leftover after parsing attributes in process `syz.3.658'. [ 238.539597][ T7714] netlink: 194236 bytes leftover after parsing attributes in process `syz.0.657'. [ 238.596949][ T7714] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 239.206314][ T7734] netlink: 'syz.1.664': attribute type 3 has an invalid length. [ 239.246672][ T7734] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.664'. [ 239.648992][ T7738] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 240.081019][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 240.305003][ T7757] netlink: 14 bytes leftover after parsing attributes in process `syz.3.675'. [ 240.364326][ T7755] netlink: 'syz.2.673': attribute type 13 has an invalid length. [ 240.568562][ T7761] netlink: 'syz.0.676': attribute type 4 has an invalid length. [ 240.636636][ T7761] netlink: 152 bytes leftover after parsing attributes in process `syz.0.676'. [ 240.985251][ T7769] netlink: 'syz.3.677': attribute type 25 has an invalid length. [ 241.034567][ T7769] netlink: 'syz.3.677': attribute type 3 has an invalid length. [ 241.263522][ T7755] netlink: 194236 bytes leftover after parsing attributes in process `syz.2.673'. [ 241.286825][ T7755] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 241.484892][ T7776] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 241.890487][ T7788] FAULT_INJECTION: forcing a failure. [ 241.890487][ T7788] name failslab, interval 1, probability 0, space 0, times 0 [ 241.903574][ T7788] CPU: 1 PID: 7788 Comm: syz.0.682 Not tainted syzkaller #0 [ 241.910889][ T7788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 241.920973][ T7788] Call Trace: [ 241.924281][ T7788] [ 241.927234][ T7788] dump_stack_lvl+0x18c/0x250 [ 241.931959][ T7788] ? show_regs_print_info+0x20/0x20 [ 241.937213][ T7788] ? load_image+0x420/0x420 [ 241.941768][ T7788] should_fail_ex+0x394/0x4c0 [ 241.946476][ T7788] should_failslab+0x9/0x20 [ 241.951009][ T7788] slab_pre_alloc_hook+0x59/0x300 [ 241.956090][ T7788] kmem_cache_alloc+0x5a/0x2c0 [ 241.960888][ T7788] ? sctp_get_port_local+0x69f/0x15d0 [ 241.966296][ T7788] sctp_get_port_local+0x69f/0x15d0 [ 241.971568][ T7788] ? sctp_do_bind+0x8f0/0x8f0 [ 241.976278][ T7788] ? sctp_bind_addr_match+0x30/0x2a0 [ 241.981600][ T7788] sctp_do_bind+0x4c0/0x8f0 [ 241.986144][ T7788] sctp_connect_new_asoc+0x26a/0x6a0 [ 241.991467][ T7788] ? __sctp_connect+0xd80/0xd80 [ 241.996348][ T7788] ? __local_bh_enable_ip+0x13a/0x1c0 [ 242.001793][ T7788] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 242.007378][ T7788] ? security_sctp_bind_connect+0x89/0xb0 [ 242.013141][ T7788] sctp_sendmsg+0x1519/0x27b0 [ 242.017864][ T7788] ? sctp_getsockopt+0xb60/0xb60 [ 242.022830][ T7788] ? aa_af_perm+0x330/0x330 [ 242.027361][ T7788] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 242.033845][ T7788] ? sock_rps_record_flow+0x19/0x3f0 [ 242.039185][ T7788] ? inet_sendmsg+0xce/0x2a0 [ 242.043801][ T7788] ? inet_send_prepare+0x250/0x250 [ 242.048946][ T7788] ____sys_sendmsg+0x61b/0x980 [ 242.053757][ T7788] ? __asan_memset+0x22/0x40 [ 242.058380][ T7788] ? __sys_sendmsg_sock+0x30/0x30 [ 242.063443][ T7788] ? __import_iovec+0x5f2/0x850 [ 242.068346][ T7788] ? import_iovec+0x73/0xa0 [ 242.072890][ T7788] ___sys_sendmsg+0x2a6/0x360 [ 242.077604][ T7788] ? get_pid_task+0x20/0x1e0 [ 242.082223][ T7788] ? __sys_sendmsg+0x2b0/0x2b0 [ 242.087031][ T7788] ? __lock_acquire+0x7d80/0x7d80 [ 242.092122][ T7788] __se_sys_sendmsg+0x1d0/0x2c0 [ 242.097010][ T7788] ? __x64_sys_sendmsg+0x80/0x80 [ 242.101995][ T7788] ? lockdep_hardirqs_on+0x98/0x150 [ 242.107231][ T7788] do_syscall_64+0x55/0xb0 [ 242.111685][ T7788] ? clear_bhb_loop+0x40/0x90 [ 242.116488][ T7788] ? clear_bhb_loop+0x40/0x90 [ 242.121199][ T7788] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 242.127133][ T7788] RIP: 0033:0x7f1927b9de99 [ 242.131570][ T7788] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 242.151201][ T7788] RSP: 002b:00007f1928a38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 242.159649][ T7788] RAX: ffffffffffffffda RBX: 00007f1927e25fa0 RCX: 00007f1927b9de99 [ 242.167656][ T7788] RDX: 0000000000008054 RSI: 0000200000000ac0 RDI: 0000000000000005 [ 242.175690][ T7788] RBP: 00007f1928a38090 R08: 0000000000000000 R09: 0000000000000000 [ 242.183690][ T7788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 242.191690][ T7788] R13: 00007f1927e26038 R14: 00007f1927e25fa0 R15: 00007ffc5be74838 [ 242.199711][ T7788] [ 242.307382][ T7794] netlink: 14 bytes leftover after parsing attributes in process `syz.3.685'. [ 242.952746][ T7804] netlink: 'syz.3.689': attribute type 10 has an invalid length. [ 243.427250][ T7813] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 243.699534][ T7826] netlink: 14 bytes leftover after parsing attributes in process `syz.3.697'. [ 243.817634][ T7827] netlink: 763 bytes leftover after parsing attributes in process `syz.1.696'. [ 244.066727][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 244.355142][ T7832] netlink: 'syz.2.698': attribute type 10 has an invalid length. [ 244.430761][ T7832] netlink: 2 bytes leftover after parsing attributes in process `syz.2.698'. [ 244.495258][ T7832] hsr0: entered promiscuous mode [ 244.521284][ T7832] bridge0: port 2(hsr0) entered blocking state [ 244.651348][ T7832] bridge0: port 2(hsr0) entered disabled state [ 244.711432][ T7832] hsr0: entered allmulticast mode [ 244.770959][ T7832] hsr_slave_0: entered allmulticast mode [ 244.811401][ T7832] hsr_slave_1: entered allmulticast mode [ 244.909275][ T7832] bridge0: port 2(hsr0) entered blocking state [ 244.915744][ T7832] bridge0: port 2(hsr0) entered forwarding state [ 245.651029][ T7851] FAULT_INJECTION: forcing a failure. [ 245.651029][ T7851] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 245.747059][ T7851] CPU: 1 PID: 7851 Comm: syz.2.705 Not tainted syzkaller #0 [ 245.754434][ T7851] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 245.764541][ T7851] Call Trace: [ 245.767873][ T7851] [ 245.770845][ T7851] dump_stack_lvl+0x18c/0x250 [ 245.775583][ T7851] ? show_regs_print_info+0x20/0x20 [ 245.780831][ T7851] ? load_image+0x420/0x420 [ 245.785370][ T7851] ? __might_fault+0xaa/0x120 [ 245.790069][ T7851] ? __lock_acquire+0x7d80/0x7d80 [ 245.795135][ T7851] should_fail_ex+0x394/0x4c0 [ 245.799850][ T7851] _copy_from_user+0x2f/0xe0 [ 245.804470][ T7851] __sys_bpf+0x23e/0x890 [ 245.808732][ T7851] ? bpf_link_show_fdinfo+0x390/0x390 [ 245.814152][ T7851] ? lock_chain_count+0x20/0x20 [ 245.819043][ T7851] __x64_sys_bpf+0x7c/0x90 [ 245.823483][ T7851] do_syscall_64+0x55/0xb0 [ 245.827918][ T7851] ? clear_bhb_loop+0x40/0x90 [ 245.832612][ T7851] ? clear_bhb_loop+0x40/0x90 [ 245.837304][ T7851] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 245.843235][ T7851] RIP: 0033:0x7fa352b9de99 [ 245.847702][ T7851] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 245.867326][ T7851] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 245.875766][ T7851] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 245.883773][ T7851] RDX: 0000000000000048 RSI: 00002000000009c0 RDI: 0000000000000000 [ 245.891759][ T7851] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 245.899739][ T7851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 245.907833][ T7851] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 245.915852][ T7851] [ 246.078535][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 246.358415][ T7856] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 246.484469][ T7863] netlink: 14 bytes leftover after parsing attributes in process `syz.0.709'. [ 246.691425][ T7865] netlink: 60 bytes leftover after parsing attributes in process `syz.2.710'. [ 246.712577][ T7868] netlink: 'syz.1.711': attribute type 19 has an invalid length. [ 246.746743][ T7868] netlink: 14552 bytes leftover after parsing attributes in process `syz.1.711'. [ 246.909265][ T7865] netlink: 60 bytes leftover after parsing attributes in process `syz.2.710'. [ 246.996397][ T7871] netlink: 60 bytes leftover after parsing attributes in process `syz.2.710'. [ 247.085720][ T7865] netlink: 60 bytes leftover after parsing attributes in process `syz.2.710'. [ 247.137545][ T7877] netlink: 'syz.3.712': attribute type 10 has an invalid length. [ 247.191170][ T7877] netlink: 2 bytes leftover after parsing attributes in process `syz.3.712'. [ 247.237216][ T7877] hsr0: entered promiscuous mode [ 247.242531][ T7877] bridge0: port 2(hsr0) entered blocking state [ 247.367107][ T7877] bridge0: port 2(hsr0) entered disabled state [ 247.408262][ T7877] hsr0: entered allmulticast mode [ 247.465914][ T7877] hsr_slave_0: entered allmulticast mode [ 247.517119][ T7877] hsr_slave_1: entered allmulticast mode [ 247.553066][ T7877] bridge0: port 2(hsr0) entered blocking state [ 247.559454][ T7877] bridge0: port 2(hsr0) entered forwarding state [ 249.110954][ T42] wlan1: Trigger new scan to find an IBSS to join [ 249.897546][ T7896] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 249.949273][ T7900] __nla_validate_parse: 4 callbacks suppressed [ 249.949292][ T7900] netlink: 14 bytes leftover after parsing attributes in process `syz.3.721'. [ 250.017812][ T7903] bridge_slave_0: left allmulticast mode [ 250.045556][ T7903] bridge_slave_0: left promiscuous mode [ 250.056677][ T7903] bridge0: port 1(bridge_slave_0) entered disabled state [ 250.422696][ T7907] netlink: 12 bytes leftover after parsing attributes in process `syz.1.719'. [ 250.443291][ T7917] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.726'. [ 250.750152][ T7923] netlink: 'syz.0.725': attribute type 10 has an invalid length. [ 250.765496][ T7923] netlink: 2 bytes leftover after parsing attributes in process `syz.0.725'. [ 250.782009][ T7923] hsr0: entered promiscuous mode [ 250.791371][ T7923] bridge0: port 2(hsr0) entered blocking state [ 250.804193][ T7923] bridge0: port 2(hsr0) entered disabled state [ 250.812726][ T7923] hsr0: entered allmulticast mode [ 250.822599][ T7923] hsr_slave_0: entered allmulticast mode [ 250.829936][ T7923] hsr_slave_1: entered allmulticast mode [ 250.856155][ T7923] bridge0: port 2(hsr0) entered blocking state [ 250.862575][ T7923] bridge0: port 2(hsr0) entered forwarding state [ 251.368897][ T7932] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 251.556010][ T7939] netlink: 14 bytes leftover after parsing attributes in process `syz.1.733'. [ 251.597998][ T7939] netlink: 14 bytes leftover after parsing attributes in process `syz.1.733'. [ 251.723748][ T7945] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.736'. [ 251.817369][ T7949] netlink: 12 bytes leftover after parsing attributes in process `syz.0.737'. [ 251.952788][ T7956] batadv0: entered promiscuous mode [ 252.078968][ T42] wlan1: Trigger new scan to find an IBSS to join [ 252.182381][ T7956] netlink: 199824 bytes leftover after parsing attributes in process `syz.3.740'. [ 252.320499][ T7960] netlink: 'syz.1.741': attribute type 10 has an invalid length. [ 252.328724][ T7960] netlink: 2 bytes leftover after parsing attributes in process `syz.1.741'. [ 252.342713][ T7960] hsr0: entered promiscuous mode [ 252.786954][ T7964] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 252.825820][ T7967] FAULT_INJECTION: forcing a failure. [ 252.825820][ T7967] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 252.839013][ T7967] CPU: 1 PID: 7967 Comm: syz.1.744 Not tainted syzkaller #0 [ 252.846409][ T7967] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 252.856490][ T7967] Call Trace: [ 252.859793][ T7967] [ 252.862741][ T7967] dump_stack_lvl+0x18c/0x250 [ 252.867478][ T7967] ? show_regs_print_info+0x20/0x20 [ 252.872709][ T7967] ? load_image+0x420/0x420 [ 252.877275][ T7967] ? __might_fault+0xaa/0x120 [ 252.881985][ T7967] ? __lock_acquire+0x7d80/0x7d80 [ 252.887045][ T7967] should_fail_ex+0x394/0x4c0 [ 252.891847][ T7967] _copy_to_user+0x2f/0xa0 [ 252.896370][ T7967] finalize_log+0xe4/0x160 [ 252.900816][ T7967] ? btf_parse_struct_metas+0xde0/0xde0 [ 252.906398][ T7967] ? btf_check_type_tags+0x674/0x680 [ 252.911721][ T7967] btf_new_fd+0x757/0x9e0 [ 252.916105][ T7967] ? bpf_btf_show_fdinfo+0x80/0x80 [ 252.921252][ T7967] ? capable+0x88/0xe0 [ 252.925360][ T7967] __sys_bpf+0x670/0x890 [ 252.929627][ T7967] ? bpf_link_show_fdinfo+0x390/0x390 [ 252.935015][ T7967] ? lock_chain_count+0x20/0x20 [ 252.939894][ T7967] __x64_sys_bpf+0x7c/0x90 [ 252.944361][ T7967] do_syscall_64+0x55/0xb0 [ 252.948787][ T7967] ? clear_bhb_loop+0x40/0x90 [ 252.953480][ T7967] ? clear_bhb_loop+0x40/0x90 [ 252.958158][ T7967] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 252.964061][ T7967] RIP: 0033:0x7fc67759de99 [ 252.968491][ T7967] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 252.988095][ T7967] RSP: 002b:00007fc678480028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 252.996505][ T7967] RAX: ffffffffffffffda RBX: 00007fc677825fa0 RCX: 00007fc67759de99 [ 253.004643][ T7967] RDX: 0000000000000028 RSI: 0000200000000140 RDI: 0000000000000012 [ 253.012610][ T7967] RBP: 00007fc678480090 R08: 0000000000000000 R09: 0000000000000000 [ 253.020580][ T7967] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 253.028544][ T7967] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 253.036550][ T7967] [ 253.201116][ T7974] FAULT_INJECTION: forcing a failure. [ 253.201116][ T7974] name failslab, interval 1, probability 0, space 0, times 0 [ 253.220248][ T7974] CPU: 1 PID: 7974 Comm: syz.2.747 Not tainted syzkaller #0 [ 253.227605][ T7974] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 253.237684][ T7974] Call Trace: [ 253.240976][ T7974] [ 253.243933][ T7974] dump_stack_lvl+0x18c/0x250 [ 253.248647][ T7974] ? show_regs_print_info+0x20/0x20 [ 253.253870][ T7974] ? load_image+0x420/0x420 [ 253.258391][ T7974] ? mark_lock+0x94/0x320 [ 253.262733][ T7974] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 253.268743][ T7974] should_fail_ex+0x394/0x4c0 [ 253.273448][ T7974] should_failslab+0x9/0x20 [ 253.278061][ T7974] slab_pre_alloc_hook+0x59/0x300 [ 253.283119][ T7974] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 253.289289][ T7974] kmem_cache_alloc+0x5a/0x2c0 [ 253.294058][ T7974] ? skb_clone+0x1eb/0x370 [ 253.298474][ T7974] skb_clone+0x1eb/0x370 [ 253.302722][ T7974] __netlink_deliver_tap+0x411/0x7f0 [ 253.308029][ T7974] ? netlink_deliver_tap+0x2e/0x1b0 [ 253.313269][ T7974] netlink_deliver_tap+0x19c/0x1b0 [ 253.318411][ T7974] __netlink_sendskb+0x4b/0x90 [ 253.323181][ T7974] netlink_dump+0xab3/0xec0 [ 253.327732][ T7974] ? netlink_lookup+0x200/0x200 [ 253.332636][ T7974] ? __asan_memset+0x22/0x40 [ 253.337250][ T7974] ? genl_start+0x491/0x6c0 [ 253.341764][ T7974] __netlink_dump_start+0x57c/0x7a0 [ 253.346977][ T7974] genl_family_rcv_msg_dumpit+0x214/0x310 [ 253.352711][ T7974] ? genl_rcv_msg+0x7a0/0x7a0 [ 253.357393][ T7974] ? genl_get_cmd+0x7f2/0x930 [ 253.362079][ T7974] ? genl_family_rcv_msg_doit+0x310/0x310 [ 253.367909][ T7974] ? genl_start+0x6c0/0x6c0 [ 253.372411][ T7974] ? genl_dumpit+0x1a0/0x1a0 [ 253.377028][ T7974] ? bpf_lsm_capable+0x9/0x10 [ 253.381708][ T7974] ? security_capable+0x89/0xb0 [ 253.386575][ T7974] genl_rcv_msg+0x5de/0x7a0 [ 253.391095][ T7974] ? genl_bind+0x360/0x360 [ 253.395516][ T7974] ? batadv_dat_free+0x380/0x380 [ 253.400454][ T7974] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 253.407044][ T7974] ? ref_tracker_free+0x686/0x830 [ 253.412082][ T7974] netlink_rcv_skb+0x235/0x4c0 [ 253.416854][ T7974] ? genl_bind+0x360/0x360 [ 253.421280][ T7974] ? netlink_ack+0x1160/0x1160 [ 253.426059][ T7974] ? __lock_acquire+0x7d80/0x7d80 [ 253.431098][ T7974] ? down_read+0x1ac/0x2e0 [ 253.435518][ T7974] genl_rcv+0x28/0x40 [ 253.439591][ T7974] netlink_unicast+0x7b1/0x930 [ 253.444370][ T7974] netlink_sendmsg+0x8d0/0xbf0 [ 253.449145][ T7974] ? netlink_getsockopt+0x590/0x590 [ 253.454348][ T7974] ? apparmor_socket_sendmsg+0x170/0x330 [ 253.460003][ T7974] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 253.465288][ T7974] ? security_socket_sendmsg+0x80/0xa0 [ 253.470748][ T7974] ? netlink_getsockopt+0x590/0x590 [ 253.475952][ T7974] ____sys_sendmsg+0x61b/0x980 [ 253.480733][ T7974] ? __asan_memset+0x22/0x40 [ 253.485323][ T7974] ? __sys_sendmsg_sock+0x30/0x30 [ 253.490437][ T7974] ? __import_iovec+0x5f2/0x850 [ 253.495300][ T7974] ? import_iovec+0x73/0xa0 [ 253.499809][ T7974] ___sys_sendmsg+0x2a6/0x360 [ 253.504503][ T7974] ? __sys_sendmsg+0x2b0/0x2b0 [ 253.509289][ T7974] ? ktime_get+0x7f/0x280 [ 253.513690][ T7974] __se_sys_sendmsg+0x1d0/0x2c0 [ 253.518550][ T7974] ? __x64_sys_sendmsg+0x80/0x80 [ 253.523507][ T7974] ? lockdep_hardirqs_on+0x98/0x150 [ 253.528712][ T7974] do_syscall_64+0x55/0xb0 [ 253.533136][ T7974] ? clear_bhb_loop+0x40/0x90 [ 253.537818][ T7974] ? clear_bhb_loop+0x40/0x90 [ 253.542495][ T7974] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 253.548389][ T7974] RIP: 0033:0x7fa352b9de99 [ 253.552801][ T7974] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 253.572415][ T7974] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 253.580831][ T7974] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 253.588805][ T7974] RDX: 00000000200000c0 RSI: 0000200000000000 RDI: 0000000000000007 [ 253.596771][ T7974] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 253.604746][ T7974] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 253.612715][ T7974] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 253.620701][ T7974] [ 254.070110][ T41] wlan1: Trigger new scan to find an IBSS to join [ 254.072970][ T42] wlan1: Trigger new scan to find an IBSS to join [ 254.597360][ T7989] batadv0: entered promiscuous mode [ 254.727787][ T7994] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 254.840495][ T7998] netlink: 'syz.1.758': attribute type 10 has an invalid length. [ 254.871411][ T7998] batman_adv: batadv0: Adding interface: virt_wifi0 [ 254.892504][ T7998] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 254.997329][ T7998] batman_adv: batadv0: Interface activated: virt_wifi0 [ 255.126306][ T8005] __nla_validate_parse: 5 callbacks suppressed [ 255.126325][ T8005] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.760'. [ 255.349608][ T8012] netlink: 14 bytes leftover after parsing attributes in process `syz.3.763'. [ 255.393013][ T8012] netlink: 14 bytes leftover after parsing attributes in process `syz.3.763'. [ 255.465788][ T42] wlan1: Creating new IBSS network, BSSID 22:c2:52:68:5e:e3 [ 255.727542][ T8024] syzkaller0: entered promiscuous mode [ 255.734243][ T8024] syzkaller0: entered allmulticast mode [ 255.883955][ T8033] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.772'. [ 255.915686][ T8024] syzkaller0: tun_net_xmit 1280 [ 255.921881][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.928573][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.951140][ T8024] syzkaller0: create flow: hash 1902188520 index 1 [ 256.066654][ T42] wlan1: Trigger new scan to find an IBSS to join [ 256.996670][ T8022] syzkaller0: delete flow: hash 1902188520 index 1 [ 258.069175][ T12] wlan1: Trigger new scan to find an IBSS to join [ 258.661271][ T8049] netlink: 14 bytes leftover after parsing attributes in process `syz.3.779'. [ 258.670656][ T8053] netlink: 14 bytes leftover after parsing attributes in process `syz.3.779'. [ 258.685213][ T8059] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.782'. [ 258.701330][ T8060] netlink: 'syz.0.783': attribute type 10 has an invalid length. [ 258.917668][ T8060] team0: Port device wlan1 added [ 258.974928][ T8060] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 259.107727][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 259.151994][ T2932] wlan1: Creating new IBSS network, BSSID b6:e7:cd:6e:20:85 [ 259.303629][ T8082] FAULT_INJECTION: forcing a failure. [ 259.303629][ T8082] name failslab, interval 1, probability 0, space 0, times 0 [ 259.324666][ T8071] syzkaller0: entered promiscuous mode [ 259.332363][ T8082] CPU: 1 PID: 8082 Comm: syz.1.796 Not tainted syzkaller #0 [ 259.339708][ T8082] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 259.340623][ T8071] syzkaller0: entered allmulticast mode [ 259.349790][ T8082] Call Trace: [ 259.349842][ T8082] [ 259.349852][ T8082] dump_stack_lvl+0x18c/0x250 [ 259.349882][ T8082] ? sctp_sendmsg+0x1519/0x27b0 [ 259.349902][ T8082] ? ___sys_sendmsg+0x2a6/0x360 [ 259.349929][ T8082] ? show_regs_print_info+0x20/0x20 [ 259.349955][ T8082] ? load_image+0x420/0x420 [ 259.350001][ T8082] should_fail_ex+0x394/0x4c0 [ 259.390576][ T8082] should_failslab+0x9/0x20 [ 259.395104][ T8082] slab_pre_alloc_hook+0x59/0x300 [ 259.400149][ T8082] ? sctp_add_bind_addr+0x8c/0x360 [ 259.405268][ T8082] __kmem_cache_alloc_node+0x53/0x250 [ 259.410662][ T8082] ? sctp_add_bind_addr+0x8c/0x360 [ 259.415788][ T8082] kmalloc_trace+0x2a/0xe0 [ 259.420220][ T8082] sctp_add_bind_addr+0x8c/0x360 [ 259.425188][ T8082] sctp_copy_local_addr_list+0x31b/0x4e0 [ 259.430838][ T8082] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 259.436568][ T8082] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 259.442654][ T8082] ? sctp_v6_is_any+0x64/0x70 [ 259.447354][ T8082] ? sctp_copy_one_addr+0x8c/0x350 [ 259.452485][ T8082] sctp_bind_addr_copy+0xb3/0x3c0 [ 259.457527][ T8082] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 259.463990][ T8082] sctp_connect_new_asoc+0x2f9/0x6a0 [ 259.469347][ T8082] ? __sctp_connect+0xd80/0xd80 [ 259.474226][ T8082] ? __local_bh_enable_ip+0x13a/0x1c0 [ 259.479618][ T8082] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 259.485172][ T8082] ? security_sctp_bind_connect+0x89/0xb0 [ 259.490945][ T8082] sctp_sendmsg+0x1519/0x27b0 [ 259.495670][ T8082] ? sctp_getsockopt+0xb60/0xb60 [ 259.500628][ T8082] ? aa_af_perm+0x330/0x330 [ 259.505145][ T8082] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 259.511581][ T8082] ? sock_rps_record_flow+0x19/0x3f0 [ 259.516903][ T8082] ? inet_sendmsg+0xce/0x2a0 [ 259.521506][ T8082] ? inet_send_prepare+0x250/0x250 [ 259.526632][ T8082] ____sys_sendmsg+0x61b/0x980 [ 259.531432][ T8082] ? __sys_sendmsg_sock+0x30/0x30 [ 259.536488][ T8082] ? __import_iovec+0x5f2/0x850 [ 259.541373][ T8082] ? import_iovec+0x73/0xa0 [ 259.545959][ T8082] ___sys_sendmsg+0x2a6/0x360 [ 259.550667][ T8082] ? __sys_sendmsg+0x2b0/0x2b0 [ 259.555477][ T8082] ? __lock_acquire+0x7d80/0x7d80 [ 259.560547][ T8082] __se_sys_sendmsg+0x1d0/0x2c0 [ 259.565413][ T8082] ? __x64_sys_sendmsg+0x80/0x80 [ 259.570387][ T8082] ? lockdep_hardirqs_on+0x98/0x150 [ 259.575600][ T8082] do_syscall_64+0x55/0xb0 [ 259.580032][ T8082] ? clear_bhb_loop+0x40/0x90 [ 259.584716][ T8082] ? clear_bhb_loop+0x40/0x90 [ 259.589434][ T8082] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 259.595341][ T8082] RIP: 0033:0x7fc67759de99 [ 259.599777][ T8082] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 259.619761][ T8082] RSP: 002b:00007fc678480028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 259.628192][ T8082] RAX: ffffffffffffffda RBX: 00007fc677825fa0 RCX: 00007fc67759de99 [ 259.636187][ T8082] RDX: 00000000000480c4 RSI: 00002000000017c0 RDI: 0000000000000004 [ 259.644198][ T8082] RBP: 00007fc678480090 R08: 0000000000000000 R09: 0000000000000000 [ 259.652183][ T8082] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 259.660163][ T8082] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 259.668171][ T8082] [ 259.729745][ T8085] netlink: 668 bytes leftover after parsing attributes in process `syz.0.788'. [ 259.748740][ T8085] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 259.769970][ T8085] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 260.360898][ T3448] wlan1: Creating new IBSS network, BSSID 5e:43:f8:48:b4:3a [ 261.374832][ T8080] netlink: 'syz.3.787': attribute type 10 has an invalid length. [ 261.382899][ T8080] netlink: 40 bytes leftover after parsing attributes in process `syz.3.787'. [ 261.393774][ T8080] batman_adv: batadv0: Adding interface: virt_wifi0 [ 261.400539][ T8080] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 261.428505][ T8080] batman_adv: batadv0: Interface activated: virt_wifi0 [ 261.649392][ T8097] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.792'. [ 261.708653][ T8100] netlink: 14 bytes leftover after parsing attributes in process `syz.3.793'. [ 261.772616][ T8104] netlink: 148 bytes leftover after parsing attributes in process `syz.0.797'. [ 261.806652][ T8100] netlink: 14 bytes leftover after parsing attributes in process `syz.3.793'. [ 261.974303][ T5782] Bluetooth: hci1: ISO packet for unknown connection handle 5 [ 262.049287][ T8114] netlink: 'syz.2.801': attribute type 10 has an invalid length. [ 262.057905][ T8114] netlink: 40 bytes leftover after parsing attributes in process `syz.2.801'. [ 262.099369][ T8114] batman_adv: batadv0: Adding interface: virt_wifi0 [ 262.115733][ T8114] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 262.207557][ T8114] batman_adv: batadv0: Interface activated: virt_wifi0 [ 262.513988][ T8133] netlink: 61775 bytes leftover after parsing attributes in process `syz.2.807'. [ 262.710169][ T8139] netlink: 14 bytes leftover after parsing attributes in process `syz.2.810'. [ 262.733614][ T8139] netlink: 14 bytes leftover after parsing attributes in process `syz.2.810'. [ 264.322004][ T8143] FAULT_INJECTION: forcing a failure. [ 264.322004][ T8143] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 264.336853][ T8143] CPU: 0 PID: 8143 Comm: syz.1.812 Not tainted syzkaller #0 [ 264.344206][ T8143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 264.354262][ T8143] Call Trace: [ 264.357569][ T8143] [ 264.360498][ T8143] dump_stack_lvl+0x18c/0x250 [ 264.365180][ T8143] ? show_regs_print_info+0x20/0x20 [ 264.370378][ T8143] ? load_image+0x420/0x420 [ 264.374888][ T8143] ? __might_fault+0xaa/0x120 [ 264.379567][ T8143] ? __lock_acquire+0x7d80/0x7d80 [ 264.384595][ T8143] should_fail_ex+0x394/0x4c0 [ 264.389279][ T8143] _copy_from_user+0x2f/0xe0 [ 264.393876][ T8143] sk_setsockopt+0x2b9/0x2b20 [ 264.398565][ T8143] ? sockopt_capable+0x60/0x60 [ 264.403355][ T8143] ? aa_sk_perm+0x83c/0x970 [ 264.407854][ T8143] ? __fget_files+0x28/0x460 [ 264.412454][ T8143] ? aa_af_perm+0x330/0x330 [ 264.416953][ T8143] ? __fget_files+0x28/0x460 [ 264.421551][ T8143] ? aa_sock_opt_perm+0x74/0x100 [ 264.427037][ T8143] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 264.432581][ T8143] ? security_socket_setsockopt+0x7e/0xa0 [ 264.438396][ T8143] do_sock_setsockopt+0x11b/0x1a0 [ 264.443434][ T8143] __x64_sys_setsockopt+0x182/0x200 [ 264.448639][ T8143] do_syscall_64+0x55/0xb0 [ 264.453096][ T8143] ? clear_bhb_loop+0x40/0x90 [ 264.457858][ T8143] ? clear_bhb_loop+0x40/0x90 [ 264.462553][ T8143] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 264.468451][ T8143] RIP: 0033:0x7fc67759de99 [ 264.472867][ T8143] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 264.492515][ T8143] RSP: 002b:00007fc678480028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 264.500934][ T8143] RAX: ffffffffffffffda RBX: 00007fc677825fa0 RCX: 00007fc67759de99 [ 264.508933][ T8143] RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000003 [ 264.516909][ T8143] RBP: 00007fc678480090 R08: 0000000000000004 R09: 0000000000000000 [ 264.524875][ T8143] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 264.532866][ T8143] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 264.540855][ T8143] [ 264.945539][ T8145] syzkaller0: entered promiscuous mode [ 264.977176][ T8145] syzkaller0: entered allmulticast mode [ 268.772627][ T8162] netlink: 61775 bytes leftover after parsing attributes in process `syz.3.818'. [ 268.802697][ T8172] tap0: tun_chr_ioctl cmd 2148553947 [ 269.102124][ T8180] netlink: 144 bytes leftover after parsing attributes in process `syz.2.826'. [ 269.152938][ T8183] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.827'. [ 269.241927][ T8180] team0: Port device team_slave_0 removed [ 269.252868][ T8180] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 269.282329][ T8183] netlink: 'syz.3.827': attribute type 1 has an invalid length. [ 269.301729][ T8183] netlink: 'syz.3.827': attribute type 4 has an invalid length. [ 269.312000][ T8183] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.827'. [ 269.325936][ T8190] netlink: 'syz.3.827': attribute type 1 has an invalid length. [ 269.334314][ T8190] netlink: 'syz.3.827': attribute type 4 has an invalid length. [ 269.371946][ T8190] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.827'. [ 269.487310][ T8180] syz.2.826 (8180) used greatest stack depth: 19496 bytes left [ 271.575924][ T8208] FAULT_INJECTION: forcing a failure. [ 271.575924][ T8208] name failslab, interval 1, probability 0, space 0, times 0 [ 271.593780][ T8208] CPU: 0 PID: 8208 Comm: syz.2.833 Not tainted syzkaller #0 [ 271.601133][ T8208] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 271.611220][ T8208] Call Trace: [ 271.614518][ T8208] [ 271.617473][ T8208] dump_stack_lvl+0x18c/0x250 [ 271.622204][ T8208] ? sctp_sendmsg+0x1519/0x27b0 [ 271.627095][ T8208] ? ___sys_sendmsg+0x2a6/0x360 [ 271.631992][ T8208] ? show_regs_print_info+0x20/0x20 [ 271.637234][ T8208] ? load_image+0x420/0x420 [ 271.641759][ T8208] should_fail_ex+0x394/0x4c0 [ 271.646428][ T8208] should_failslab+0x9/0x20 [ 271.650970][ T8208] slab_pre_alloc_hook+0x59/0x300 [ 271.656032][ T8208] ? sctp_add_bind_addr+0x8c/0x360 [ 271.661178][ T8208] __kmem_cache_alloc_node+0x53/0x250 [ 271.666589][ T8208] ? sctp_add_bind_addr+0x8c/0x360 [ 271.671735][ T8208] kmalloc_trace+0x2a/0xe0 [ 271.676187][ T8208] sctp_add_bind_addr+0x8c/0x360 [ 271.681155][ T8208] sctp_copy_local_addr_list+0x31b/0x4e0 [ 271.686797][ T8208] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 271.692541][ T8208] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 271.698614][ T8208] ? sctp_v4_is_any+0x35/0x60 [ 271.703322][ T8208] ? sctp_copy_one_addr+0x8c/0x350 [ 271.708468][ T8208] sctp_bind_addr_copy+0xb3/0x3c0 [ 271.713578][ T8208] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 271.719907][ T8208] sctp_connect_new_asoc+0x2f9/0x6a0 [ 271.725198][ T8208] ? __sctp_connect+0xd80/0xd80 [ 271.730045][ T8208] ? __local_bh_enable_ip+0x13a/0x1c0 [ 271.735417][ T8208] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 271.740976][ T8208] ? security_sctp_bind_connect+0x89/0xb0 [ 271.746697][ T8208] sctp_sendmsg+0x1519/0x27b0 [ 271.751389][ T8208] ? sctp_getsockopt+0xb60/0xb60 [ 271.756331][ T8208] ? aa_af_perm+0x330/0x330 [ 271.760839][ T8208] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 271.767262][ T8208] ? sock_rps_record_flow+0x19/0x3f0 [ 271.772552][ T8208] ? inet_sendmsg+0xce/0x2a0 [ 271.777157][ T8208] ? inet_send_prepare+0x250/0x250 [ 271.782268][ T8208] ____sys_sendmsg+0x61b/0x980 [ 271.787042][ T8208] ? __asan_memset+0x22/0x40 [ 271.791632][ T8208] ? __sys_sendmsg_sock+0x30/0x30 [ 271.796707][ T8208] ? __import_iovec+0x5f2/0x850 [ 271.801573][ T8208] ? import_iovec+0x73/0xa0 [ 271.806077][ T8208] ___sys_sendmsg+0x2a6/0x360 [ 271.810846][ T8208] ? get_pid_task+0x20/0x1e0 [ 271.815437][ T8208] ? __sys_sendmsg+0x2b0/0x2b0 [ 271.820215][ T8208] ? __lock_acquire+0x7d80/0x7d80 [ 271.825257][ T8208] __se_sys_sendmsg+0x1d0/0x2c0 [ 271.830132][ T8208] ? __x64_sys_sendmsg+0x80/0x80 [ 271.835373][ T8208] ? lockdep_hardirqs_on+0x98/0x150 [ 271.840718][ T8208] do_syscall_64+0x55/0xb0 [ 271.845139][ T8208] ? clear_bhb_loop+0x40/0x90 [ 271.849825][ T8208] ? clear_bhb_loop+0x40/0x90 [ 271.854497][ T8208] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 271.860394][ T8208] RIP: 0033:0x7fa352b9de99 [ 271.864806][ T8208] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 271.884418][ T8208] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 271.892844][ T8208] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 271.900817][ T8208] RDX: 0000000000008804 RSI: 0000200000000380 RDI: 0000000000000003 [ 271.908789][ T8208] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 271.916868][ T8208] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 271.924834][ T8208] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 271.932898][ T8208] [ 272.213184][ T8221] syzkaller0: entered promiscuous mode [ 272.241550][ T8221] syzkaller0: entered allmulticast mode [ 272.276066][ T8221] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 65487 [ 272.947980][ T8241] netlink: 64 bytes leftover after parsing attributes in process `syz.3.846'. [ 275.249835][ T8270] netlink: 134744 bytes leftover after parsing attributes in process `syz.0.853'. [ 275.623881][ T8287] netlink: 'syz.2.859': attribute type 9 has an invalid length. [ 275.656607][ T8287] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.859'. [ 276.182701][ T8299] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.862'. [ 276.322262][ T8299] netlink: 'syz.2.862': attribute type 1 has an invalid length. [ 276.403757][ T8299] netlink: 'syz.2.862': attribute type 4 has an invalid length. [ 276.427913][ T8299] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.862'. [ 276.529201][ T8302] netlink: 'syz.2.862': attribute type 1 has an invalid length. [ 276.573192][ T8302] netlink: 'syz.2.862': attribute type 4 has an invalid length. [ 276.644689][ T8302] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.862'. [ 278.324840][ T8326] netlink: 'syz.2.871': attribute type 3 has an invalid length. [ 278.371336][ T8326] netlink: 'syz.2.871': attribute type 1 has an invalid length. [ 278.417312][ T8326] netlink: 'syz.2.871': attribute type 6 has an invalid length. [ 278.465818][ T8326] netlink: 144448 bytes leftover after parsing attributes in process `syz.2.871'. [ 278.574306][ T8333] netlink: 2 bytes leftover after parsing attributes in process `syz.0.875'. [ 278.639100][ T8333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 278.734294][ T8333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 278.816815][ T8333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 278.991056][ T8333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.109911][ T8333] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 279.307214][ T8333] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 279.397683][ T8333] batadv_slave_1: entered promiscuous mode [ 281.719212][ T8355] netlink: 'syz.2.878': attribute type 9 has an invalid length. [ 281.776740][ T8355] netlink: 'syz.2.878': attribute type 23 has an invalid length. [ 281.820326][ T8355] netlink: 156008 bytes leftover after parsing attributes in process `syz.2.878'. [ 281.976899][ T8353] netlink: 64 bytes leftover after parsing attributes in process `syz.1.881'. [ 282.656707][ T8369] FAULT_INJECTION: forcing a failure. [ 282.656707][ T8369] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 282.754223][ T8369] CPU: 1 PID: 8369 Comm: syz.1.886 Not tainted syzkaller #0 [ 282.761591][ T8369] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 282.771675][ T8369] Call Trace: [ 282.774977][ T8369] [ 282.777932][ T8369] dump_stack_lvl+0x18c/0x250 [ 282.782637][ T8369] ? show_regs_print_info+0x20/0x20 [ 282.787877][ T8369] ? load_image+0x420/0x420 [ 282.792415][ T8369] ? __lock_acquire+0x7d80/0x7d80 [ 282.797443][ T8369] ? snprintf+0xe9/0x140 [ 282.801688][ T8369] should_fail_ex+0x394/0x4c0 [ 282.806369][ T8369] _copy_to_user+0x2f/0xa0 [ 282.810784][ T8369] simple_read_from_buffer+0xe7/0x150 [ 282.816170][ T8369] proc_fail_nth_read+0x1e8/0x260 [ 282.821202][ T8369] ? proc_fault_inject_write+0x360/0x360 [ 282.826840][ T8369] ? fsnotify_perm+0x271/0x5e0 [ 282.831608][ T8369] ? proc_fault_inject_write+0x360/0x360 [ 282.837242][ T8369] vfs_read+0x298/0x990 [ 282.841407][ T8369] ? kernel_read+0x1e0/0x1e0 [ 282.846002][ T8369] ? __fget_files+0x28/0x460 [ 282.850597][ T8369] ? __fget_files+0x3fc/0x460 [ 282.855284][ T8369] ? __fdget_pos+0x2a3/0x330 [ 282.859882][ T8369] ? ksys_read+0x74/0x260 [ 282.864228][ T8369] ksys_read+0x151/0x260 [ 282.868476][ T8369] ? vfs_write+0x9a0/0x9a0 [ 282.872903][ T8369] do_syscall_64+0x55/0xb0 [ 282.877319][ T8369] ? clear_bhb_loop+0x40/0x90 [ 282.881995][ T8369] ? clear_bhb_loop+0x40/0x90 [ 282.886674][ T8369] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 282.893010][ T8369] RIP: 0033:0x7fc67755e6ce [ 282.897428][ T8369] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 282.917041][ T8369] RSP: 002b:00007fc67847ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 282.925460][ T8369] RAX: ffffffffffffffda RBX: 00007fc6784806c0 RCX: 00007fc67755e6ce [ 282.933427][ T8369] RDX: 000000000000000f RSI: 00007fc6784800a0 RDI: 0000000000000005 [ 282.941398][ T8369] RBP: 00007fc678480090 R08: 0000000000000000 R09: 0000000000000000 [ 282.949471][ T8369] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 282.957455][ T8369] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 282.965530][ T8369] [ 283.894600][ T8394] netlink: 'syz.1.892': attribute type 1 has an invalid length. [ 283.915594][ T8394] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.892'. [ 284.002183][ T8394] netlink: 'syz.1.892': attribute type 10 has an invalid length. [ 285.477196][ T3448] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 285.663552][ T8394] team0: Device veth1_vlan failed to register rx_handler [ 286.033151][ T8399] netlink: 'syz.3.893': attribute type 4 has an invalid length. [ 286.115090][ T8399] netlink: 152 bytes leftover after parsing attributes in process `syz.3.893'. [ 286.166145][ T8399] .`: renamed from bond0 (while UP) [ 286.311499][ T8402] FAULT_INJECTION: forcing a failure. [ 286.311499][ T8402] name failslab, interval 1, probability 0, space 0, times 0 [ 286.337018][ T8402] CPU: 1 PID: 8402 Comm: syz.1.894 Not tainted syzkaller #0 [ 286.344370][ T8402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 286.354458][ T8402] Call Trace: [ 286.357760][ T8402] [ 286.360707][ T8402] dump_stack_lvl+0x18c/0x250 [ 286.365416][ T8402] ? show_regs_print_info+0x20/0x20 [ 286.370664][ T8402] ? load_image+0x420/0x420 [ 286.375203][ T8402] ? __might_sleep+0xe0/0xe0 [ 286.379824][ T8402] ? __lock_acquire+0x7d80/0x7d80 [ 286.384894][ T8402] should_fail_ex+0x394/0x4c0 [ 286.389612][ T8402] should_failslab+0x9/0x20 [ 286.394148][ T8402] slab_pre_alloc_hook+0x59/0x300 [ 286.399219][ T8402] kmem_cache_alloc_node+0x5e/0x310 [ 286.404448][ T8402] ? __alloc_skb+0x103/0x2c0 [ 286.409078][ T8402] __alloc_skb+0x103/0x2c0 [ 286.413542][ T8402] alloc_skb_with_frags+0xcd/0x7a0 [ 286.418690][ T8402] ? perf_trace_lock+0xfc/0x3b0 [ 286.423587][ T8402] ? trace_event_raw_event_lock+0x240/0x240 [ 286.429514][ T8402] ? aa_label_sk_perm+0x4d4/0x660 [ 286.434586][ T8402] sock_alloc_send_pskb+0x883/0x9a0 [ 286.439864][ T8402] ? sock_kzfree_s+0x50/0x50 [ 286.444458][ T8402] ? do_raw_spin_lock+0x11f/0x2b0 [ 286.449487][ T8402] ? __rwlock_init+0x150/0x150 [ 286.454255][ T8402] ? do_raw_spin_unlock+0x121/0x230 [ 286.459459][ T8402] unix_dgram_sendmsg+0x5a9/0x16e0 [ 286.464579][ T8402] ? aa_af_perm+0x330/0x330 [ 286.469080][ T8402] ? perf_trace_lock+0xfc/0x3b0 [ 286.473936][ T8402] ? unix_dgram_poll+0x680/0x680 [ 286.478875][ T8402] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 286.485295][ T8402] ? apparmor_socket_sendmsg+0x8e/0x330 [ 286.490839][ T8402] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 286.496147][ T8402] ? security_socket_sendmsg+0x80/0xa0 [ 286.501608][ T8402] ? unix_dgram_poll+0x680/0x680 [ 286.506555][ T8402] ____sys_sendmsg+0x61b/0x980 [ 286.511340][ T8402] ? __asan_memset+0x22/0x40 [ 286.515933][ T8402] ? __sys_sendmsg_sock+0x30/0x30 [ 286.520958][ T8402] ? __import_iovec+0x5f2/0x850 [ 286.525812][ T8402] ? import_iovec+0x73/0xa0 [ 286.530317][ T8402] ___sys_sendmsg+0x2a6/0x360 [ 286.535039][ T8402] ? __sys_sendmsg+0x2b0/0x2b0 [ 286.539847][ T8402] ? __lock_acquire+0x7d80/0x7d80 [ 286.545001][ T8402] __se_sys_sendmsg+0x1d0/0x2c0 [ 286.549867][ T8402] ? __x64_sys_sendmsg+0x80/0x80 [ 286.554818][ T8402] ? lockdep_hardirqs_on+0x98/0x150 [ 286.560020][ T8402] do_syscall_64+0x55/0xb0 [ 286.564436][ T8402] ? clear_bhb_loop+0x40/0x90 [ 286.569108][ T8402] ? clear_bhb_loop+0x40/0x90 [ 286.573778][ T8402] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 286.579678][ T8402] RIP: 0033:0x7fc67759de99 [ 286.584088][ T8402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.603698][ T8402] RSP: 002b:00007fc678480028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 286.612115][ T8402] RAX: ffffffffffffffda RBX: 00007fc677825fa0 RCX: 00007fc67759de99 [ 286.620085][ T8402] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000004 [ 286.628054][ T8402] RBP: 00007fc678480090 R08: 0000000000000000 R09: 0000000000000000 [ 286.636064][ T8402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 286.644031][ T8402] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 286.652016][ T8402] [ 288.343973][ T8440] netlink: 763 bytes leftover after parsing attributes in process `syz.0.914'. [ 288.767326][ T8448] netlink: 'syz.3.909': attribute type 10 has an invalid length. [ 289.163132][ T42] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 289.250602][ T8462] netlink: 'syz.1.915': attribute type 29 has an invalid length. [ 289.284735][ T8462] netlink: 'syz.1.915': attribute type 29 has an invalid length. [ 289.433703][ T8462] netlink: 'syz.1.915': attribute type 29 has an invalid length. [ 289.475250][ T8467] netlink: 'syz.1.915': attribute type 29 has an invalid length. [ 289.511098][ T8469] netlink: 'syz.1.915': attribute type 29 has an invalid length. [ 290.197953][ T8486] netlink: 'syz.1.927': attribute type 21 has an invalid length. [ 290.205758][ T8486] netlink: 'syz.1.927': attribute type 1 has an invalid length. [ 290.214877][ T8486] netlink: 15998 bytes leftover after parsing attributes in process `syz.1.927'. [ 290.217043][ T8484] FAULT_INJECTION: forcing a failure. [ 290.217043][ T8484] name failslab, interval 1, probability 0, space 0, times 0 [ 290.276904][ T8484] CPU: 0 PID: 8484 Comm: syz.3.926 Not tainted syzkaller #0 [ 290.284276][ T8484] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 290.294379][ T8484] Call Trace: [ 290.297708][ T8484] [ 290.300679][ T8484] dump_stack_lvl+0x18c/0x250 [ 290.305425][ T8484] ? show_regs_print_info+0x20/0x20 [ 290.310725][ T8484] ? load_image+0x420/0x420 [ 290.315331][ T8484] ? __might_sleep+0xe0/0xe0 [ 290.319992][ T8484] ? __lock_acquire+0x7d80/0x7d80 [ 290.325106][ T8484] should_fail_ex+0x394/0x4c0 [ 290.329870][ T8484] should_failslab+0x9/0x20 [ 290.334419][ T8484] slab_pre_alloc_hook+0x59/0x300 [ 290.339495][ T8484] ? trace_call_bpf+0x5e9/0x6c0 [ 290.344404][ T8484] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 290.350176][ T8484] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 290.355945][ T8484] __kmem_cache_alloc_node+0x53/0x250 [ 290.361391][ T8484] ? tomoyo_realpath_from_path+0xe6/0x5c0 [ 290.367170][ T8484] __kmalloc+0xa7/0x240 [ 290.371398][ T8484] tomoyo_realpath_from_path+0xe6/0x5c0 [ 290.377013][ T8484] ? tomoyo_domain+0xd6/0x120 [ 290.381869][ T8484] tomoyo_path_number_perm+0x248/0x5e0 [ 290.387470][ T8484] ? tomoyo_path_number_perm+0x217/0x5e0 [ 290.393348][ T8484] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 290.398879][ T8484] ? ksys_write+0x1d2/0x260 [ 290.403553][ T8484] ? __fget_files+0x28/0x460 [ 290.408247][ T8484] security_file_ioctl+0x70/0xa0 [ 290.413291][ T8484] __se_sys_ioctl+0x48/0x170 [ 290.417956][ T8484] do_syscall_64+0x55/0xb0 [ 290.422421][ T8484] ? clear_bhb_loop+0x40/0x90 [ 290.427141][ T8484] ? clear_bhb_loop+0x40/0x90 [ 290.431877][ T8484] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 290.437819][ T8484] RIP: 0033:0x7f83c859de99 [ 290.442287][ T8484] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 290.462031][ T8484] RSP: 002b:00007f83c939b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 290.470500][ T8484] RAX: ffffffffffffffda RBX: 00007f83c8825fa0 RCX: 00007f83c859de99 [ 290.478520][ T8484] RDX: 0000200000000000 RSI: 0000000000008b05 RDI: 0000000000000005 [ 290.486538][ T8484] RBP: 00007f83c939b090 R08: 0000000000000000 R09: 0000000000000000 [ 290.494561][ T8484] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 290.502581][ T8484] R13: 00007f83c8826038 R14: 00007f83c8825fa0 R15: 00007ffcf16656b8 [ 290.510687][ T8484] [ 290.518412][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 290.576736][ T8484] ERROR: Out of memory at tomoyo_realpath_from_path. [ 290.603129][ T8488] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.928'. [ 290.612892][ T8488] openvswitch: netlink: Tunnel attr 11913 out of range max 16 [ 290.925050][ T8492] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 290.989039][ T8495] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 291.973310][ T8527] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 292.128013][ T8531] FAULT_INJECTION: forcing a failure. [ 292.128013][ T8531] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 292.149564][ T8531] CPU: 0 PID: 8531 Comm: syz.0.946 Not tainted syzkaller #0 [ 292.156908][ T8531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 292.166987][ T8531] Call Trace: [ 292.170287][ T8531] [ 292.173234][ T8531] dump_stack_lvl+0x18c/0x250 [ 292.177946][ T8531] ? show_regs_print_info+0x20/0x20 [ 292.183187][ T8531] ? load_image+0x420/0x420 [ 292.187730][ T8531] ? __might_fault+0xaa/0x120 [ 292.192440][ T8531] ? __lock_acquire+0x7d80/0x7d80 [ 292.197502][ T8531] should_fail_ex+0x394/0x4c0 [ 292.202227][ T8531] _copy_from_user+0x2f/0xe0 [ 292.206842][ T8531] ___sys_sendmsg+0x1c7/0x360 [ 292.211586][ T8531] ? __sys_sendmsg+0x2b0/0x2b0 [ 292.216389][ T8531] ? lockdep_hardirqs_on+0x98/0x150 [ 292.221629][ T8531] __se_sys_sendmsg+0x1d0/0x2c0 [ 292.226525][ T8531] ? __x64_sys_sendmsg+0x80/0x80 [ 292.231495][ T8531] ? lockdep_hardirqs_on+0x98/0x150 [ 292.236714][ T8531] do_syscall_64+0x55/0xb0 [ 292.241147][ T8531] ? clear_bhb_loop+0x40/0x90 [ 292.245830][ T8531] ? clear_bhb_loop+0x40/0x90 [ 292.250515][ T8531] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 292.256436][ T8531] RIP: 0033:0x7f1927b9de99 [ 292.260857][ T8531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.280470][ T8531] RSP: 002b:00007f1928a38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 292.288898][ T8531] RAX: ffffffffffffffda RBX: 00007f1927e25fa0 RCX: 00007f1927b9de99 [ 292.296878][ T8531] RDX: 00000000000080d1 RSI: 0000200000000140 RDI: 0000000000000007 [ 292.304854][ T8531] RBP: 00007f1928a38090 R08: 0000000000000000 R09: 0000000000000000 [ 292.312831][ T8531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.320810][ T8531] R13: 00007f1927e26038 R14: 00007f1927e25fa0 R15: 00007ffc5be74838 [ 292.328811][ T8531] [ 292.504004][ T8541] netlink: 'syz.0.950': attribute type 3 has an invalid length. [ 292.514236][ T8541] netlink: 199820 bytes leftover after parsing attributes in process `syz.0.950'. [ 292.697591][ T8523] FAULT_INJECTION: forcing a failure. [ 292.697591][ T8523] name failslab, interval 1, probability 0, space 0, times 0 [ 292.724918][ T8523] CPU: 1 PID: 8523 Comm: syz.3.943 Not tainted syzkaller #0 [ 292.732271][ T8523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 292.742381][ T8523] Call Trace: [ 292.745686][ T8523] [ 292.748643][ T8523] dump_stack_lvl+0x18c/0x250 [ 292.753408][ T8523] ? show_regs_print_info+0x20/0x20 [ 292.758649][ T8523] ? load_image+0x420/0x420 [ 292.763189][ T8523] ? __lock_acquire+0x7d80/0x7d80 [ 292.768253][ T8523] should_fail_ex+0x394/0x4c0 [ 292.772972][ T8523] should_failslab+0x9/0x20 [ 292.777506][ T8523] slab_pre_alloc_hook+0x59/0x300 [ 292.782564][ T8523] kmem_cache_alloc_node+0x5e/0x310 [ 292.787801][ T8523] ? __alloc_skb+0x103/0x2c0 [ 292.792428][ T8523] __alloc_skb+0x103/0x2c0 [ 292.796880][ T8523] qrtr_port_remove+0x81/0x400 [ 292.801681][ T8523] qrtr_release+0x1f6/0x2b0 [ 292.806241][ T8523] sock_close+0xa7/0x210 [ 292.810512][ T8523] ? sock_mmap+0xa0/0xa0 [ 292.814789][ T8523] __fput+0x221/0x940 [ 292.818813][ T8523] task_work_run+0x1d4/0x260 [ 292.823434][ T8523] ? task_work_cancel+0x220/0x220 [ 292.828498][ T8523] get_signal+0x11da/0x1390 [ 292.833026][ T8523] ? kick_process+0xe4/0x150 [ 292.837647][ T8523] ? __ia32_sys_pidfd_getfd+0x90/0x90 [ 292.843055][ T8523] arch_do_signal_or_restart+0xc2/0x7b0 [ 292.848629][ T8523] ? get_sigframe_size+0x20/0x20 [ 292.853602][ T8523] ? exit_to_user_mode_loop+0x3b/0x110 [ 292.859083][ T8523] exit_to_user_mode_loop+0x70/0x110 [ 292.864395][ T8523] exit_to_user_mode_prepare+0xee/0x180 [ 292.869959][ T8523] syscall_exit_to_user_mode+0x1a/0x50 [ 292.875423][ T8523] do_syscall_64+0x61/0xb0 [ 292.879846][ T8523] ? clear_bhb_loop+0x40/0x90 [ 292.884518][ T8523] ? clear_bhb_loop+0x40/0x90 [ 292.889225][ T8523] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 292.895143][ T8523] RIP: 0033:0x7f83c859de99 [ 292.899576][ T8523] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 292.919199][ T8523] RSP: 002b:00007f83c939b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 292.927620][ T8523] RAX: fffffffffffffe00 RBX: 00007f83c8825fa0 RCX: 00007f83c859de99 [ 292.935614][ T8523] RDX: 0000000040002182 RSI: 0000200000000540 RDI: 0000000000000008 [ 292.943619][ T8523] RBP: 00007f83c939b090 R08: 0000000000000000 R09: 0000000000000000 [ 292.951601][ T8523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 292.959572][ T8523] R13: 00007f83c8826038 R14: 00007f83c8825fa0 R15: 00007ffcf16656b8 [ 292.967647][ T8523] [ 292.995572][ T8552] netlink: 'syz.2.953': attribute type 29 has an invalid length. [ 293.222479][ T8559] netlink: 40 bytes leftover after parsing attributes in process `syz.1.956'. [ 293.232161][ T8559] netlink: 3 bytes leftover after parsing attributes in process `syz.1.956'. [ 293.241930][ T8559] bridge_slave_0: entered allmulticast mode [ 293.252143][ T8559] netlink: 3 bytes leftover after parsing attributes in process `syz.1.956'. [ 293.328085][ T8558] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 293.494384][ T8566] FAULT_INJECTION: forcing a failure. [ 293.494384][ T8566] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 293.513737][ T8566] CPU: 0 PID: 8566 Comm: syz.2.958 Not tainted syzkaller #0 [ 293.521114][ T8566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 293.531193][ T8566] Call Trace: [ 293.534496][ T8566] [ 293.537447][ T8566] dump_stack_lvl+0x18c/0x250 [ 293.542162][ T8566] ? show_regs_print_info+0x20/0x20 [ 293.547391][ T8566] ? load_image+0x420/0x420 [ 293.551921][ T8566] ? __lock_acquire+0x7d80/0x7d80 [ 293.556969][ T8566] should_fail_ex+0x394/0x4c0 [ 293.561660][ T8566] _copy_from_user+0x2f/0xe0 [ 293.566270][ T8566] __copy_msghdr+0x388/0x560 [ 293.570932][ T8566] ___sys_sendmsg+0x214/0x360 [ 293.575610][ T8566] ? __sys_sendmsg+0x2b0/0x2b0 [ 293.580471][ T8566] ? trace_call_bpf+0xc3/0x6c0 [ 293.585462][ T8566] __se_sys_sendmsg+0x1d0/0x2c0 [ 293.590326][ T8566] ? __x64_sys_sendmsg+0x80/0x80 [ 293.595271][ T8566] ? lockdep_hardirqs_on+0x98/0x150 [ 293.600465][ T8566] do_syscall_64+0x55/0xb0 [ 293.604905][ T8566] ? clear_bhb_loop+0x40/0x90 [ 293.609593][ T8566] ? clear_bhb_loop+0x40/0x90 [ 293.614293][ T8566] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 293.620187][ T8566] RIP: 0033:0x7fa352b9de99 [ 293.624588][ T8566] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.644187][ T8566] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 293.652598][ T8566] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 293.660575][ T8566] RDX: 0000000000000041 RSI: 0000200000000600 RDI: 0000000000000003 [ 293.668556][ T8566] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 293.676628][ T8566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 293.684610][ T8566] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 293.692834][ T8566] [ 293.833968][ T8573] FAULT_INJECTION: forcing a failure. [ 293.833968][ T8573] name failslab, interval 1, probability 0, space 0, times 0 [ 293.882504][ T8578] validate_nla: 4 callbacks suppressed [ 293.882523][ T8578] netlink: 'syz.0.963': attribute type 10 has an invalid length. [ 293.883382][ T8573] CPU: 1 PID: 8573 Comm: syz.2.961 Not tainted syzkaller #0 [ 293.896674][ T8578] netlink: 169832 bytes leftover after parsing attributes in process `syz.0.963'. [ 293.903020][ T8573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 293.903037][ T8573] Call Trace: [ 293.903046][ T8573] [ 293.903054][ T8573] dump_stack_lvl+0x18c/0x250 [ 293.903088][ T8573] ? show_regs_print_info+0x20/0x20 [ 293.919409][ T8578] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 293.922322][ T8573] ? load_image+0x420/0x420 [ 293.922359][ T8573] ? __might_sleep+0xe0/0xe0 [ 293.956171][ T8573] ? __lock_acquire+0x7d80/0x7d80 [ 293.961243][ T8573] should_fail_ex+0x394/0x4c0 [ 293.965997][ T8573] should_failslab+0x9/0x20 [ 293.970537][ T8573] slab_pre_alloc_hook+0x59/0x300 [ 293.975598][ T8573] ? __get_vm_area_node+0x125/0x370 [ 293.980834][ T8573] __kmem_cache_alloc_node+0x53/0x250 [ 293.986247][ T8573] ? __get_vm_area_node+0x125/0x370 [ 293.991485][ T8573] kmalloc_node_trace+0x26/0xe0 [ 293.996376][ T8573] __get_vm_area_node+0x125/0x370 [ 294.001527][ T8573] __vmalloc_node_range+0x36f/0x1320 [ 294.006849][ T8573] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 294.012431][ T8573] ? mark_lock+0x94/0x320 [ 294.016777][ T8573] ? __lock_acquire+0x1336/0x7d80 [ 294.021815][ T8573] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 294.027711][ T8573] ? aa_get_newest_label+0xfd/0x5c0 [ 294.032908][ T8573] ? free_vm_area+0x50/0x50 [ 294.037455][ T8573] ? end_current_label_crit_section+0x170/0x170 [ 294.043691][ T8573] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 294.049668][ T8573] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 294.056865][ T8573] ? lock_chain_count+0x20/0x20 [ 294.061711][ T8573] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 294.067255][ T8573] __vmalloc+0x7a/0x90 [ 294.071323][ T8573] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 294.076871][ T8573] bpf_prog_alloc_no_stats+0x46/0x430 [ 294.082278][ T8573] bpf_prog_alloc+0x3d/0x1a0 [ 294.086872][ T8573] bpf_prog_load+0x6b2/0x1610 [ 294.091577][ T8573] ? map_freeze+0x420/0x420 [ 294.096082][ T8573] ? __might_fault+0xaa/0x120 [ 294.100754][ T8573] ? __lock_acquire+0x7d80/0x7d80 [ 294.105778][ T8573] ? seqcount_lockdep_reader_access+0x17b/0x1d0 [ 294.112022][ T8573] ? __might_fault+0xaa/0x120 [ 294.116699][ T8573] ? __might_fault+0xc6/0x120 [ 294.121380][ T8573] ? __might_fault+0xaa/0x120 [ 294.126051][ T8573] ? bpf_lsm_bpf+0x9/0x10 [ 294.130403][ T8573] ? security_bpf+0x7e/0xa0 [ 294.134930][ T8573] __sys_bpf+0x5ba/0x890 [ 294.139245][ T8573] ? bpf_link_show_fdinfo+0x390/0x390 [ 294.144637][ T8573] ? lock_chain_count+0x20/0x20 [ 294.149485][ T8573] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 294.155473][ T8573] __x64_sys_bpf+0x7c/0x90 [ 294.159891][ T8573] do_syscall_64+0x55/0xb0 [ 294.164310][ T8573] ? clear_bhb_loop+0x40/0x90 [ 294.168983][ T8573] ? clear_bhb_loop+0x40/0x90 [ 294.173655][ T8573] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 294.179580][ T8573] RIP: 0033:0x7fa352b9de99 [ 294.183989][ T8573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 294.203680][ T8573] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 294.212123][ T8573] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 294.220104][ T8573] RDX: 0000000000000070 RSI: 0000200000000440 RDI: 0000000000000005 [ 294.228078][ T8573] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 294.236047][ T8573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.244016][ T8573] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 294.252001][ T8573] [ 294.258030][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 294.269583][ T64] wlan1: Trigger new scan to find an IBSS to join [ 294.282400][ T8581] netlink: 'syz.0.964': attribute type 29 has an invalid length. [ 294.290855][ T8581] netlink: 'syz.0.964': attribute type 29 has an invalid length. [ 294.297635][ T8573] syz.2.961: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz2,mems_allowed=0-1 [ 294.326998][ T8581] netlink: 'syz.0.964': attribute type 29 has an invalid length. [ 294.329473][ T8573] CPU: 1 PID: 8573 Comm: syz.2.961 Not tainted syzkaller #0 [ 294.341869][ T8581] netlink: 'syz.0.964': attribute type 29 has an invalid length. [ 294.342025][ T8573] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 294.342039][ T8573] Call Trace: [ 294.361500][ T8581] netlink: 'syz.0.964': attribute type 29 has an invalid length. [ 294.363071][ T8573] [ 294.363082][ T8573] dump_stack_lvl+0x18c/0x250 [ 294.378475][ T8573] ? show_regs_print_info+0x20/0x20 [ 294.383756][ T8573] ? load_image+0x420/0x420 [ 294.388306][ T8573] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 294.394785][ T8573] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 294.401322][ T8573] warn_alloc+0x246/0x340 [ 294.405693][ T8573] ? __get_vm_area_node+0x125/0x370 [ 294.410929][ T8573] ? zone_watermark_ok_safe+0x230/0x230 [ 294.416510][ T8573] ? rcu_is_watching+0x15/0xb0 [ 294.421318][ T8573] ? __get_vm_area_node+0x356/0x370 [ 294.426562][ T8573] __vmalloc_node_range+0x394/0x1320 [ 294.431884][ T8573] ? mark_lock+0x94/0x320 [ 294.436256][ T8573] ? __lock_acquire+0x1336/0x7d80 [ 294.441324][ T8573] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 294.447172][ T8573] ? aa_get_newest_label+0xfd/0x5c0 [ 294.452398][ T8573] ? free_vm_area+0x50/0x50 [ 294.456930][ T8573] ? end_current_label_crit_section+0x170/0x170 [ 294.463195][ T8573] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 294.469205][ T8573] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 294.476436][ T8573] ? lock_chain_count+0x20/0x20 [ 294.481322][ T8573] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 294.486904][ T8573] __vmalloc+0x7a/0x90 [ 294.490996][ T8573] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 294.496563][ T8573] bpf_prog_alloc_no_stats+0x46/0x430 [ 294.501956][ T8573] bpf_prog_alloc+0x3d/0x1a0 [ 294.506557][ T8573] bpf_prog_load+0x6b2/0x1610 [ 294.511248][ T8573] ? map_freeze+0x420/0x420 [ 294.515762][ T8573] ? __might_fault+0xaa/0x120 [ 294.520435][ T8573] ? __lock_acquire+0x7d80/0x7d80 [ 294.525462][ T8573] ? seqcount_lockdep_reader_access+0x17b/0x1d0 [ 294.531703][ T8573] ? __might_fault+0xaa/0x120 [ 294.536383][ T8573] ? __might_fault+0xc6/0x120 [ 294.541056][ T8573] ? __might_fault+0xaa/0x120 [ 294.545756][ T8573] ? bpf_lsm_bpf+0x9/0x10 [ 294.550086][ T8573] ? security_bpf+0x7e/0xa0 [ 294.554588][ T8573] __sys_bpf+0x5ba/0x890 [ 294.558845][ T8573] ? bpf_link_show_fdinfo+0x390/0x390 [ 294.564232][ T8573] ? lock_chain_count+0x20/0x20 [ 294.569090][ T8573] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 294.575075][ T8573] __x64_sys_bpf+0x7c/0x90 [ 294.579510][ T8573] do_syscall_64+0x55/0xb0 [ 294.583934][ T8573] ? clear_bhb_loop+0x40/0x90 [ 294.588616][ T8573] ? clear_bhb_loop+0x40/0x90 [ 294.593301][ T8573] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 294.599197][ T8573] RIP: 0033:0x7fa352b9de99 [ 294.603612][ T8573] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 294.623224][ T8573] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 294.631658][ T8573] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 294.639635][ T8573] RDX: 0000000000000070 RSI: 0000200000000440 RDI: 0000000000000005 [ 294.647609][ T8573] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 294.655588][ T8573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 294.663581][ T8573] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 294.671571][ T8573] [ 294.717529][ T8573] Mem-Info: [ 294.720915][ T8573] active_anon:5793 inactive_anon:0 isolated_anon:0 [ 294.720915][ T8573] active_file:18549 inactive_file:40035 isolated_file:0 [ 294.720915][ T8573] unevictable:768 dirty:453 writeback:0 [ 294.720915][ T8573] slab_reclaimable:10401 slab_unreclaimable:91890 [ 294.720915][ T8573] mapped:24518 shmem:1361 pagetables:596 [ 294.720915][ T8573] sec_pagetables:0 bounce:0 [ 294.720915][ T8573] kernel_misc_reclaimable:0 [ 294.720915][ T8573] free:1347361 free_pcp:9093 free_cma:0 [ 294.780303][ T8573] Node 0 active_anon:23272kB inactive_anon:0kB active_file:74196kB inactive_file:159940kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:98172kB dirty:1808kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10416kB pagetables:2384kB sec_pagetables:0kB all_unreclaimable? no [ 294.817092][ T8573] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 294.847783][ T8573] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 294.882949][ T8573] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 294.889178][ T8573] Node 0 DMA32 free:1471992kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:23232kB inactive_anon:0kB active_file:74196kB inactive_file:159108kB unevictable:1536kB writepending:1808kB present:3129332kB managed:2586848kB mlocked:0kB bounce:0kB free_pcp:18004kB local_pcp:2920kB free_cma:0kB [ 294.923032][ T8573] lowmem_reserve[]: 0 0 0 0 0 [ 294.963781][ T8573] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:832kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 294.994125][ T8573] lowmem_reserve[]: 0 0 0 0 0 [ 295.016533][ T8573] Node 1 Normal free:3901840kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:4kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:18528kB local_pcp:6240kB free_cma:0kB [ 295.048582][ T8573] lowmem_reserve[]: 0 0 0 0 0 [ 295.066918][ T8573] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 295.085705][ T8573] Node 0 DMA32: 2536*4kB (UME) 1827*8kB (UME) 1426*16kB (UME) 1333*32kB (UME) 744*64kB (UME) 277*128kB (UME) 149*256kB (UM) 58*512kB (UM) 38*1024kB (UME) 12*2048kB (UME) 285*4096kB (UM) = 1471992kB [ 295.117160][ T8573] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 295.136694][ T8573] Node 1 Normal: 230*4kB (UME) 41*8kB (UME) 43*16kB (UME) 94*32kB (UME) 25*64kB (UME) 8*128kB (UME) 2*256kB (UM) 1*512kB (E) 0*1024kB 1*2048kB (U) 950*4096kB (M) = 3901840kB [ 295.137043][ T8590] batadv0: entered allmulticast mode [ 295.154956][ T8573] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 295.175127][ T8573] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 295.181165][ T8590] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 295.195054][ T8573] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 295.215217][ T8573] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 295.233408][ T8573] 59970 total pagecache pages [ 295.241057][ T8573] 0 pages in swap cache [ 295.245474][ T8573] Free swap = 124996kB [ 295.250203][ T8573] Total swap = 124996kB [ 295.254872][ T8573] 2097051 pages RAM [ 295.278024][ T8573] 0 pages HighMem/MovableOnly [ 295.282753][ T8573] 416953 pages reserved [ 295.310624][ T8573] 0 pages cma reserved [ 295.319951][ T8595] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 295.660406][ T8608] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.973'. [ 295.672621][ T8610] netlink: 'syz.3.974': attribute type 10 has an invalid length. [ 295.691030][ T8610] netlink: 2 bytes leftover after parsing attributes in process `syz.3.974'. [ 295.693285][ T8608] openvswitch: netlink: Tunnel attr 11913 out of range max 16 [ 295.744099][ T8610] batadv_slave_1: entered promiscuous mode [ 295.784275][ T8610] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 295.807382][ T8610] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 295.867114][ T8610] netlink: 'syz.3.974': attribute type 10 has an invalid length. [ 295.875034][ T8610] netlink: 40 bytes leftover after parsing attributes in process `syz.3.974'. [ 296.067277][ T64] wlan1: Trigger new scan to find an IBSS to join [ 297.107053][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 298.859353][ T41] wlan1: Creating new IBSS network, BSSID d6:b7:22:c7:80:d7 [ 299.103488][ T8631] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 299.264127][ T8638] syzkaller0: entered promiscuous mode [ 299.269985][ T8638] syzkaller0: entered allmulticast mode [ 301.109231][ T41] wlan1: Trigger new scan to find an IBSS to join [ 301.115878][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 302.046764][ T42] wlan1: Creating new IBSS network, BSSID 86:20:f0:04:ee:01 [ 302.100371][ T8663] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 302.275226][ T8666] syzkaller0: entered promiscuous mode [ 302.280897][ T8666] syzkaller0: entered allmulticast mode [ 302.292171][ T8668] netlink: 'syz.3.995': attribute type 39 has an invalid length. [ 302.305919][ T5782] Bluetooth: hci2: unexpected event 0x04 length: 151 > 10 [ 304.079191][ T12] wlan1: Trigger new scan to find an IBSS to join [ 304.307010][ T5782] Bluetooth: hci2: command 0x0406 tx timeout [ 307.171075][ T8704] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 307.355219][ T8712] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1007'. [ 307.422499][ T8713] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 307.463057][ T8713] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 308.076269][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 308.495217][ T2959] wlan1: Creating new IBSS network, BSSID 8e:c8:0b:d3:fb:3c [ 309.003459][ T8740] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 309.128831][ T8750] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.1019'. [ 309.152271][ T8750] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.1019'. [ 309.164521][ T8749] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.1019'. [ 309.186195][ T8749] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.1019'. [ 309.455798][ T8759] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1022'. [ 309.468772][ T8759] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1022'. [ 309.495128][ T8757] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1022'. [ 309.517294][ T8759] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.1022'. [ 309.716970][ T8765] netlink: 'syz.0.1024': attribute type 10 has an invalid length. [ 310.689940][ T8776] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.1025'. [ 310.820051][ T8781] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 311.026771][ T41] wlan1: Trigger new scan to find an IBSS to join [ 311.026792][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 311.144744][ T8792] FAULT_INJECTION: forcing a failure. [ 311.144744][ T8792] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 311.184775][ T8792] CPU: 0 PID: 8792 Comm: syz.2.1032 Not tainted syzkaller #0 [ 311.192242][ T8792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 311.202353][ T8792] Call Trace: [ 311.205659][ T8792] [ 311.208620][ T8792] dump_stack_lvl+0x18c/0x250 [ 311.213347][ T8792] ? show_regs_print_info+0x20/0x20 [ 311.218592][ T8792] ? load_image+0x420/0x420 [ 311.223398][ T8792] ? __lock_acquire+0x7d80/0x7d80 [ 311.228480][ T8792] should_fail_ex+0x394/0x4c0 [ 311.233196][ T8792] _copy_from_user+0x2f/0xe0 [ 311.237841][ T8792] __copy_msghdr+0x388/0x560 [ 311.242471][ T8792] ___sys_sendmsg+0x214/0x360 [ 311.247186][ T8792] ? get_pid_task+0x20/0x1e0 [ 311.251812][ T8792] ? __sys_sendmsg+0x2b0/0x2b0 [ 311.256621][ T8792] ? __lock_acquire+0x7d80/0x7d80 [ 311.261699][ T8792] __se_sys_sendmsg+0x1d0/0x2c0 [ 311.266592][ T8792] ? __x64_sys_sendmsg+0x80/0x80 [ 311.271589][ T8792] ? lockdep_hardirqs_on+0x98/0x150 [ 311.276836][ T8792] do_syscall_64+0x55/0xb0 [ 311.281287][ T8792] ? clear_bhb_loop+0x40/0x90 [ 311.286001][ T8792] ? clear_bhb_loop+0x40/0x90 [ 311.290714][ T8792] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 311.296646][ T8792] RIP: 0033:0x7fa352b9de99 [ 311.301121][ T8792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 311.320757][ T8792] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 311.329173][ T8792] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 311.337143][ T8792] RDX: 0000000000000041 RSI: 0000200000000600 RDI: 0000000000000003 [ 311.345138][ T8792] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 311.353107][ T8792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 311.361073][ T8792] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 311.369062][ T8792] [ 313.038871][ T12] wlan1: Trigger new scan to find an IBSS to join [ 313.822805][ T8809] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.1036'. [ 314.045309][ T8815] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 314.437034][ T8822] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 314.520646][ T8836] netlink: 'syz.2.1046': attribute type 1 has an invalid length. [ 314.536873][ T8836] netlink: 112865 bytes leftover after parsing attributes in process `syz.2.1046'. [ 314.798912][ T8841] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.1048'. [ 314.997492][ T8844] FAULT_INJECTION: forcing a failure. [ 314.997492][ T8844] name failslab, interval 1, probability 0, space 0, times 0 [ 315.015125][ T8844] CPU: 1 PID: 8844 Comm: syz.3.1047 Not tainted syzkaller #0 [ 315.022556][ T8844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 315.032644][ T8844] Call Trace: [ 315.035946][ T8844] [ 315.038900][ T8844] dump_stack_lvl+0x18c/0x250 [ 315.043612][ T8844] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 315.049809][ T8844] ? show_regs_print_info+0x20/0x20 [ 315.055040][ T8844] ? load_image+0x420/0x420 [ 315.059586][ T8844] should_fail_ex+0x394/0x4c0 [ 315.064299][ T8844] should_failslab+0x9/0x20 [ 315.068835][ T8844] slab_pre_alloc_hook+0x59/0x300 [ 315.073892][ T8844] ? bpf_prog_test_run_skb+0x242/0x18f0 [ 315.080003][ T8844] ? bpf_prog_test_run_skb+0x242/0x18f0 [ 315.085577][ T8844] __kmem_cache_alloc_node+0x53/0x250 [ 315.090992][ T8844] ? bpf_prog_test_run_skb+0x242/0x18f0 [ 315.096577][ T8844] __kmalloc+0xa7/0x240 [ 315.100787][ T8844] bpf_prog_test_run_skb+0x242/0x18f0 [ 315.106199][ T8844] ? __fget_files+0x28/0x460 [ 315.110863][ T8844] ? __fget_files+0x3fc/0x460 [ 315.115580][ T8844] ? cpu_online+0x60/0x60 [ 315.119943][ T8844] bpf_prog_test_run+0x31f/0x390 [ 315.124913][ T8844] __sys_bpf+0x49d/0x890 [ 315.129201][ T8844] ? bpf_link_show_fdinfo+0x390/0x390 [ 315.134625][ T8844] ? lock_chain_count+0x20/0x20 [ 315.139517][ T8844] __x64_sys_bpf+0x7c/0x90 [ 315.143961][ T8844] do_syscall_64+0x55/0xb0 [ 315.148407][ T8844] ? clear_bhb_loop+0x40/0x90 [ 315.153105][ T8844] ? clear_bhb_loop+0x40/0x90 [ 315.157808][ T8844] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 315.163733][ T8844] RIP: 0033:0x7f83c859de99 [ 315.168177][ T8844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 315.187823][ T8844] RSP: 002b:00007f83c939b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 315.196261][ T8844] RAX: ffffffffffffffda RBX: 00007f83c8825fa0 RCX: 00007f83c859de99 [ 315.204257][ T8844] RDX: 000000000000002a RSI: 0000200000000080 RDI: 000000000000000a [ 315.212242][ T8844] RBP: 00007f83c939b090 R08: 0000000000000000 R09: 0000000000000000 [ 315.220258][ T8844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 315.228231][ T8844] R13: 00007f83c8826038 R14: 00007f83c8825fa0 R15: 00007ffcf16656b8 [ 315.236217][ T8844] [ 315.242634][ T41] wlan1: Trigger new scan to find an IBSS to join [ 317.029656][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 317.350798][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.364249][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.534556][ T41] wlan1: Creating new IBSS network, BSSID 06:2f:f1:0a:04:12 [ 317.548154][ T8850] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 317.917636][ T8863] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1053'. [ 317.971012][ T8863] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1053'. [ 318.123423][ T8867] FAULT_INJECTION: forcing a failure. [ 318.123423][ T8867] name failslab, interval 1, probability 0, space 0, times 0 [ 318.195443][ T8867] CPU: 1 PID: 8867 Comm: syz.0.1055 Not tainted syzkaller #0 [ 318.202893][ T8867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 318.212985][ T8867] Call Trace: [ 318.216291][ T8867] [ 318.219254][ T8867] dump_stack_lvl+0x18c/0x250 [ 318.223977][ T8867] ? sctp_sendmsg+0x1519/0x27b0 [ 318.228872][ T8867] ? ___sys_sendmsg+0x2a6/0x360 [ 318.233810][ T8867] ? show_regs_print_info+0x20/0x20 [ 318.239053][ T8867] ? load_image+0x420/0x420 [ 318.243609][ T8867] should_fail_ex+0x394/0x4c0 [ 318.248331][ T8867] should_failslab+0x9/0x20 [ 318.252872][ T8867] slab_pre_alloc_hook+0x59/0x300 [ 318.257949][ T8867] ? sctp_add_bind_addr+0x8c/0x360 [ 318.263106][ T8867] __kmem_cache_alloc_node+0x53/0x250 [ 318.268517][ T8867] ? sctp_add_bind_addr+0x8c/0x360 [ 318.273659][ T8867] kmalloc_trace+0x2a/0xe0 [ 318.278115][ T8867] sctp_add_bind_addr+0x8c/0x360 [ 318.283089][ T8867] sctp_copy_local_addr_list+0x31b/0x4e0 [ 318.288762][ T8867] ? sctp_copy_local_addr_list+0xa4/0x4e0 [ 318.294564][ T8867] ? sctp_do_8_2_transport_strike+0x910/0x910 [ 318.300717][ T8867] ? sctp_v6_is_any+0x64/0x70 [ 318.305431][ T8867] ? sctp_copy_one_addr+0x8c/0x350 [ 318.310581][ T8867] sctp_bind_addr_copy+0xb3/0x3c0 [ 318.315762][ T8867] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 318.322134][ T8867] sctp_connect_new_asoc+0x2f9/0x6a0 [ 318.327507][ T8867] ? __sctp_connect+0xd80/0xd80 [ 318.332536][ T8867] ? __local_bh_enable_ip+0x13a/0x1c0 [ 318.337964][ T8867] ? bpf_lsm_sctp_bind_connect+0x9/0x10 [ 318.343550][ T8867] ? security_sctp_bind_connect+0x89/0xb0 [ 318.349312][ T8867] sctp_sendmsg+0x1519/0x27b0 [ 318.354047][ T8867] ? sctp_getsockopt+0xb60/0xb60 [ 318.359032][ T8867] ? aa_af_perm+0x330/0x330 [ 318.363599][ T8867] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 318.370097][ T8867] ? sock_rps_record_flow+0x19/0x3f0 [ 318.375393][ T8867] ? inet_sendmsg+0xce/0x2a0 [ 318.380039][ T8867] ? inet_send_prepare+0x250/0x250 [ 318.385153][ T8867] ____sys_sendmsg+0x61b/0x980 [ 318.389928][ T8867] ? __asan_memset+0x22/0x40 [ 318.394520][ T8867] ? __sys_sendmsg_sock+0x30/0x30 [ 318.399564][ T8867] ? __import_iovec+0x5f2/0x850 [ 318.404423][ T8867] ? import_iovec+0x73/0xa0 [ 318.408956][ T8867] ___sys_sendmsg+0x2a6/0x360 [ 318.413638][ T8867] ? __sys_sendmsg+0x2b0/0x2b0 [ 318.418425][ T8867] ? trace_call_bpf+0xc3/0x6c0 [ 318.423212][ T8867] __se_sys_sendmsg+0x1d0/0x2c0 [ 318.428068][ T8867] ? perf_trace_preemptirq_template+0x269/0x330 [ 318.434313][ T8867] ? __x64_sys_sendmsg+0x80/0x80 [ 318.439263][ T8867] ? lockdep_hardirqs_on+0x98/0x150 [ 318.444461][ T8867] do_syscall_64+0x55/0xb0 [ 318.448878][ T8867] ? clear_bhb_loop+0x40/0x90 [ 318.453550][ T8867] ? clear_bhb_loop+0x40/0x90 [ 318.458247][ T8867] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 318.464145][ T8867] RIP: 0033:0x7f1927b9de99 [ 318.468562][ T8867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 318.488188][ T8867] RSP: 002b:00007f1928a38028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 318.496628][ T8867] RAX: ffffffffffffffda RBX: 00007f1927e25fa0 RCX: 00007f1927b9de99 [ 318.504597][ T8867] RDX: 0000000000000041 RSI: 0000200000002dc0 RDI: 0000000000000003 [ 318.512565][ T8867] RBP: 00007f1928a38090 R08: 0000000000000000 R09: 0000000000000000 [ 318.520530][ T8867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 318.528496][ T8867] R13: 00007f1927e26038 R14: 00007f1927e25fa0 R15: 00007ffc5be74838 [ 318.536489][ T8867] [ 318.697838][ T8876] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.1058'. [ 318.998434][ T8862] delete_channel: no stack [ 319.022421][ T8882] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 319.079392][ T8885] FAULT_INJECTION: forcing a failure. [ 319.079392][ T8885] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 319.167219][ T8885] CPU: 1 PID: 8885 Comm: syz.3.1060 Not tainted syzkaller #0 [ 319.174771][ T8885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 319.184884][ T8885] Call Trace: [ 319.188215][ T8885] [ 319.191289][ T8885] dump_stack_lvl+0x18c/0x250 [ 319.196030][ T8885] ? show_regs_print_info+0x20/0x20 [ 319.201286][ T8885] ? load_image+0x420/0x420 [ 319.205867][ T8885] ? __might_fault+0xaa/0x120 [ 319.210593][ T8885] ? __lock_acquire+0x7d80/0x7d80 [ 319.216346][ T8885] should_fail_ex+0x394/0x4c0 [ 319.221056][ T8885] _copy_from_iter+0x1cd/0x1290 [ 319.225930][ T8885] ? rep_movs_alternative+0x4a/0x90 [ 319.231160][ T8885] ? copyout_mc+0x70/0x70 [ 319.235514][ T8885] ? copyout_mc+0x70/0x70 [ 319.239870][ T8885] ? __virt_addr_valid+0x10c/0x380 [ 319.245007][ T8885] ? page_copy_sane+0x16a/0x270 [ 319.249878][ T8885] copy_page_from_iter+0x7b/0x100 [ 319.254936][ T8885] skb_copy_datagram_from_iter+0x2ea/0x6f0 [ 319.260871][ T8885] tun_get_user+0xc84/0x3d70 [ 319.265495][ T8885] ? trace_event_raw_event_lock+0x150/0x240 [ 319.271502][ T8885] ? aa_file_perm+0x3e3/0xee0 [ 319.276199][ T8885] ? rcu_read_unlock+0xa0/0xa0 [ 319.281005][ T8885] ? tun_get+0x1c/0x2e0 [ 319.285183][ T8885] ? __lock_acquire+0x7d80/0x7d80 [ 319.290242][ T8885] ? tun_get+0x1c/0x2e0 [ 319.294429][ T8885] tun_chr_write_iter+0x119/0x200 [ 319.299480][ T8885] vfs_write+0x474/0x9a0 [ 319.303751][ T8885] ? file_end_write+0x250/0x250 [ 319.308634][ T8885] ? __fget_files+0x3fc/0x460 [ 319.313459][ T8885] ? __fdget_pos+0x1d8/0x330 [ 319.318061][ T8885] ? ksys_write+0x74/0x260 [ 319.322504][ T8885] ksys_write+0x151/0x260 [ 319.326858][ T8885] ? __ia32_sys_read+0x90/0x90 [ 319.331650][ T8885] ? lockdep_hardirqs_on+0x98/0x150 [ 319.336878][ T8885] do_syscall_64+0x55/0xb0 [ 319.341308][ T8885] ? clear_bhb_loop+0x40/0x90 [ 319.345993][ T8885] ? clear_bhb_loop+0x40/0x90 [ 319.350721][ T8885] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 319.356635][ T8885] RIP: 0033:0x7f83c859de99 [ 319.361077][ T8885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.380791][ T8885] RSP: 002b:00007f83c939b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 319.389226][ T8885] RAX: ffffffffffffffda RBX: 00007f83c8825fa0 RCX: 00007f83c859de99 [ 319.397211][ T8885] RDX: 000000000000cfa4 RSI: 00002000000006c0 RDI: 00000000000000c8 [ 319.405191][ T8885] RBP: 00007f83c939b090 R08: 0000000000000000 R09: 0000000000000000 [ 319.413182][ T8885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 319.421181][ T8885] R13: 00007f83c8826038 R14: 00007f83c8825fa0 R15: 00007ffcf16656b8 [ 319.429202][ T8885] [ 320.066679][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 320.073541][ T12] wlan1: Trigger new scan to find an IBSS to join [ 320.253422][ T8908] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.1068'. [ 320.262226][ T8889] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.1070'. [ 320.520186][ T8916] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1071'. [ 320.534111][ T8916] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1071'. [ 320.800217][ T8921] syz_tun: mtu greater than device maximum [ 321.043234][ T8925] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 321.138731][ T8914] delete_channel: no stack [ 321.420322][ T8936] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 321.482654][ T8943] netlink: 61967 bytes leftover after parsing attributes in process `syz.2.1079'. [ 321.860146][ T8947] netlink: 'syz.1.1081': attribute type 10 has an invalid length. [ 321.910765][ T8947] netlink: 2 bytes leftover after parsing attributes in process `syz.1.1081'. [ 321.956296][ T8947] bond0: entered promiscuous mode [ 321.963418][ T8947] bond_slave_0: entered promiscuous mode [ 321.980423][ T8947] bond_slave_1: entered promiscuous mode [ 322.002219][ T8947] bridge_slave_1: entered promiscuous mode [ 322.083146][ T2937] wlan1: Creating new IBSS network, BSSID de:4b:7a:f1:fb:d0 [ 322.865926][ T8965] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 323.293483][ T8975] netlink: 'syz.2.1092': attribute type 10 has an invalid length. [ 323.385848][ T8973] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1087'. [ 323.436626][ T8973] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1087'. [ 324.068360][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 325.027712][ T12] wlan1: Trigger new scan to find an IBSS to join [ 326.407562][ T8972] delete_channel: no stack [ 326.474363][ T8987] FAULT_INJECTION: forcing a failure. [ 326.474363][ T8987] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 326.516825][ T8987] CPU: 0 PID: 8987 Comm: syz.2.1096 Not tainted syzkaller #0 [ 326.524271][ T8987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 326.534352][ T8987] Call Trace: [ 326.537659][ T8987] [ 326.540622][ T8987] dump_stack_lvl+0x18c/0x250 [ 326.545346][ T8987] ? show_regs_print_info+0x20/0x20 [ 326.550589][ T8987] ? load_image+0x420/0x420 [ 326.555138][ T8987] ? __lock_acquire+0x7d80/0x7d80 [ 326.560199][ T8987] ? snprintf+0xe9/0x140 [ 326.564481][ T8987] should_fail_ex+0x394/0x4c0 [ 326.569185][ T8987] _copy_to_user+0x2f/0xa0 [ 326.573618][ T8987] simple_read_from_buffer+0xe7/0x150 [ 326.579038][ T8987] proc_fail_nth_read+0x1e8/0x260 [ 326.584124][ T8987] ? proc_fault_inject_write+0x360/0x360 [ 326.589786][ T8987] ? fsnotify_perm+0x271/0x5e0 [ 326.594600][ T8987] ? proc_fault_inject_write+0x360/0x360 [ 326.600254][ T8987] vfs_read+0x298/0x990 [ 326.604441][ T8987] ? kernel_read+0x1e0/0x1e0 [ 326.609048][ T8987] ? __fget_files+0x28/0x460 [ 326.613653][ T8987] ? __fget_files+0x3fc/0x460 [ 326.618345][ T8987] ? __fdget_pos+0x2a3/0x330 [ 326.622944][ T8987] ? ksys_read+0x74/0x260 [ 326.627288][ T8987] ksys_read+0x151/0x260 [ 326.631547][ T8987] ? vfs_write+0x9a0/0x9a0 [ 326.635975][ T8987] ? lockdep_hardirqs_on+0x98/0x150 [ 326.641190][ T8987] do_syscall_64+0x55/0xb0 [ 326.645614][ T8987] ? clear_bhb_loop+0x40/0x90 [ 326.650387][ T8987] ? clear_bhb_loop+0x40/0x90 [ 326.655072][ T8987] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 326.660976][ T8987] RIP: 0033:0x7fa352b5e6ce [ 326.665400][ T8987] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 326.685024][ T8987] RSP: 002b:00007fa353a92fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 326.693454][ T8987] RAX: ffffffffffffffda RBX: 00007fa353a936c0 RCX: 00007fa352b5e6ce [ 326.701442][ T8987] RDX: 000000000000000f RSI: 00007fa353a930a0 RDI: 0000000000000004 [ 326.709445][ T8987] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 326.717425][ T8987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 326.725400][ T8987] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 326.733401][ T8987] [ 328.476707][ T9003] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 329.029300][ T2937] wlan1: Trigger new scan to find an IBSS to join [ 329.182017][ T41] wlan1: Creating new IBSS network, BSSID 36:7c:ba:71:47:17 [ 331.026783][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 332.207722][ T9038] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1109'. [ 332.361437][ T9038] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1109'. [ 333.121490][ T9057] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 333.142736][ T9058] netlink: 'syz.1.1113': attribute type 10 has an invalid length. [ 333.193153][ T9058] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 333.218551][ T9058] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 333.294390][ T9037] delete_channel: no stack [ 334.067984][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 335.564227][ T2937] wlan1: Creating new IBSS network, BSSID 42:e4:78:a2:9f:aa [ 336.061174][ T9103] netlink: 'syz.2.1126': attribute type 21 has an invalid length. [ 336.082417][ T9103] netlink: 'syz.2.1126': attribute type 6 has an invalid length. [ 336.126170][ T9103] netlink: 15999 bytes leftover after parsing attributes in process `syz.2.1126'. [ 336.173373][ T9106] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 337.031292][ T12] wlan1: Trigger new scan to find an IBSS to join [ 339.957679][ T9129] netlink: 'syz.1.1141': attribute type 46 has an invalid length. [ 339.965611][ T9129] netlink: 55 bytes leftover after parsing attributes in process `syz.1.1141'. [ 340.066831][ T41] wlan1: Trigger new scan to find an IBSS to join [ 341.161474][ T9145] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 341.182293][ T9151] FAULT_INJECTION: forcing a failure. [ 341.182293][ T9151] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 341.267822][ T9151] CPU: 1 PID: 9151 Comm: syz.2.1143 Not tainted syzkaller #0 [ 341.275262][ T9151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 341.285378][ T9151] Call Trace: [ 341.288691][ T9151] [ 341.291644][ T9151] dump_stack_lvl+0x18c/0x250 [ 341.296448][ T9151] ? show_regs_print_info+0x20/0x20 [ 341.301683][ T9151] ? load_image+0x420/0x420 [ 341.306221][ T9151] ? __might_fault+0xaa/0x120 [ 341.310934][ T9151] ? __lock_acquire+0x7d80/0x7d80 [ 341.316004][ T9151] ? __virt_addr_valid+0x10c/0x380 [ 341.321157][ T9151] should_fail_ex+0x394/0x4c0 [ 341.325875][ T9151] _copy_to_user+0x2f/0xa0 [ 341.330329][ T9151] bpf_verifier_vlog+0x2f1/0x840 [ 341.335374][ T9151] __btf_verifier_log+0xe3/0x140 [ 341.340381][ T9151] ? btf_check_sec_info+0x350/0x350 [ 341.345630][ T9151] __btf_verifier_log_type+0x3c9/0x690 [ 341.351134][ T9151] ? btf_int_show+0x2810/0x2810 [ 341.356026][ T9151] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 341.361790][ T9151] btf_func_proto_check_meta+0xed/0x150 [ 341.367411][ T9151] btf_check_all_metas+0x371/0xaf0 [ 341.372571][ T9151] ? trace_event_raw_event_preemptirq_template+0x1f0/0x1f0 [ 341.379827][ T9151] btf_parse_type_sec+0xfc/0x1960 [ 341.384929][ T9151] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 341.391122][ T9151] ? lockdep_hardirqs_on+0x98/0x150 [ 341.396354][ T9151] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 341.402553][ T9151] ? btf_parse_str_sec+0x20d/0x2a0 [ 341.407707][ T9151] btf_new_fd+0x440/0x9e0 [ 341.412177][ T9151] ? bpf_btf_show_fdinfo+0x80/0x80 [ 341.417331][ T9151] ? capable+0x88/0xe0 [ 341.421456][ T9151] __sys_bpf+0x670/0x890 [ 341.425767][ T9151] ? bpf_link_show_fdinfo+0x390/0x390 [ 341.431186][ T9151] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 341.437397][ T9151] __x64_sys_bpf+0x7c/0x90 [ 341.441859][ T9151] do_syscall_64+0x55/0xb0 [ 341.446313][ T9151] ? clear_bhb_loop+0x40/0x90 [ 341.451023][ T9151] ? clear_bhb_loop+0x40/0x90 [ 341.455730][ T9151] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 341.461660][ T9151] RIP: 0033:0x7fa352b9de99 [ 341.466103][ T9151] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 341.485739][ T9151] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 341.494187][ T9151] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 341.502189][ T9151] RDX: 0000000000000020 RSI: 00002000000000c0 RDI: 0000000000000012 [ 341.510189][ T9151] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 341.518191][ T9151] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 341.526191][ T9151] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 341.534243][ T9151] [ 342.070829][ T2937] wlan1: Trigger new scan to find an IBSS to join [ 342.165889][ T2937] wlan1: Creating new IBSS network, BSSID e2:82:30:ce:31:cb [ 342.764224][ T9174] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1148'. [ 342.792185][ T9174] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1148'. [ 343.947063][ T9171] delete_channel: no stack [ 344.146085][ T9187] netlink: 'syz.2.1150': attribute type 10 has an invalid length. [ 344.206519][ T9187] macvlan0: entered promiscuous mode [ 344.212119][ T9187] macvlan0: entered allmulticast mode [ 344.312632][ T9187] veth1_vlan: entered allmulticast mode [ 344.879078][ T9196] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 345.015391][ T9202] netlink: 'syz.1.1158': attribute type 29 has an invalid length. [ 345.046627][ T9202] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1158'. [ 345.072986][ T9202] netlink: 'syz.1.1158': attribute type 29 has an invalid length. [ 345.117201][ T9202] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1158'. [ 345.126460][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 345.549767][ T9213] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1162'. [ 345.559557][ T9213] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1162'. [ 346.337276][ T9211] delete_channel: no stack [ 346.721138][ T9231] FAULT_INJECTION: forcing a failure. [ 346.721138][ T9231] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 346.775908][ T9231] CPU: 1 PID: 9231 Comm: syz.2.1169 Not tainted syzkaller #0 [ 346.778918][ T9233] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 346.783333][ T9231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 346.783351][ T9231] Call Trace: [ 346.783359][ T9231] [ 346.783367][ T9231] dump_stack_lvl+0x18c/0x250 [ 346.813262][ T9231] ? show_regs_print_info+0x20/0x20 [ 346.818501][ T9231] ? load_image+0x420/0x420 [ 346.823044][ T9231] ? __lock_acquire+0x7d80/0x7d80 [ 346.828110][ T9231] should_fail_ex+0x394/0x4c0 [ 346.832829][ T9231] _copy_from_user+0x2f/0xe0 [ 346.837466][ T9231] bpf_prog_test_run_skb+0x267/0x18f0 [ 346.842921][ T9231] ? __fget_files+0x28/0x460 [ 346.847552][ T9231] ? __fget_files+0x3fc/0x460 [ 346.852452][ T9231] ? cpu_online+0x60/0x60 [ 346.856824][ T9231] bpf_prog_test_run+0x31f/0x390 [ 346.861789][ T9231] __sys_bpf+0x49d/0x890 [ 346.866063][ T9231] ? bpf_link_show_fdinfo+0x390/0x390 [ 346.871472][ T9231] ? lock_chain_count+0x20/0x20 [ 346.876364][ T9231] __x64_sys_bpf+0x7c/0x90 [ 346.876576][ T9237] netlink: 'syz.3.1170': attribute type 33 has an invalid length. [ 346.880795][ T9231] do_syscall_64+0x55/0xb0 [ 346.889017][ T9237] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1170'. [ 346.893019][ T9231] ? clear_bhb_loop+0x40/0x90 [ 346.906752][ T9231] ? clear_bhb_loop+0x40/0x90 [ 346.911470][ T9231] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 346.917399][ T9231] RIP: 0033:0x7fa352b9de99 [ 346.921840][ T9231] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 346.941479][ T9231] RSP: 002b:00007fa353a93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 346.949927][ T9231] RAX: ffffffffffffffda RBX: 00007fa352e25fa0 RCX: 00007fa352b9de99 [ 346.957928][ T9231] RDX: 0000000000000050 RSI: 0000200000000900 RDI: 000000000000000a [ 346.965930][ T9231] RBP: 00007fa353a93090 R08: 0000000000000000 R09: 0000000000000000 [ 346.973929][ T9231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 346.981930][ T9231] R13: 00007fa352e26038 R14: 00007fa352e25fa0 R15: 00007ffec96fde68 [ 346.989948][ T9231] [ 347.027507][ T2937] wlan1: Trigger new scan to find an IBSS to join [ 347.250659][ T9240] netlink: 'syz.1.1172': attribute type 2 has an invalid length. [ 347.339906][ T9247] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1174'. [ 347.350285][ T9247] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1174'. [ 347.412035][ T9250] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 348.523975][ T9246] delete_channel: no stack [ 348.907722][ T9266] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.1188'. [ 349.122785][ T41] wlan1: Trigger new scan to find an IBSS to join [ 349.179603][ T9275] netlink: 'syz.2.1183': attribute type 29 has an invalid length. [ 349.223420][ T9275] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1183'. [ 349.330922][ T9275] netlink: 'syz.2.1183': attribute type 29 has an invalid length. [ 349.382348][ T9275] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1183'. [ 349.452233][ T9273] netlink: 'syz.0.1177': attribute type 2 has an invalid length. [ 350.066898][ T42] wlan1: Trigger new scan to find an IBSS to join [ 351.031530][ T2937] wlan1: Trigger new scan to find an IBSS to join [ 351.471152][ T41] wlan1: Creating new IBSS network, BSSID 1a:8d:d8:75:c9:f9 [ 351.917861][ T9289] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 351.970011][ T9285] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1187'. [ 352.016955][ T9285] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1187'. [ 352.098990][ T12] wlan1: Creating new IBSS network, BSSID 3a:16:3c:de:6c:cc [ 352.267719][ T9300] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.1191'. [ 352.476938][ T9284] delete_channel: no stack [ 354.107285][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 356.432720][ T2959] wlan1: Creating new IBSS network, BSSID e6:b4:8e:4a:a3:4f [ 356.640267][ T9324] netlink: 'syz.0.1197': attribute type 29 has an invalid length. [ 356.654721][ T9324] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1197'. [ 356.664181][ T9324] netlink: 'syz.0.1197': attribute type 29 has an invalid length. [ 356.673018][ T9324] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1197'. [ 356.693361][ T9321] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 356.810667][ T9329] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.1200'. [ 357.000228][ T9332] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1202'. [ 357.032720][ T9332] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1202'. [ 357.474549][ T9331] delete_channel: no stack [ 357.958564][ T9358] FAULT_INJECTION: forcing a failure. [ 357.958564][ T9358] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 358.063461][ T9358] CPU: 0 PID: 9358 Comm: syz.1.1208 Not tainted syzkaller #0 [ 358.071065][ T9358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 358.081146][ T9358] Call Trace: [ 358.084790][ T9358] [ 358.087834][ T9358] dump_stack_lvl+0x18c/0x250 [ 358.092721][ T9358] ? show_regs_print_info+0x20/0x20 [ 358.098062][ T9358] ? load_image+0x420/0x420 [ 358.102642][ T9358] ? __might_fault+0xaa/0x120 [ 358.107395][ T9358] ? __lock_acquire+0x7d80/0x7d80 [ 358.112469][ T9358] should_fail_ex+0x394/0x4c0 [ 358.117224][ T9358] _copy_from_user+0x2f/0xe0 [ 358.121847][ T9358] sk_setsockopt+0x2b9/0x2b20 [ 358.126673][ T9358] ? sockopt_capable+0x60/0x60 [ 358.131464][ T9358] ? aa_sk_perm+0x83c/0x970 [ 358.136029][ T9358] ? __fget_files+0x28/0x460 [ 358.140680][ T9358] ? aa_af_perm+0x330/0x330 [ 358.145225][ T9358] ? __fget_files+0x28/0x460 [ 358.149841][ T9358] ? aa_sock_opt_perm+0x74/0x100 [ 358.155156][ T9358] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 358.160759][ T9358] ? security_socket_setsockopt+0x7e/0xa0 [ 358.166716][ T9358] do_sock_setsockopt+0x11b/0x1a0 [ 358.171865][ T9358] __x64_sys_setsockopt+0x182/0x200 [ 358.177105][ T9358] do_syscall_64+0x55/0xb0 [ 358.181550][ T9358] ? clear_bhb_loop+0x40/0x90 [ 358.186350][ T9358] ? clear_bhb_loop+0x40/0x90 [ 358.191052][ T9358] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 358.197051][ T9358] RIP: 0033:0x7fc67759de99 [ 358.201569][ T9358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 358.221355][ T9358] RSP: 002b:00007fc678480028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 358.229802][ T9358] RAX: ffffffffffffffda RBX: 00007fc677825fa0 RCX: 00007fc67759de99 [ 358.237797][ T9358] RDX: 000000000000000e RSI: 0000000000000001 RDI: 0000000000000003 [ 358.245791][ T9358] RBP: 00007fc678480090 R08: 000000000000003b R09: 0000000000000000 [ 358.253823][ T9358] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 358.261824][ T9358] R13: 00007fc677826038 R14: 00007fc677825fa0 R15: 00007fffbaa60b38 [ 358.269951][ T9358] [ 359.125386][ T12] wlan1: Trigger new scan to find an IBSS to join [ 360.828737][ T9362] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 361.043347][ T9365] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.1211'. [ 361.328210][ T9373] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1215'. [ 361.376604][ T9373] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1215'. [ 361.560672][ T9377] netlink: 'syz.3.1217': attribute type 5 has an invalid length. [ 361.727792][ T9381] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1218'. [ 362.081263][ T9371] delete_channel: no stack [ 363.039089][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 363.107669][ T2937] wlan1: Trigger new scan to find an IBSS to join [ 365.035977][ T9401] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 365.046917][ T42] wlan1: Creating new IBSS network, BSSID 06:f4:c8:ca:3d:93 [ 365.112586][ T9408] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.1224'. [ 365.521455][ T9418] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1229'. [ 365.546955][ T9418] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1229'. [ 365.847560][ T9417] delete_channel: no stack [ 366.104179][ T9437] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.1235'. [ 366.121658][ T9436] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 367.042585][ T12] wlan1: Trigger new scan to find an IBSS to join [ 367.470592][ T9464] netlink: 'syz.1.1243': attribute type 8 has an invalid length. [ 367.482969][ T9464] netlink: 'syz.1.1243': attribute type 1 has an invalid length. [ 367.502966][ T9464] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1243'. [ 367.535672][ T9462] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1242'. [ 367.549053][ T9462] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1242'. [ 367.560772][ T9467] netlink: 6 bytes leftover after parsing attributes in process `syz.0.1244'. [ 367.606604][ T9467] openvswitch: netlink: Flow actions attr not present in new flow. [ 367.843920][ T9472] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 368.013231][ T9479] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.1247'. [ 368.229627][ T9461] delete_channel: no stack [ 369.888212][ T9509] syzkaller0: entered promiscuous mode [ 369.893753][ T9509] syzkaller0: entered allmulticast mode [ 370.066900][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 370.067811][ T2959] wlan1: Trigger new scan to find an IBSS to join [ 371.172711][ T9522] delete_channel: no stack [ 371.696133][ T9513] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 371.709016][ T9516] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.1258'. [ 371.800688][ T9526] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1261'. [ 371.826598][ T9526] netlink: 152 bytes leftover after parsing attributes in process `syz.0.1261'. [ 371.924734][ T9534] netlink: 'syz.1.1263': attribute type 10 has an invalid length. [ 373.222250][ T9560] mac80211_hwsim hwsim7 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 373.247998][ T9562] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.1271'. [ 373.283034][ T9566] netlink: 'syz.1.1272': attribute type 23 has an invalid length. [ 373.291612][ T9566] netlink: 156008 bytes leftover after parsing attributes in process `syz.1.1272'. [ 373.443336][ T9569] FAULT_INJECTION: forcing a failure. [ 373.443336][ T9569] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 373.491622][ T9569] CPU: 1 PID: 9569 Comm: syz.3.1274 Not tainted syzkaller #0 [ 373.499065][ T9569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 373.509146][ T9569] Call Trace: [ 373.512432][ T9569] [ 373.515371][ T9569] dump_stack_lvl+0x18c/0x250 [ 373.520067][ T9569] ? show_regs_print_info+0x20/0x20 [ 373.525271][ T9569] ? load_image+0x420/0x420 [ 373.529816][ T9569] ? __lock_acquire+0x7d80/0x7d80 [ 373.534844][ T9569] ? snprintf+0xe9/0x140 [ 373.539141][ T9569] should_fail_ex+0x394/0x4c0 [ 373.543864][ T9569] _copy_to_user+0x2f/0xa0 [ 373.548285][ T9569] simple_read_from_buffer+0xe7/0x150 [ 373.553669][ T9569] proc_fail_nth_read+0x1e8/0x260 [ 373.558765][ T9569] ? proc_fault_inject_write+0x360/0x360 [ 373.564406][ T9569] ? fsnotify_perm+0x271/0x5e0 [ 373.569174][ T9569] ? proc_fault_inject_write+0x360/0x360 [ 373.574809][ T9569] vfs_read+0x298/0x990 [ 373.579002][ T9569] ? kernel_read+0x1e0/0x1e0 [ 373.583595][ T9569] ? __fget_files+0x28/0x460 [ 373.588191][ T9569] ? __fget_files+0x3fc/0x460 [ 373.592882][ T9569] ? __fdget_pos+0x2a3/0x330 [ 373.597501][ T9569] ? ksys_read+0x74/0x260 [ 373.601841][ T9569] ksys_read+0x151/0x260 [ 373.606088][ T9569] ? vfs_write+0x9a0/0x9a0 [ 373.610511][ T9569] ? lockdep_hardirqs_on+0x98/0x150 [ 373.615717][ T9569] do_syscall_64+0x55/0xb0 [ 373.620137][ T9569] ? clear_bhb_loop+0x40/0x90 [ 373.624897][ T9569] ? clear_bhb_loop+0x40/0x90 [ 373.629581][ T9569] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 373.635478][ T9569] RIP: 0033:0x7f83c855e6ce [ 373.639911][ T9569] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 373.659544][ T9569] RSP: 002b:00007f83c939afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 373.667976][ T9569] RAX: ffffffffffffffda RBX: 00007f83c939b6c0 RCX: 00007f83c855e6ce [ 373.675975][ T9569] RDX: 000000000000000f RSI: 00007f83c939b0a0 RDI: 0000000000000006 [ 373.683963][ T9569] RBP: 00007f83c939b090 R08: 0000000000000000 R09: 0000000000000000 [ 373.691940][ T9569] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 373.699915][ T9569] R13: 00007f83c8826038 R14: 00007f83c8825fa0 R15: 00007ffcf16656b8 [ 373.707906][ T9569] [ 373.734745][ T9573] netlink: 60243 bytes leftover after parsing attributes in process `syz.1.1276'. [ 373.750044][ T9573] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1276'. [ 373.777338][ T9565] delete_channel: no stack [ 374.061615][ T9583] netlink: 21 bytes leftover after parsing attributes in process `syz.2.1281'. [ 374.066683][ T3448] wlan1: Trigger new scan to find an IBSS to join [ 374.077555][ T41] wlan1: Trigger new scan to find an IBSS to join [ 374.102813][ T9583] ksmbd: Unknown IPC event: 0, ignore. [ 375.265565][ T41] wlan1: Creating new IBSS network, BSSID 2a:e1:1d:8e:56:ed [ 375.279945][ T9585] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 375.292446][ T64] ------------[ cut here ]------------ [ 375.298306][ T64] WARNING: CPU: 1 PID: 64 at net/wireless/ibss.c:37 __cfg80211_ibss_joined+0x3cb/0x430 [ 375.308559][ T64] Modules linked in: [ 375.312483][ T64] CPU: 1 PID: 64 Comm: kworker/u4:4 Not tainted syzkaller #0 [ 375.320382][ T64] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 375.331044][ T64] Workqueue: cfg80211 cfg80211_event_work [ 375.337424][ T64] RIP: 0010:__cfg80211_ibss_joined+0x3cb/0x430 [ 375.343621][ T64] Code: 04 25 28 00 00 00 48 3b 44 24 60 75 57 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 fe b6 9a f7 0f 0b eb bf e8 f5 b6 9a f7 <0f> 0b eb b6 e8 ec b6 9a f7 0f 0b e9 e2 fd ff ff e8 e0 b6 9a f7 0f [ 375.363832][ T64] RSP: 0018:ffffc900015b7a40 EFLAGS: 00010293 [ 375.370468][ T64] RAX: ffffffff89ec2e7b RBX: dffffc0000000000 RCX: ffff88801deeda00 [ 375.378835][ T64] RDX: 0000000000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1cfa20 [ 375.387245][ T64] RBP: ffffc900015b7af8 R08: ffffffff911e756f R09: 1ffffffff223cead [ 375.395264][ T64] R10: dffffc0000000000 R11: fffffbfff223ceae R12: ffff88805d624d10 [ 375.403506][ T64] R13: ffff88801da53658 R14: 1ffff920002b6f4c R15: 000000000000001f [ 375.411791][ T64] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 375.421128][ T64] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 375.428126][ T64] CR2: 0000001b2d722ff8 CR3: 000000000cf32000 CR4: 00000000003506e0 [ 375.436144][ T64] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 375.444522][ T64] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 375.452841][ T64] Call Trace: [ 375.456134][ T64] [ 375.459200][ T64] ? trace_rdev_return_void+0x1c0/0x1c0 [ 375.464793][ T64] cfg80211_process_wdev_events+0x396/0x500 [ 375.470793][ T64] cfg80211_process_rdev_events+0xa1/0x110 [ 375.476761][ T64] cfg80211_event_work+0x2f/0x40 [ 375.481723][ T64] ? process_scheduled_works+0x975/0x1600 [ 375.487540][ T64] process_scheduled_works+0xa60/0x1600 [ 375.493124][ T64] ? worker_attach_to_pool+0x370/0x370 [ 375.498660][ T64] ? assign_work+0x3cc/0x5d0 [ 375.503305][ T64] worker_thread+0xa5e/0xfe0 [ 375.508150][ T64] kthread+0x2fa/0x390 [ 375.512264][ T64] ? pr_cont_work+0x550/0x550 [ 375.517045][ T64] ? kthread_blkcg+0xd0/0xd0 [ 375.521671][ T64] ret_from_fork+0x48/0x80 [ 375.526157][ T64] ? kthread_blkcg+0xd0/0xd0 [ 375.530850][ T64] ret_from_fork_asm+0x11/0x20 [ 375.535701][ T64] [ 375.538773][ T64] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 375.546097][ T64] CPU: 1 PID: 64 Comm: kworker/u4:4 Not tainted syzkaller #0 [ 375.553465][ T64] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026 [ 375.563514][ T64] Workqueue: cfg80211 cfg80211_event_work [ 375.569273][ T64] Call Trace: [ 375.572546][ T64] [ 375.575604][ T64] dump_stack_lvl+0x18c/0x250 [ 375.580318][ T64] ? show_regs_print_info+0x20/0x20 [ 375.585528][ T64] ? load_image+0x420/0x420 [ 375.590050][ T64] panic+0x2ca/0x720 [ 375.593949][ T64] ? bpf_jit_dump+0xd0/0xd0 [ 375.598457][ T64] ? ret_from_fork_asm+0x11/0x20 [ 375.603425][ T64] __warn+0x2e0/0x470 [ 375.607403][ T64] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 375.612975][ T64] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 375.618544][ T64] report_bug+0x2be/0x4f0 [ 375.622901][ T64] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 375.628449][ T64] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 375.633990][ T64] ? __cfg80211_ibss_joined+0x3cd/0x430 [ 375.639536][ T64] handle_bug+0xcf/0x120 [ 375.643800][ T64] exc_invalid_op+0x1a/0x50 [ 375.648296][ T64] asm_exc_invalid_op+0x1a/0x20 [ 375.653163][ T64] RIP: 0010:__cfg80211_ibss_joined+0x3cb/0x430 [ 375.659314][ T64] Code: 04 25 28 00 00 00 48 3b 44 24 60 75 57 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 fe b6 9a f7 0f 0b eb bf e8 f5 b6 9a f7 <0f> 0b eb b6 e8 ec b6 9a f7 0f 0b e9 e2 fd ff ff e8 e0 b6 9a f7 0f [ 375.678925][ T64] RSP: 0018:ffffc900015b7a40 EFLAGS: 00010293 [ 375.684991][ T64] RAX: ffffffff89ec2e7b RBX: dffffc0000000000 RCX: ffff88801deeda00 [ 375.692971][ T64] RDX: 0000000000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1cfa20 [ 375.700944][ T64] RBP: ffffc900015b7af8 R08: ffffffff911e756f R09: 1ffffffff223cead [ 375.708918][ T64] R10: dffffc0000000000 R11: fffffbfff223ceae R12: ffff88805d624d10 [ 375.716909][ T64] R13: ffff88801da53658 R14: 1ffff920002b6f4c R15: 000000000000001f [ 375.724915][ T64] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 375.730477][ T64] ? trace_rdev_return_void+0x1c0/0x1c0 [ 375.736032][ T64] cfg80211_process_wdev_events+0x396/0x500 [ 375.741969][ T64] cfg80211_process_rdev_events+0xa1/0x110 [ 375.747781][ T64] cfg80211_event_work+0x2f/0x40 [ 375.752716][ T64] ? process_scheduled_works+0x975/0x1600 [ 375.758434][ T64] process_scheduled_works+0xa60/0x1600 [ 375.764004][ T64] ? worker_attach_to_pool+0x370/0x370 [ 375.769466][ T64] ? assign_work+0x3cc/0x5d0 [ 375.774058][ T64] worker_thread+0xa5e/0xfe0 [ 375.778666][ T64] kthread+0x2fa/0x390 [ 375.782731][ T64] ? pr_cont_work+0x550/0x550 [ 375.787412][ T64] ? kthread_blkcg+0xd0/0xd0 [ 375.792008][ T64] ret_from_fork+0x48/0x80 [ 375.796434][ T64] ? kthread_blkcg+0xd0/0xd0 [ 375.801039][ T64] ret_from_fork_asm+0x11/0x20 [ 375.805813][ T64] [ 375.808952][ T64] Kernel Offset: disabled [ 375.813363][ T64] Rebooting in 86400 seconds..