last executing test programs: 4.534080179s ago: executing program 0 (id=18564): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000a40)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000004040)=""/4097, 0x1001}, {&(0x7f0000000f40)=""/4092, 0xffc}, {&(0x7f00000002c0)=""/66, 0x42}], 0x3}, 0x40000000) 4.330637293s ago: executing program 0 (id=18566): r0 = perf_event_open(&(0x7f0000000440)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x5, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = perf_event_open(&(0x7f0000000600)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d32, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r3 = socket$kcm(0x2, 0x3, 0x2) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="9feb010018000000000000004c0000004c0000002a0000000100000000000001040000002000000105000000010000040400000013000000010000000000000017000000020000040800000021000000010000000000000025000000020000002000000000696e74006270665f7370696e5f6c6f636b0076616c006d61705f76616c756500636e74006c"], 0x0, 0x8e}, 0x28) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="6ef4c91750e21c90080000080100000000000008", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="010000000300"/28], 0x48) r6 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)=[{0x0}], 0x1}, 0x0) recvmsg$kcm(r6, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000900)=""/4135, 0x1027}], 0x1}, 0x42) perf_event_open(&(0x7f0000001940)={0x2, 0x80, 0xf8, 0x0, 0x3, 0x4, 0x0, 0x0, 0x89b60, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x5, @perf_config_ext={0xffffffffffffffff, 0x3}, 0x11a226, 0x0, 0x3, 0x0, 0x3, 0x1ff, 0x2, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0x0, r2, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000001d40)=ANY=[@ANYBLOB="0b00000002000000060200000900000009080000", @ANYRES32=r5, @ANYBLOB="040f0000000000000000000000000000000000006ebb74590c3bba3e96f86b5ff6e88a042e136c62540174a7c7c594c6d9dea002eac01fa670e278f037af67cd6b674b368adc5eb2a31a2979b899cfb322e054bd93d8d81fa387e8368489c0a32975df9b7b45dcd926d396d9fc496fe55f2c207a3aee2bd86945e704b366ee2637cc7f7afd8d797a9650f062c321a35ed3d40e29113e0f019dc408426af658c77588eddaa4494afa668ad97fffffffd3914e77df6cac3ee9127cb94c24fd82d5", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000010000000100"/28], 0x50) r7 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r7, &(0x7f0000001a40)=ANY=[@ANYBLOB="130300005500915509"], 0xfe33) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$inet(r3, 0x0, 0x48000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001c00)={0xffffffffffffffff, 0x8100, 0x0, 0x0, 0x0, 0x0, 0xadf1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000001c80), 0x200002, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000001cc0)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_int(r9, &(0x7f0000001d00)=0x1, 0x12) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x3, 0x0, 0x0}, 0x94) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000100)={0x1, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x1e, 0x10, &(0x7f00000003c0)=ANY=[@ANYBLOB="18ffffff7f0000000000000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007491900f8ffffffbfa400000000000007040000f0ffffffb71b00000800000018230000", @ANYRES32=r10, @ANYBLOB="0000000000000000b70500000800000085000000a50000009500000000000000"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x48) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 4.024783011s ago: executing program 0 (id=18571): bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x9, 0x5, 0x8, 0x40, 0x10, 0x1}, 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000440)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x6, 0x0, 0x1, 0x400, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8982, 0x0) 3.708433409s ago: executing program 0 (id=18575): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1b000000007f592f64cb94cd7782007f55f036db", @ANYRES32, @ANYRES16, @ANYRESHEX, @ANYRES64, @ANYBLOB="000000000000000000404df776e2917d97e13044e91700000000000000000000000000000000000000716e57098e16bc0cb357788ee6000ae677f0149ddb4b17883757390187afbd3b0dd4a68b194921ceda564203fc51d3066d517f24f64f48d6e52e29da0771815cd5328e5644a2299248fcec30a80615cc263b8186161d4d85bf54bec0f0259266aa96f4113d4878c52ef8913ed8be43ba4f18b4ce4a"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x1f, 0xd, &(0x7f00000007c0)=ANY=[@ANYBLOB="18000000fcffffff000000008000008085000000a800000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00"/13], 0x48) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140), 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0400000004"], 0x48) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="8fedcb7907009875f3"], 0xfe1b) socket$kcm(0x10, 0x2, 0x4) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x10020, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x3, 0x4, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28ec, 0x0, @perf_config_ext={0x1, 0xc7d2d38}, 0x4110, 0x94, 0x0, 0x5, 0x0, 0x9, 0x8, 0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) r4 = syz_clone(0x20128000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0x0) r5 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r5, &(0x7f0000000300)={&(0x7f0000000340)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x34004000) ioctl$sock_kcm_SIOCKCMUNATTACH(r5, 0x5411, 0x0) perf_event_open(&(0x7f0000000380)={0x2, 0x80, 0x7c, 0x1, 0xf, 0x0, 0x0, 0x0, 0x204, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b, 0x0, @perf_bp={0x0}, 0x408, 0x0, 0xfffffffc, 0x0, 0x1, 0x7df, 0x0, 0x0, 0x0, 0x0, 0x800000000}, 0x0, 0x7, 0xffffffffffffffff, 0x9) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x2, &(0x7f00000004c0)=ANY=[@ANYBLOB="186a00000c000000000000001081fb00"], &(0x7f0000000500)='syzkaller\x00', 0x9, 0x21, &(0x7f0000000540)=""/33, 0x41100, 0x10, '\x00', 0x0, 0x25, r2, 0x8, &(0x7f0000000580)={0x7, 0x6}, 0x8, 0x10, &(0x7f00000005c0)={0x5, 0x5, 0x7, 0x8}, 0x10, 0x0, 0x0, 0x4, &(0x7f0000000680)=[0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000900)=[{0x2, 0x1, 0x2, 0x8}, {0x2, 0x1, 0xa, 0x8}, {0x4, 0x5, 0x4, 0x6}, {0x1, 0x5, 0x4, 0x2}], 0x10, 0x8001}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000880)=ANY=[@ANYRESDEC=r1, @ANYRES8=r4, @ANYBLOB="00000000000000000000000000000000008dfc10b75d19e25d4107f8e3d4c925000000", @ANYRES32=0x0, @ANYBLOB='\x00'/25], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x3, 0x0, 0x0, &(0x7f0000001c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000001cc0)="d8000000100081046a81f782db44b904021d080b01000000e8fe55a1180015000600f300030000120800040043000000a8001600a400014020000900feffff7f3626feffff7fb94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8dcef52a9d7c7c0b7a196e6f66112c88a6bbace806872123b6f5220f4cef4090000001f3c29643a5ee4ce1b14d6d930dfe1d9d322d4acd9b575730d0080000000000000b5675025ccca9e00360db70100000040a9925667e006dcdf63951f215ce3bb14feb9f5588a63644caf1ce1bd6c769ad809d52e9ecbee28a0", 0xd8}], 0x1}, 0x0) bpf$ITER_CREATE(0x21, 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000001dc0)={0x0, 0x0, &(0x7f0000001e00)=[{0x0}], 0x1, &(0x7f0000001e80)=ANY=[@ANYBLOB="1000c7283c0c78000000201824000000000000"], 0x10}, 0x4040081) 3.167349132s ago: executing program 1 (id=18580): bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x9, 0x5, 0x8, 0x40, 0x10, 0x1}, 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x9) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x5, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8982, &(0x7f0000000600)) 3.081022434s ago: executing program 2 (id=18581): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x50) r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r3, 0x0, 0xdc0, 0x0, &(0x7f0000000a00)="00800000000000000045a9000000", 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xf}, 0x3e) close(r2) r4 = perf_event_open(&(0x7f0000000a40)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x5, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x5, 0x5, &(0x7f0000000b80)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000bc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) socketpair(0x1, 0x1, 0x0, &(0x7f0000000c00)) r6 = perf_event_open(&(0x7f0000000c80)={0x2, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0xffffffffffffffff, 0x9010, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf50a43945a8ef38c}, 0xce6b9b20411c70f4, 0x800000000000ca, 0x0, 0x9, 0xffffffbffffffffc, 0x0, 0x0, 0x0, 0xf, 0x0, 0x3}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000d00)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) r7 = perf_event_open(&(0x7f0000000d80)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20488, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x111d09, 0x4, 0x10000, 0x1, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0xbf}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x2400, 0x7) recvmsg$unix(r1, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e80), 0xc1842, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x400454d0, 0xfb5896a630119561) write$cgroup_subtree(r8, &(0x7f0000000ec0)=ANY=[@ANYRES8=r2, @ANYBLOB="3eca", @ANYRES32=r7], 0x9a) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x10, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) perf_event_open(&(0x7f00000005c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2a040, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)="1400000016000b63d25a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x200000000000000) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x3, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1}, 0x50) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000800)="d80000001c0081044e81f782db44b9040a1d08020a000000401296a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 2.939409467s ago: executing program 1 (id=18583): bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x9, 0x5, 0x8, 0x40, 0x10, 0x1}, 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000440)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x108b84, 0x6, 0x0, 0x1, 0x400, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x9) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8982, 0x0) 2.617390436s ago: executing program 2 (id=18584): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8c00, 0x0) close(r1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0xc000000, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x6, &(0x7f0000000280)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {0x4}}, @exit], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0xe3, &(0x7f0000000300)=""/227}, 0x90) ioctl$TUNSETLINK(r0, 0x400454cd, 0x308) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) 2.520793248s ago: executing program 1 (id=18585): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000a40)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000004040)=""/4097, 0x1001}, {&(0x7f0000000f40)=""/4092, 0xffc}, {&(0x7f00000002c0)=""/66, 0x42}], 0x3}, 0x40000000) 2.480606829s ago: executing program 3 (id=18586): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0900000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0200000001"], 0x50) 2.289575034s ago: executing program 2 (id=18587): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000380)={r0, 0x0, 0x0}, 0x20) 2.247038305s ago: executing program 3 (id=18588): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0xd6, 0x0, 0x2, 0x640a9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x4, 0x49, 0x6, 0x2, 0x0, 0xffffdfff, 0x0, 0x2009}, 0x0, 0xf, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f0000000240)={0x0, 0xffffff2d, &(0x7f0000000280)=[{&(0x7f00000002c0)="c00e020039000b05d25a806f8c6394f90324fc602f00000008000300feff020037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0xa, 0x922000000003, 0x11) ioctl$sock_kcm_SIOCKCMATTACH(r3, 0x89e0, &(0x7f0000000340)={r2}) sendmsg$kcm(r3, &(0x7f0000000380)={&(0x7f00000003c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000580)="f4000900062b2b25fe80000000000000dc8b850f238466ccfc007a000000ad6e911b51818462b4", 0x27}], 0x1}, 0x54) sendmsg$kcm(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)="2e00000011008188040f46ecdb4cb9cca7480ef410000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x24000000) bpf$ENABLE_STATS(0x20, &(0x7f0000000300), 0x4) 2.04819712s ago: executing program 0 (id=18589): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x50) r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r3, 0x0, 0xdc0, 0x0, &(0x7f0000000a00)="00800000000000000045a9000000", 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xf}, 0x3e) close(r2) r4 = perf_event_open(&(0x7f0000000a40)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x5, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x5, 0x5, &(0x7f0000000b80)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000bc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) socketpair(0x1, 0x1, 0x0, &(0x7f0000000c00)) r6 = perf_event_open(&(0x7f0000000c80)={0x2, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0xffffffffffffffff, 0x9010, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf50a43945a8ef38c}, 0xce6b9b20411c70f4, 0x800000000000ca, 0x0, 0x9, 0xffffffbffffffffc, 0x0, 0x0, 0x0, 0xf, 0x0, 0x3}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000d00)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) r7 = perf_event_open(&(0x7f0000000d80)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20488, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x111d09, 0x4, 0x10000, 0x1, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0xbf}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x2400, 0x7) recvmsg$unix(r1, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e80), 0xc1842, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x400454d0, 0xfb5896a630119561) write$cgroup_subtree(r8, &(0x7f0000000ec0)=ANY=[@ANYRES8=r2, @ANYBLOB="3eca", @ANYRES32=r7], 0x9a) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x10, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) perf_event_open(&(0x7f00000005c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2a040, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)="1400000016000b63d25a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x200000000000000) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x3, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1}, 0x50) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000800)="d80000001c0081044e81f782db44b9040a1d08020a000000401296a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 2.0478421s ago: executing program 1 (id=18590): perf_event_open(0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000580)) perf_event_open(&(0x7f0000002040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000020c0)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f0000002100)=r0, 0x161) r2 = socket$kcm(0x10, 0x2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xe, 0x6, &(0x7f0000000340)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa0}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x7d}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000380)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) r3 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r3, 0x29, 0x11, 0x0, 0x40019) close(r2) socket$kcm(0x10, 0x2, 0x0) r4 = getpid() perf_event_open(&(0x7f00000005c0)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0, 0x7}, 0x1d4dc, 0x4, 0x98, 0x0, 0x3aa, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r5 = perf_event_open$cgroup(&(0x7f0000000640)={0x1, 0x80, 0x7, 0xe, 0x2, 0xec, 0x0, 0xff, 0xc65a, 0x5, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x8000000000000000, 0x4}, 0x490, 0xffffffffffffffff, 0xca, 0x8, 0x2, 0x1, 0x0, 0x0, 0x7, 0x0, 0xffffffffffff6de2}, r0, 0xc, r0, 0xb) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000700)={r4, r5, 0x0, 0x13, &(0x7f00000006c0)='cgroup.controllers\x00'}, 0x30) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0xffffffffffffffff}, 0x8, 0x0, 0x0, 0x0, 0x6, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x400200000000003e}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f00000001c0)={0x0, 0xd18c9b25, &(0x7f0000000200)=[{&(0x7f0000000240)="e03f03002a000b11d25a806c8c6f94f90424fc601000407a0a000600053582c137153e37000c11802f2ff4070300", 0x33fe0}], 0x1, 0x0, 0x0, 0x35}, 0x0) 2.04692864s ago: executing program 2 (id=18591): perf_event_open(0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000580)) perf_event_open(&(0x7f0000002040)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext, 0x0, 0x1, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000020c0)='cgroup.controllers\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f0000002100)=r0, 0x161) r2 = socket$kcm(0x10, 0x2, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xe, 0x6, &(0x7f0000000340)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xa0}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x7d}, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000380)='GPL\x00', 0x5, 0x29e, &(0x7f00000003c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) r3 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r3, 0x29, 0x11, 0x0, 0x40019) close(r2) socket$kcm(0x10, 0x2, 0x0) r4 = getpid() perf_event_open(0x0, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r5 = perf_event_open$cgroup(&(0x7f0000000640)={0x1, 0x80, 0x7, 0xe, 0x2, 0xec, 0x0, 0xff, 0xc65a, 0x5, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, @perf_config_ext={0x8000000000000000, 0x4}, 0x490, 0xffffffffffffffff, 0xca, 0x8, 0x2, 0x1, 0x0, 0x0, 0x7, 0x0, 0xffffffffffff6de2}, r0, 0xc, r0, 0xb) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000700)={r4, r5, 0x0, 0x13, &(0x7f00000006c0)='cgroup.controllers\x00'}, 0x30) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xb, 0xffffffffffffffff}, 0x8, 0x0, 0x0, 0x0, 0x6, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x400200000000003e}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r6, &(0x7f00000001c0)={0x0, 0xd18c9b25, &(0x7f0000000200)=[{&(0x7f0000000240)="e03f03002a000b11d25a806c8c6f94f90424fc601000407a0a000600053582c137153e37000c11802f2ff4070300", 0x33fe0}], 0x1, 0x0, 0x0, 0x35}, 0x0) 1.868462334s ago: executing program 3 (id=18592): bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x9, 0x5, 0x8, 0x40, 0x10, 0x1}, 0x50) socketpair(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x9) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x5, 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x48, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8982, &(0x7f0000000600)) 454.434609ms ago: executing program 1 (id=18593): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x50) r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000900)={0xffffffffffffffff, 0xffffffffffffffff}) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000980)={r3, 0x0, 0xdc0, 0x0, &(0x7f0000000a00)="00800000000000000045a9000000", 0x0, 0x0, 0x5000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xf}, 0x3e) close(r2) r4 = perf_event_open(&(0x7f0000000a40)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x5, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x5, 0x5, &(0x7f0000000b80)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000bc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) socketpair(0x1, 0x1, 0x0, &(0x7f0000000c00)) r6 = perf_event_open(&(0x7f0000000c80)={0x2, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0xffffffffffffffff, 0x9010, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, @perf_bp={0x0, 0xf50a43945a8ef38c}, 0xce6b9b20411c70f4, 0x800000000000ca, 0x0, 0x9, 0xffffffbffffffffc, 0x0, 0x0, 0x0, 0xf, 0x0, 0x3}, 0x0, 0xfffffffffffffffe, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000d00)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}, 0x104101, 0x4, 0x0, 0x1, 0x9, 0x10000000, 0x1}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x3) r7 = perf_event_open(&(0x7f0000000d80)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20488, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x4}, 0x111d09, 0x4, 0x10000, 0x1, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0xbf}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x2400, 0x7) recvmsg$unix(r1, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000e40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000e80), 0xc1842, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x400454d0, 0xfb5896a630119561) write$cgroup_subtree(r8, &(0x7f0000000ec0)=ANY=[@ANYRES8=r2, @ANYBLOB="3eca", @ANYRES32=r7], 0x9a) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x10, 0x4, 0x8, 0x2, 0x0, 0x1}, 0x48) perf_event_open(&(0x7f00000005c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x2a040, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x1, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r10 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r10, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000740)="1400000016000b63d25a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x200000000000000) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xe, 0x4, 0x3, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1}, 0x50) r11 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r11, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000800)="d80000001c0081044e81f782db44b9040a1d08020a000000401296a1180002000000000000000e1208000f0100810401a8001600200001400300000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c11503c6bbace8017cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef3d93452a00"/216, 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 450.918479ms ago: executing program 3 (id=18594): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000fc0)=[{&(0x7f0000001000)="2e000000100081cb977f1137ad88040f80ec59acbc0400010bfffffffd00000e000a00ff00009dabe4519b1f039d", 0x2e}], 0x10000000000001c2}, 0x40004800) 348.229462ms ago: executing program 2 (id=18595): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x8c00, 0x0) close(r1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0xc000000, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x10, 0x6, &(0x7f0000000280)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r2}, {0x4}}, @exit], &(0x7f00000002c0)='syzkaller\x00', 0x2, 0xe3, &(0x7f0000000300)=""/227}, 0x90) ioctl$TUNSETLINK(r0, 0x400454cd, 0x308) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, &(0x7f0000000080)) 175.091215ms ago: executing program 3 (id=18596): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0900000004000000040000000a00000000000000", @ANYRES32, @ANYBLOB, @ANYRES32=0x0, @ANYRES32=r0, @ANYBLOB="0200000001"], 0x50) 103.328228ms ago: executing program 0 (id=18597): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000a40)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019000800004460bc06000000a701251e6182949a3651fbffffffd4d4938037e7c7a0a03400ac09c51c268811000096859fc57a00000000000000002571cd53b9851b30", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x8000) recvmsg$kcm(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000004040)=""/4097, 0x1001}, {&(0x7f0000000f40)=""/4092, 0xffc}, {0x0}, {&(0x7f00000002c0)=""/66, 0x42}], 0x4}, 0x40000000) 25.107859ms ago: executing program 2 (id=18598): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000380)={r0, 0x0, 0x0}, 0x20) 8.597939ms ago: executing program 3 (id=18599): r0 = socket$kcm(0x2, 0x1000000000000002, 0x0) (async) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x20, 0x11, &(0x7f0000000280)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xe0}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@map_val={0x18, 0xa, 0x2, 0x0, r1, 0x0, 0x0, 0x0, 0xd5b5}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000340)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) sendmsg$inet(r0, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x4e24, @rand_addr=0x20}, 0x10, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1100000000000000fb3fddd7e683d3d5c3560b9b6f6df01903000100000800000000000000001c00000000000000000f00d143639efd", @ANYRES32=0x0, @ANYBLOB="1414fe100000000000000000000000006e51f500009448d7a7a364ff649c76503b92d7dcce66d05b35000380124996d2ade9490356584d7410431c91", @ANYRES16=r1, @ANYBLOB="a005000000000000000000002400000000000000000000000700000094040000441088f00000000000000000000000000000000011", @ANYBLOB="9ac8506a62d43db08c1d1f44c582e0d9f20a369c454110fb10669a86cef529c12f18e1f206784b207086cb64a77fa4f6d2940c52c6dd12eb4857405da9cdb0e404fff4af879ab69e832c241038d1ff"], 0x98}, 0x4008800) (async) r2 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="c01803001d000b63", 0x8}], 0x1}, 0x0) (async, rerun: 64) write$cgroup_subtree(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="33fe00006a"], 0xfe33) (async, rerun: 64) r3 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r3, 0x84, 0x7, &(0x7f00000007c0), 0x4) 0s ago: executing program 1 (id=18600): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0xd6, 0x0, 0x2, 0x640a9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x4, 0x49, 0x6, 0x2, 0x0, 0xffffdfff, 0x0, 0x2009}, 0x0, 0xf, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x29, 0x5, 0x0) r1 = perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, 0xffffffffffffffff) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f0000000240)={0x0, 0xffffff2d, &(0x7f0000000280)=[{&(0x7f00000002c0)="c00e020039000b05d25a806f8c6394f90324fc602f00000008000300feff020037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x7}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) r4 = socket$kcm(0xa, 0x922000000003, 0x11) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000000340)={r3}) sendmsg$kcm(r4, &(0x7f0000000380)={&(0x7f00000003c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000580)="f4000900062b2b25fe80000000000000dc8b850f238466ccfc007a000000ad6e911b51818462b4", 0x27}], 0x1}, 0x54) sendmsg$kcm(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000640)="2e00000011008188040f46ecdb4cb9cca7480ef410000000e3bd6efb440009000e000a000d000000ba8000001201", 0x2e}], 0x1}, 0x24000000) bpf$ENABLE_STATS(0x20, &(0x7f0000000300), 0x4) kernel console output (not intermixed with test programs): 36.993292][T28832] do_syscall_64+0x55/0xb0 [ 2936.997719][T28832] ? clear_bhb_loop+0x40/0x90 [ 2937.002403][T28832] ? clear_bhb_loop+0x40/0x90 [ 2937.007093][T28832] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2937.012991][T28832] RIP: 0033:0x7f3f64b5fd8e [ 2937.017418][T28832] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2937.037032][T28832] RSP: 002b:00007f3f62df5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2937.045460][T28832] RAX: ffffffffffffffda RBX: 00007f3f62df66c0 RCX: 00007f3f64b5fd8e [ 2937.053441][T28832] RDX: 000000000000000f RSI: 00007f3f62df60a0 RDI: 0000000000000004 [ 2937.061420][T28832] RBP: 00007f3f62df6090 R08: 0000000000000000 R09: 0000000000000000 [ 2937.069396][T28832] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2937.077375][T28832] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2937.085387][T28832] [ 2937.133551][T28834] netlink: 'syz.2.18153': attribute type 39 has an invalid length. [ 2937.219949][T28837] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.18154'. [ 2937.253550][T28837] netlink: 'syz.0.18154': attribute type 10 has an invalid length. [ 2937.584840][T28837] team0 (unregistering): Port device team_slave_0 removed [ 2938.200675][T28837] team0 (unregistering): Port device team_slave_1 removed [ 2938.310988][T28844] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18156'. [ 2938.323776][T28837] team0 (unregistering): Port device netdevsim0 removed [ 2938.366616][T28844] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2938.378850][T28844] CPU: 1 PID: 28844 Comm: syz.1.18156 Not tainted syzkaller #0 [ 2938.386468][T28844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2938.396557][T28844] Call Trace: [ 2938.399876][T28844] [ 2938.402847][T28844] dump_stack_lvl+0x18c/0x250 [ 2938.407589][T28844] ? show_regs_print_info+0x20/0x20 [ 2938.412839][T28844] ? load_image+0x420/0x420 [ 2938.417425][T28844] sysfs_warn_dup+0x8e/0xa0 [ 2938.421968][T28844] sysfs_do_create_link_sd+0xc0/0x110 [ 2938.427358][T28844] device_add_class_symlinks+0x1cf/0x240 [ 2938.433010][T28844] device_add+0x4f9/0xc40 [ 2938.437351][T28844] wiphy_register+0x1f24/0x2c70 [ 2938.442245][T28844] ? cfg80211_event_work+0x40/0x40 [ 2938.447375][T28844] ? minstrel_ht_alloc+0x88a/0x990 [ 2938.452507][T28844] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2938.458580][T28844] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2938.464078][T28844] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2938.469646][T28844] ? ieee80211_tasklet_handler+0x20/0x20 [ 2938.475287][T28844] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2938.481196][T28844] ? __debug_object_init+0xec/0x450 [ 2938.486410][T28844] ? __asan_memset+0x22/0x40 [ 2938.491019][T28844] ? __hrtimer_init+0x189/0x270 [ 2938.495888][T28844] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2938.501651][T28844] ? mac80211_hwsim_free+0x220/0x220 [ 2938.506944][T28844] ? rcu_is_watching+0x15/0xb0 [ 2938.511715][T28844] ? kstrndup+0xbd/0x140 [ 2938.515994][T28844] hwsim_new_radio_nl+0xdad/0x1a70 [ 2938.521128][T28844] ? __nla_validate+0x50/0x50 [ 2938.525831][T28844] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2938.532195][T28844] ? __nla_parse+0x40/0x50 [ 2938.536632][T28844] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2938.542978][T28844] genl_family_rcv_msg_doit+0x21a/0x310 [ 2938.548542][T28844] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2938.554455][T28844] ? bpf_lsm_capable+0x9/0x10 [ 2938.559131][T28844] ? security_capable+0x89/0xb0 [ 2938.563999][T28844] genl_rcv_msg+0x611/0x7a0 [ 2938.568520][T28844] ? genl_bind+0x360/0x360 [ 2938.572949][T28844] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2938.579285][T28844] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2938.585879][T28844] ? perf_trace_lock+0xfc/0x3b0 [ 2938.590778][T28844] netlink_rcv_skb+0x235/0x4c0 [ 2938.595555][T28844] ? genl_bind+0x360/0x360 [ 2938.599980][T28844] ? netlink_ack+0x1160/0x1160 [ 2938.604769][T28844] ? __lock_acquire+0x7eb0/0x7eb0 [ 2938.609815][T28844] ? down_read+0x1ac/0x2e0 [ 2938.614241][T28844] genl_rcv+0x28/0x40 [ 2938.618224][T28844] netlink_unicast+0x7b1/0x930 [ 2938.623096][T28844] netlink_sendmsg+0x8d0/0xbf0 [ 2938.627881][T28844] ? netlink_getsockopt+0x590/0x590 [ 2938.633086][T28844] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2938.638643][T28844] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2938.643931][T28844] ? security_socket_sendmsg+0x80/0xa0 [ 2938.649396][T28844] ? netlink_getsockopt+0x590/0x590 [ 2938.654761][T28844] ____sys_sendmsg+0x61b/0x980 [ 2938.659545][T28844] ? __asan_memset+0x22/0x40 [ 2938.664148][T28844] ? __sys_sendmsg_sock+0x30/0x30 [ 2938.669183][T28844] ? __import_iovec+0x5f2/0x850 [ 2938.674075][T28844] ? import_iovec+0x73/0xa0 [ 2938.678592][T28844] ___sys_sendmsg+0x2a6/0x360 [ 2938.683284][T28844] ? __sys_sendmsg+0x2b0/0x2b0 [ 2938.688134][T28844] __se_sys_sendmsg+0x1d0/0x2c0 [ 2938.692997][T28844] ? __x64_sys_sendmsg+0x80/0x80 [ 2938.697966][T28844] ? lockdep_hardirqs_on+0x98/0x150 [ 2938.703174][T28844] do_syscall_64+0x55/0xb0 [ 2938.707596][T28844] ? clear_bhb_loop+0x40/0x90 [ 2938.712280][T28844] ? clear_bhb_loop+0x40/0x90 [ 2938.716964][T28844] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2938.722867][T28844] RIP: 0033:0x7f872219f559 [ 2938.727285][T28844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2938.746892][T28844] RSP: 002b:00007f872310b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2938.755312][T28844] RAX: ffffffffffffffda RBX: 00007f8722426090 RCX: 00007f872219f559 [ 2938.763284][T28844] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000b [ 2938.771270][T28844] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2938.779243][T28844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2938.787214][T28844] R13: 00007f8722426128 R14: 00007f8722426090 R15: 00007fffa76cef08 [ 2938.795214][T28844] [ 2938.879724][T28840] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18155'. [ 2938.922555][T28840] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2938.940874][T28840] CPU: 1 PID: 28840 Comm: syz.2.18155 Not tainted syzkaller #0 [ 2938.948482][T28840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2938.958563][T28840] Call Trace: [ 2938.961878][T28840] [ 2938.964843][T28840] dump_stack_lvl+0x18c/0x250 [ 2938.969562][T28840] ? show_regs_print_info+0x20/0x20 [ 2938.974796][T28840] ? load_image+0x420/0x420 [ 2938.979350][T28840] sysfs_warn_dup+0x8e/0xa0 [ 2938.983880][T28840] sysfs_do_create_link_sd+0xc0/0x110 [ 2938.989284][T28840] device_add_class_symlinks+0x1cf/0x240 [ 2938.994949][T28840] device_add+0x4f9/0xc40 [ 2938.999307][T28840] wiphy_register+0x1f24/0x2c70 [ 2939.004216][T28840] ? cfg80211_event_work+0x40/0x40 [ 2939.005466][T28857] FAULT_INJECTION: forcing a failure. [ 2939.005466][T28857] name failslab, interval 1, probability 0, space 0, times 0 [ 2939.009335][T28840] ? minstrel_ht_alloc+0x88a/0x990 [ 2939.009376][T28840] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2939.009404][T28840] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2939.038604][T28840] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2939.044172][T28840] ? ieee80211_tasklet_handler+0x20/0x20 [ 2939.049807][T28840] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2939.055710][T28840] ? __debug_object_init+0xec/0x450 [ 2939.060914][T28840] ? __asan_memset+0x22/0x40 [ 2939.065512][T28840] ? __hrtimer_init+0x189/0x270 [ 2939.070368][T28840] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2939.076113][T28840] ? mac80211_hwsim_free+0x220/0x220 [ 2939.081399][T28840] ? rcu_is_watching+0x15/0xb0 [ 2939.086181][T28840] ? kstrndup+0xbd/0x140 [ 2939.090440][T28840] hwsim_new_radio_nl+0xdad/0x1a70 [ 2939.095561][T28840] ? __nla_validate+0x50/0x50 [ 2939.100257][T28840] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2939.106598][T28840] ? __nla_parse+0x40/0x50 [ 2939.111026][T28840] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2939.117363][T28840] genl_family_rcv_msg_doit+0x21a/0x310 [ 2939.122929][T28840] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2939.128846][T28840] ? bpf_lsm_capable+0x9/0x10 [ 2939.133524][T28840] ? security_capable+0x89/0xb0 [ 2939.138391][T28840] genl_rcv_msg+0x611/0x7a0 [ 2939.142912][T28840] ? genl_bind+0x360/0x360 [ 2939.147331][T28840] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2939.153663][T28840] ? netlink_rcv_skb+0x214/0x4c0 [ 2939.158602][T28840] ? genl_rcv_msg+0x10/0x7a0 [ 2939.163200][T28840] netlink_rcv_skb+0x235/0x4c0 [ 2939.167967][T28840] ? genl_bind+0x360/0x360 [ 2939.172385][T28840] ? netlink_ack+0x1160/0x1160 [ 2939.177160][T28840] ? __lock_acquire+0x7eb0/0x7eb0 [ 2939.182193][T28840] ? down_read+0x1ac/0x2e0 [ 2939.186613][T28840] genl_rcv+0x28/0x40 [ 2939.190596][T28840] netlink_unicast+0x7b1/0x930 [ 2939.195374][T28840] netlink_sendmsg+0x8d0/0xbf0 [ 2939.200236][T28840] ? netlink_getsockopt+0x590/0x590 [ 2939.205437][T28840] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2939.210990][T28840] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2939.216280][T28840] ? security_socket_sendmsg+0x80/0xa0 [ 2939.221747][T28840] ? netlink_getsockopt+0x590/0x590 [ 2939.226949][T28840] ____sys_sendmsg+0x61b/0x980 [ 2939.231725][T28840] ? __asan_memset+0x22/0x40 [ 2939.236319][T28840] ? __sys_sendmsg_sock+0x30/0x30 [ 2939.241344][T28840] ? __import_iovec+0x5f2/0x850 [ 2939.246206][T28840] ? import_iovec+0x73/0xa0 [ 2939.250715][T28840] ___sys_sendmsg+0x2a6/0x360 [ 2939.255401][T28840] ? __sys_sendmsg+0x2b0/0x2b0 [ 2939.260221][T28840] __se_sys_sendmsg+0x1d0/0x2c0 [ 2939.265074][T28840] ? __x64_sys_sendmsg+0x80/0x80 [ 2939.270033][T28840] ? lockdep_hardirqs_on+0x98/0x150 [ 2939.275238][T28840] do_syscall_64+0x55/0xb0 [ 2939.279658][T28840] ? clear_bhb_loop+0x40/0x90 [ 2939.284348][T28840] ? clear_bhb_loop+0x40/0x90 [ 2939.289031][T28840] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2939.294938][T28840] RIP: 0033:0x7feb6359f559 [ 2939.299353][T28840] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2939.318965][T28840] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2939.327383][T28840] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2939.335351][T28840] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000b [ 2939.343322][T28840] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2939.351292][T28840] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2939.359258][T28840] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2939.367245][T28840] [ 2939.370265][T28857] CPU: 0 PID: 28857 Comm: syz.1.18159 Not tainted syzkaller #0 [ 2939.377843][T28857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2939.387920][T28857] Call Trace: [ 2939.391214][T28857] [ 2939.394159][T28857] dump_stack_lvl+0x18c/0x250 [ 2939.398868][T28857] ? show_regs_print_info+0x20/0x20 [ 2939.404090][T28857] ? load_image+0x420/0x420 [ 2939.408627][T28857] should_fail_ex+0x394/0x4c0 [ 2939.413336][T28857] should_failslab+0x9/0x20 [ 2939.417854][T28857] slab_pre_alloc_hook+0x59/0x300 [ 2939.422895][T28857] kmem_cache_alloc+0x5a/0x2d0 [ 2939.427654][T28857] ? skb_clone+0x1eb/0x370 [ 2939.432068][T28857] skb_clone+0x1eb/0x370 [ 2939.436312][T28857] bpf_clone_redirect+0x16d/0x4a0 [ 2939.441341][T28857] bpf_prog_c6f54bbad6dab1ee+0x5e/0x63 [ 2939.446797][T28857] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 2939.452771][T28857] ? __lock_acquire+0x7eb0/0x7eb0 [ 2939.457792][T28857] ? lock_chain_count+0x20/0x20 [ 2939.462727][T28857] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 2939.468963][T28857] ? lockdep_softirqs_on+0x5b0/0x5b0 [ 2939.474244][T28857] ? ktime_get+0x7f/0x280 [ 2939.478566][T28857] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 2939.484801][T28857] ? ktime_get_real_ts64+0x440/0x440 [ 2939.490079][T28857] ? __x64_sys_bpf+0x7c/0x90 [ 2939.494662][T28857] ? __local_bh_disable_ip+0x108/0x1a0 [ 2939.500115][T28857] ? __cant_sleep+0x220/0x220 [ 2939.504791][T28857] ? read_tsc+0x9/0x20 [ 2939.508856][T28857] ? ktime_get+0x24b/0x280 [ 2939.513269][T28857] ? bpf_test_run+0x174/0x870 [ 2939.517950][T28857] bpf_test_run+0x2df/0x870 [ 2939.522460][T28857] ? bpf_test_run+0x174/0x870 [ 2939.527138][T28857] ? dst_hold+0x70/0x70 [ 2939.531305][T28857] ? eth_get_headlen+0x210/0x210 [ 2939.536242][T28857] bpf_prog_test_run_skb+0xdbb/0x18f0 [ 2939.541623][T28857] ? cpu_online+0x60/0x60 [ 2939.545947][T28857] bpf_prog_test_run+0x31f/0x390 [ 2939.550881][T28857] __sys_bpf+0x49d/0x890 [ 2939.555118][T28857] ? bpf_link_show_fdinfo+0x560/0x560 [ 2939.560496][T28857] ? lock_chain_count+0x20/0x20 [ 2939.565349][T28857] __x64_sys_bpf+0x7c/0x90 [ 2939.569760][T28857] do_syscall_64+0x55/0xb0 [ 2939.574180][T28857] ? clear_bhb_loop+0x40/0x90 [ 2939.578853][T28857] ? clear_bhb_loop+0x40/0x90 [ 2939.583530][T28857] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2939.589417][T28857] RIP: 0033:0x7f872219f559 [ 2939.593831][T28857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2939.613429][T28857] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2939.621836][T28857] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2939.630062][T28857] RDX: 0000000000000050 RSI: 0000200000001480 RDI: 000000000000000a [ 2939.638023][T28857] RBP: 00007f872312c090 R08: 0000000000000000 R09: 0000000000000000 [ 2939.645992][T28857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2939.653954][T28857] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2939.661932][T28857] [ 2939.794747][T28858] netlink: 132 bytes leftover after parsing attributes in process `syz.0.18158'. [ 2939.919815][T28864] FAULT_INJECTION: forcing a failure. [ 2939.919815][T28864] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2939.956223][T28864] CPU: 1 PID: 28864 Comm: syz.2.18161 Not tainted syzkaller #0 [ 2939.963882][T28864] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2939.973967][T28864] Call Trace: [ 2939.977265][T28864] [ 2939.980205][T28864] dump_stack_lvl+0x18c/0x250 [ 2939.984915][T28864] ? show_regs_print_info+0x20/0x20 [ 2939.990127][T28864] ? load_image+0x420/0x420 [ 2939.994650][T28864] ? __lock_acquire+0x7eb0/0x7eb0 [ 2939.999682][T28864] ? snprintf+0xe9/0x140 [ 2940.003931][T28864] should_fail_ex+0x394/0x4c0 [ 2940.008621][T28864] _copy_to_user+0x2f/0xa0 [ 2940.013046][T28864] simple_read_from_buffer+0xe7/0x150 [ 2940.018458][T28864] proc_fail_nth_read+0x1e8/0x260 [ 2940.023508][T28864] ? proc_fault_inject_write+0x360/0x360 [ 2940.029169][T28864] ? fsnotify_perm+0x271/0x5e0 [ 2940.033939][T28864] ? proc_fault_inject_write+0x360/0x360 [ 2940.039584][T28864] vfs_read+0x298/0x990 [ 2940.043762][T28864] ? kernel_read+0x1e0/0x1e0 [ 2940.048357][T28864] ? __fget_files+0x28/0x460 [ 2940.052964][T28864] ? __fget_files+0x3fc/0x460 [ 2940.057656][T28864] ? __fdget_pos+0x2a3/0x330 [ 2940.062253][T28864] ? ksys_read+0x74/0x260 [ 2940.066592][T28864] ksys_read+0x151/0x260 [ 2940.070842][T28864] ? vfs_write+0x9a0/0x9a0 [ 2940.075270][T28864] ? lockdep_hardirqs_on+0x98/0x150 [ 2940.080477][T28864] do_syscall_64+0x55/0xb0 [ 2940.084920][T28864] ? clear_bhb_loop+0x40/0x90 [ 2940.089599][T28864] ? clear_bhb_loop+0x40/0x90 [ 2940.094281][T28864] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2940.100178][T28864] RIP: 0033:0x7feb6355fd8e [ 2940.104684][T28864] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2940.124313][T28864] RSP: 002b:00007feb644ccfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2940.132742][T28864] RAX: ffffffffffffffda RBX: 00007feb644cd6c0 RCX: 00007feb6355fd8e [ 2940.140724][T28864] RDX: 000000000000000f RSI: 00007feb644cd0a0 RDI: 000000000000000b [ 2940.148699][T28864] RBP: 00007feb644cd090 R08: 0000000000000000 R09: 0000000000000000 [ 2940.156682][T28864] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2940.164651][T28864] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2940.172669][T28864] [ 2941.286215][T28884] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18169'. [ 2941.314315][T28883] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.18167'. [ 2941.345309][T28884] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2941.354622][T28884] CPU: 1 PID: 28884 Comm: syz.1.18169 Not tainted syzkaller #0 [ 2941.362258][T28884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2941.372379][T28884] Call Trace: [ 2941.375721][T28884] [ 2941.378717][T28884] dump_stack_lvl+0x18c/0x250 [ 2941.383495][T28884] ? show_regs_print_info+0x20/0x20 [ 2941.388778][T28884] ? load_image+0x420/0x420 [ 2941.393419][T28884] sysfs_warn_dup+0x8e/0xa0 [ 2941.398003][T28884] sysfs_do_create_link_sd+0xc0/0x110 [ 2941.403463][T28884] device_add_class_symlinks+0x1cf/0x240 [ 2941.409187][T28884] device_add+0x4f9/0xc40 [ 2941.413615][T28884] wiphy_register+0x1f24/0x2c70 [ 2941.418641][T28884] ? cfg80211_event_work+0x40/0x40 [ 2941.424003][T28884] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2941.430268][T28884] ? ieee80211_register_hw+0x2d82/0x3cb0 [ 2941.436007][T28884] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2941.441616][T28884] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2941.447275][T28884] ? ieee80211_tasklet_handler+0x20/0x20 [ 2941.452979][T28884] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2941.458960][T28884] ? __debug_object_init+0xec/0x450 [ 2941.464251][T28884] ? __asan_memset+0x22/0x40 [ 2941.468917][T28884] ? __hrtimer_init+0x189/0x270 [ 2941.473858][T28884] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2941.479648][T28884] ? lock_chain_count+0x20/0x20 [ 2941.484673][T28884] ? mac80211_hwsim_free+0x220/0x220 [ 2941.490038][T28884] ? kstrndup+0xbd/0x140 [ 2941.494369][T28884] ? memcpy_orig+0xe5/0x120 [ 2941.498982][T28884] hwsim_new_radio_nl+0xdad/0x1a70 [ 2941.504164][T28884] ? __nla_validate+0x50/0x50 [ 2941.508941][T28884] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2941.515363][T28884] ? __nla_parse+0x40/0x50 [ 2941.519831][T28884] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2941.526221][T28884] genl_family_rcv_msg_doit+0x21a/0x310 [ 2941.531827][T28884] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2941.537787][T28884] ? bpf_lsm_capable+0x9/0x10 [ 2941.542494][T28884] ? security_capable+0x89/0xb0 [ 2941.547411][T28884] genl_rcv_msg+0x611/0x7a0 [ 2941.551978][T28884] ? genl_bind+0x360/0x360 [ 2941.556428][T28884] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2941.562799][T28884] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2941.569411][T28884] ? perf_trace_lock+0xfc/0x3b0 [ 2941.574334][T28884] netlink_rcv_skb+0x235/0x4c0 [ 2941.579160][T28884] ? genl_bind+0x360/0x360 [ 2941.583637][T28884] ? netlink_ack+0x1160/0x1160 [ 2941.588493][T28884] ? __lock_acquire+0x7eb0/0x7eb0 [ 2941.593599][T28884] ? down_read+0x1ac/0x2e0 [ 2941.598062][T28884] genl_rcv+0x28/0x40 [ 2941.602081][T28884] netlink_unicast+0x7b1/0x930 [ 2941.606927][T28884] netlink_sendmsg+0x8d0/0xbf0 [ 2941.611759][T28884] ? netlink_getsockopt+0x590/0x590 [ 2941.616999][T28884] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2941.622589][T28884] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2941.627904][T28884] ? security_socket_sendmsg+0x80/0xa0 [ 2941.633391][T28884] ? netlink_getsockopt+0x590/0x590 [ 2941.638632][T28884] ____sys_sendmsg+0x61b/0x980 [ 2941.643458][T28884] ? __asan_memset+0x22/0x40 [ 2941.648084][T28884] ? __sys_sendmsg_sock+0x30/0x30 [ 2941.653138][T28884] ? __import_iovec+0x5f2/0x850 [ 2941.658053][T28884] ? import_iovec+0x73/0xa0 [ 2941.662612][T28884] ___sys_sendmsg+0x2a6/0x360 [ 2941.667346][T28884] ? __sys_sendmsg+0x2b0/0x2b0 [ 2941.672231][T28884] ? __schedule+0x1805/0x4700 [ 2941.677065][T28884] __se_sys_sendmsg+0x1d0/0x2c0 [ 2941.681966][T28884] ? __x64_sys_sendmsg+0x80/0x80 [ 2941.687000][T28884] ? lockdep_hardirqs_on+0x98/0x150 [ 2941.692247][T28884] do_syscall_64+0x55/0xb0 [ 2941.696693][T28884] ? clear_bhb_loop+0x40/0x90 [ 2941.701399][T28884] ? clear_bhb_loop+0x40/0x90 [ 2941.706121][T28884] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2941.712046][T28884] RIP: 0033:0x7f872219f559 [ 2941.716498][T28884] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2941.736135][T28884] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2941.744589][T28884] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2941.752586][T28884] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2941.760584][T28884] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2941.768583][T28884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2941.776583][T28884] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2941.784646][T28884] [ 2941.850909][T28883] netlink: 'syz.2.18167': attribute type 10 has an invalid length. [ 2942.307099][T28883] team0 (unregistering): Port device team_slave_0 removed [ 2942.329668][T28883] team0 (unregistering): Port device team_slave_1 removed [ 2942.341557][T28883] team0 (unregistering): Port device netdevsim0 removed [ 2942.351521][T28883] bridge0: port 3(dummy0) entered disabled state [ 2942.358047][T28883] bridge0: port 1(bridge_slave_0) entered disabled state [ 2942.372218][T28883] team0 (unregistering): Port device bridge0 removed [ 2942.393083][T28889] netlink: 'syz.3.18168': attribute type 39 has an invalid length. [ 2942.514955][T28895] syzkaller1: entered promiscuous mode [ 2942.538582][T28895] syzkaller1: entered allmulticast mode [ 2942.827576][T28907] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18176'. [ 2942.874904][T28907] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2942.889445][T28907] CPU: 0 PID: 28907 Comm: syz.2.18176 Not tainted syzkaller #0 [ 2942.897074][T28907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2942.907168][T28907] Call Trace: [ 2942.910484][T28907] [ 2942.913452][T28907] dump_stack_lvl+0x18c/0x250 [ 2942.918188][T28907] ? show_regs_print_info+0x20/0x20 [ 2942.923455][T28907] ? load_image+0x420/0x420 [ 2942.928032][T28907] sysfs_warn_dup+0x8e/0xa0 [ 2942.932585][T28907] sysfs_do_create_link_sd+0xc0/0x110 [ 2942.938011][T28907] device_add_class_symlinks+0x1cf/0x240 [ 2942.943695][T28907] device_add+0x4f9/0xc40 [ 2942.948071][T28907] wiphy_register+0x1f24/0x2c70 [ 2942.953011][T28907] ? cfg80211_event_work+0x40/0x40 [ 2942.958165][T28907] ? minstrel_ht_alloc+0x88a/0x990 [ 2942.963338][T28907] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2942.969467][T28907] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2942.975001][T28907] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2942.980609][T28907] ? ieee80211_tasklet_handler+0x20/0x20 [ 2942.986288][T28907] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2942.992229][T28907] ? __debug_object_init+0xec/0x450 [ 2942.997479][T28907] ? __asan_memset+0x22/0x40 [ 2943.002120][T28907] ? __hrtimer_init+0x189/0x270 [ 2943.007014][T28907] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2943.012832][T28907] ? mac80211_hwsim_free+0x220/0x220 [ 2943.018156][T28907] ? rcu_is_watching+0x15/0xb0 [ 2943.022961][T28907] ? kstrndup+0xbd/0x140 [ 2943.027269][T28907] hwsim_new_radio_nl+0xdad/0x1a70 [ 2943.032434][T28907] ? __nla_validate+0x50/0x50 [ 2943.037183][T28907] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2943.043582][T28907] ? __nla_parse+0x40/0x50 [ 2943.048046][T28907] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2943.054432][T28907] genl_family_rcv_msg_doit+0x21a/0x310 [ 2943.060037][T28907] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2943.065999][T28907] ? bpf_lsm_capable+0x9/0x10 [ 2943.070713][T28907] ? security_capable+0x89/0xb0 [ 2943.075636][T28907] genl_rcv_msg+0x611/0x7a0 [ 2943.080196][T28907] ? genl_bind+0x360/0x360 [ 2943.084654][T28907] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2943.091023][T28907] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2943.097644][T28907] ? ref_tracker_free+0x686/0x830 [ 2943.102739][T28907] netlink_rcv_skb+0x235/0x4c0 [ 2943.107549][T28907] ? genl_bind+0x360/0x360 [ 2943.112008][T28907] ? netlink_ack+0x1160/0x1160 [ 2943.116967][T28907] ? __lock_acquire+0x7eb0/0x7eb0 [ 2943.122056][T28907] ? down_read+0x1ac/0x2e0 [ 2943.126526][T28907] genl_rcv+0x28/0x40 [ 2943.130553][T28907] netlink_unicast+0x7b1/0x930 [ 2943.135381][T28907] netlink_sendmsg+0x8d0/0xbf0 [ 2943.140202][T28907] ? netlink_getsockopt+0x590/0x590 [ 2943.145445][T28907] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2943.151041][T28907] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2943.156370][T28907] ? security_socket_sendmsg+0x80/0xa0 [ 2943.161879][T28907] ? netlink_getsockopt+0x590/0x590 [ 2943.167124][T28907] ____sys_sendmsg+0x61b/0x980 [ 2943.171952][T28907] ? __asan_memset+0x22/0x40 [ 2943.176597][T28907] ? __sys_sendmsg_sock+0x30/0x30 [ 2943.181656][T28907] ? __import_iovec+0x5f2/0x850 [ 2943.186575][T28907] ? import_iovec+0x73/0xa0 [ 2943.191132][T28907] ___sys_sendmsg+0x2a6/0x360 [ 2943.195872][T28907] ? __sys_sendmsg+0x2b0/0x2b0 [ 2943.200784][T28907] __se_sys_sendmsg+0x1d0/0x2c0 [ 2943.205688][T28907] ? __x64_sys_sendmsg+0x80/0x80 [ 2943.210701][T28907] ? lockdep_hardirqs_on+0x98/0x150 [ 2943.215951][T28907] do_syscall_64+0x55/0xb0 [ 2943.220415][T28907] ? clear_bhb_loop+0x40/0x90 [ 2943.225138][T28907] ? clear_bhb_loop+0x40/0x90 [ 2943.229871][T28907] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2943.235801][T28907] RIP: 0033:0x7feb6359f559 [ 2943.240257][T28907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2943.259913][T28907] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2943.268378][T28907] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2943.276395][T28907] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000b [ 2943.284408][T28907] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2943.292417][T28907] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2943.300428][T28907] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2943.308476][T28907] [ 2943.354629][T28923] netlink: 164736 bytes leftover after parsing attributes in process `syz.3.18179'. [ 2943.741926][T28927] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.18180'. [ 2943.874670][T28927] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2943.893620][T28927] CPU: 1 PID: 28927 Comm: syz.0.18180 Not tainted syzkaller #0 [ 2943.901247][T28927] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2943.911333][T28927] Call Trace: [ 2943.914638][T28927] [ 2943.917599][T28927] dump_stack_lvl+0x18c/0x250 [ 2943.922322][T28927] ? show_regs_print_info+0x20/0x20 [ 2943.927581][T28927] ? load_image+0x420/0x420 [ 2943.932137][T28927] sysfs_warn_dup+0x8e/0xa0 [ 2943.936678][T28927] sysfs_do_create_link_sd+0xc0/0x110 [ 2943.942079][T28927] device_add_class_symlinks+0x1cf/0x240 [ 2943.947724][T28927] device_add+0x4f9/0xc40 [ 2943.952060][T28927] wiphy_register+0x1f24/0x2c70 [ 2943.956940][T28927] ? cfg80211_event_work+0x40/0x40 [ 2943.962057][T28927] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2943.968227][T28927] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2943.973703][T28927] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2943.979259][T28927] ? ieee80211_tasklet_handler+0x20/0x20 [ 2943.984889][T28927] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2943.990796][T28927] ? __debug_object_init+0xec/0x450 [ 2943.995995][T28927] ? __asan_memset+0x22/0x40 [ 2944.000591][T28927] ? __hrtimer_init+0x189/0x270 [ 2944.005442][T28927] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2944.011181][T28927] ? mac80211_hwsim_free+0x220/0x220 [ 2944.016462][T28927] ? kstrndup+0xbd/0x140 [ 2944.020718][T28927] hwsim_new_radio_nl+0xdad/0x1a70 [ 2944.025832][T28927] ? __nla_validate+0x50/0x50 [ 2944.030519][T28927] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2944.036856][T28927] ? __nla_parse+0x40/0x50 [ 2944.041364][T28927] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2944.047699][T28927] genl_family_rcv_msg_doit+0x21a/0x310 [ 2944.053248][T28927] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2944.059147][T28927] ? bpf_lsm_capable+0x9/0x10 [ 2944.063820][T28927] ? security_capable+0x89/0xb0 [ 2944.068672][T28927] genl_rcv_msg+0x611/0x7a0 [ 2944.073191][T28927] ? genl_bind+0x360/0x360 [ 2944.077602][T28927] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2944.083937][T28927] netlink_rcv_skb+0x235/0x4c0 [ 2944.088708][T28927] ? genl_bind+0x360/0x360 [ 2944.093132][T28927] ? netlink_ack+0x1160/0x1160 [ 2944.097928][T28927] ? __lock_acquire+0x7eb0/0x7eb0 [ 2944.102950][T28927] ? net_generic+0x1e/0x240 [ 2944.107450][T28927] ? down_read+0x1ac/0x2e0 [ 2944.111901][T28927] genl_rcv+0x28/0x40 [ 2944.115884][T28927] netlink_unicast+0x7b1/0x930 [ 2944.120657][T28927] netlink_sendmsg+0x8d0/0xbf0 [ 2944.125431][T28927] ? netlink_getsockopt+0x590/0x590 [ 2944.130632][T28927] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2944.136226][T28927] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2944.141512][T28927] ? security_socket_sendmsg+0x80/0xa0 [ 2944.146967][T28927] ? netlink_getsockopt+0x590/0x590 [ 2944.152172][T28927] ____sys_sendmsg+0x61b/0x980 [ 2944.156948][T28927] ? __asan_memset+0x22/0x40 [ 2944.161651][T28927] ? __sys_sendmsg_sock+0x30/0x30 [ 2944.166695][T28927] ? __import_iovec+0x5f2/0x850 [ 2944.171565][T28927] ? import_iovec+0x73/0xa0 [ 2944.176075][T28927] ___sys_sendmsg+0x2a6/0x360 [ 2944.180758][T28927] ? __sys_sendmsg+0x2b0/0x2b0 [ 2944.185571][T28927] __se_sys_sendmsg+0x1d0/0x2c0 [ 2944.190422][T28927] ? __x64_sys_sendmsg+0x80/0x80 [ 2944.195370][T28927] ? lockdep_hardirqs_on+0x98/0x150 [ 2944.200567][T28927] do_syscall_64+0x55/0xb0 [ 2944.204982][T28927] ? clear_bhb_loop+0x40/0x90 [ 2944.209658][T28927] ? clear_bhb_loop+0x40/0x90 [ 2944.214333][T28927] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2944.220222][T28927] RIP: 0033:0x7f3f64b9f559 [ 2944.224636][T28927] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2944.244238][T28927] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2944.252649][T28927] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2944.260636][T28927] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2944.268602][T28927] RBP: 00007f3f64c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2944.276570][T28927] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2944.284539][T28927] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2944.292521][T28927] [ 2944.357927][T28941] netlink: 'syz.2.18185': attribute type 39 has an invalid length. [ 2944.501679][T28944] FAULT_INJECTION: forcing a failure. [ 2944.501679][T28944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2944.516978][T28944] CPU: 0 PID: 28944 Comm: syz.0.18187 Not tainted syzkaller #0 [ 2944.524580][T28944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2944.534658][T28944] Call Trace: [ 2944.537955][T28944] [ 2944.540906][T28944] dump_stack_lvl+0x18c/0x250 [ 2944.545630][T28944] ? show_regs_print_info+0x20/0x20 [ 2944.550854][T28944] ? load_image+0x420/0x420 [ 2944.555368][T28944] ? __might_fault+0xaa/0x120 [ 2944.560065][T28944] ? __lock_acquire+0x7eb0/0x7eb0 [ 2944.565096][T28944] should_fail_ex+0x394/0x4c0 [ 2944.569771][T28944] _copy_from_iter+0x1cd/0x1290 [ 2944.574630][T28944] ? copyout_mc+0x70/0x70 [ 2944.578951][T28944] ? __virt_addr_valid+0x10c/0x380 [ 2944.584058][T28944] ? __virt_addr_valid+0x10c/0x380 [ 2944.589161][T28944] ? __virt_addr_valid+0x10c/0x380 [ 2944.594269][T28944] ? __check_object_size+0x4fc/0xa40 [ 2944.599579][T28944] netlink_sendmsg+0x76b/0xbf0 [ 2944.604347][T28944] ? netlink_getsockopt+0x590/0x590 [ 2944.609544][T28944] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2944.615089][T28944] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2944.620379][T28944] ? security_socket_sendmsg+0x80/0xa0 [ 2944.625838][T28944] ? netlink_getsockopt+0x590/0x590 [ 2944.631038][T28944] ____sys_sendmsg+0x61b/0x980 [ 2944.635804][T28944] ? __asan_memset+0x22/0x40 [ 2944.640391][T28944] ? __sys_sendmsg_sock+0x30/0x30 [ 2944.645406][T28944] ? __import_iovec+0x5f2/0x850 [ 2944.650281][T28944] ? import_iovec+0x73/0xa0 [ 2944.654783][T28944] ___sys_sendmsg+0x2a6/0x360 [ 2944.659469][T28944] ? __sys_sendmsg+0x2b0/0x2b0 [ 2944.664266][T28944] __se_sys_sendmsg+0x1d0/0x2c0 [ 2944.669110][T28944] ? __x64_sys_sendmsg+0x80/0x80 [ 2944.674057][T28944] ? syscall_enter_from_user_mode+0x2e/0x80 [ 2944.679946][T28944] do_syscall_64+0x55/0xb0 [ 2944.684360][T28944] ? clear_bhb_loop+0x40/0x90 [ 2944.689045][T28944] ? clear_bhb_loop+0x40/0x90 [ 2944.693717][T28944] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2944.699603][T28944] RIP: 0033:0x7f3f64b9f559 [ 2944.704009][T28944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2944.723620][T28944] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2944.732038][T28944] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2944.740011][T28944] RDX: 0000000000000000 RSI: 0000200000003440 RDI: 000000000000000e [ 2944.747977][T28944] RBP: 00007f3f62df6090 R08: 0000000000000000 R09: 0000000000000000 [ 2944.756028][T28944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2944.764007][T28944] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2944.771981][T28944] [ 2944.797979][T28944] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.18187'. [ 2944.816742][T28948] netlink: 14 bytes leftover after parsing attributes in process `syz.3.18189'. [ 2944.844642][T28948] hsr_slave_0: left promiscuous mode [ 2944.880753][T28948] hsr_slave_1: left promiscuous mode [ 2945.388280][T28966] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18196'. [ 2945.418711][T28966] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2945.459298][T28966] CPU: 1 PID: 28966 Comm: syz.1.18196 Not tainted syzkaller #0 [ 2945.466943][T28966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2945.477061][T28966] Call Trace: [ 2945.480372][T28966] [ 2945.483345][T28966] dump_stack_lvl+0x18c/0x250 [ 2945.488084][T28966] ? show_regs_print_info+0x20/0x20 [ 2945.493338][T28966] ? load_image+0x420/0x420 [ 2945.497926][T28966] sysfs_warn_dup+0x8e/0xa0 [ 2945.502476][T28966] sysfs_do_create_link_sd+0xc0/0x110 [ 2945.507898][T28966] device_add_class_symlinks+0x1cf/0x240 [ 2945.513588][T28966] device_add+0x4f9/0xc40 [ 2945.517971][T28966] wiphy_register+0x1f24/0x2c70 [ 2945.522911][T28966] ? cfg80211_event_work+0x40/0x40 [ 2945.528066][T28966] ? minstrel_ht_alloc+0x88a/0x990 [ 2945.533232][T28966] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2945.539349][T28966] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2945.544911][T28966] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2945.550489][T28966] ? ieee80211_tasklet_handler+0x20/0x20 [ 2945.556145][T28966] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2945.562057][T28966] ? __debug_object_init+0xec/0x450 [ 2945.567270][T28966] ? __asan_memset+0x22/0x40 [ 2945.571874][T28966] ? __hrtimer_init+0x189/0x270 [ 2945.576741][T28966] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2945.582528][T28966] ? mac80211_hwsim_free+0x220/0x220 [ 2945.587817][T28966] ? rcu_is_watching+0x15/0xb0 [ 2945.592588][T28966] ? kstrndup+0xbd/0x140 [ 2945.596853][T28966] hwsim_new_radio_nl+0xdad/0x1a70 [ 2945.601979][T28966] ? __nla_validate+0x50/0x50 [ 2945.606689][T28966] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2945.613054][T28966] ? __nla_parse+0x40/0x50 [ 2945.617483][T28966] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2945.623825][T28966] genl_family_rcv_msg_doit+0x21a/0x310 [ 2945.629402][T28966] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2945.635314][T28966] ? bpf_lsm_capable+0x9/0x10 [ 2945.640000][T28966] ? security_capable+0x89/0xb0 [ 2945.644867][T28966] genl_rcv_msg+0x611/0x7a0 [ 2945.649421][T28966] ? genl_bind+0x360/0x360 [ 2945.653844][T28966] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2945.660206][T28966] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2945.666798][T28966] ? ref_tracker_free+0x686/0x830 [ 2945.671848][T28966] netlink_rcv_skb+0x235/0x4c0 [ 2945.676637][T28966] ? genl_bind+0x360/0x360 [ 2945.681070][T28966] ? netlink_ack+0x1160/0x1160 [ 2945.685858][T28966] ? __lock_acquire+0x7eb0/0x7eb0 [ 2945.690898][T28966] ? down_read+0x1ac/0x2e0 [ 2945.695327][T28966] genl_rcv+0x28/0x40 [ 2945.699338][T28966] netlink_unicast+0x7b1/0x930 [ 2945.704120][T28966] netlink_sendmsg+0x8d0/0xbf0 [ 2945.708904][T28966] ? netlink_getsockopt+0x590/0x590 [ 2945.714114][T28966] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2945.719678][T28966] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2945.724964][T28966] ? security_socket_sendmsg+0x80/0xa0 [ 2945.730425][T28966] ? netlink_getsockopt+0x590/0x590 [ 2945.735626][T28966] ____sys_sendmsg+0x61b/0x980 [ 2945.740426][T28966] ? __asan_memset+0x22/0x40 [ 2945.745038][T28966] ? __sys_sendmsg_sock+0x30/0x30 [ 2945.750074][T28966] ? __import_iovec+0x5f2/0x850 [ 2945.754952][T28966] ? import_iovec+0x73/0xa0 [ 2945.759475][T28966] ___sys_sendmsg+0x2a6/0x360 [ 2945.764176][T28966] ? __sys_sendmsg+0x2b0/0x2b0 [ 2945.769019][T28966] __se_sys_sendmsg+0x1d0/0x2c0 [ 2945.773882][T28966] ? __x64_sys_sendmsg+0x80/0x80 [ 2945.778854][T28966] ? lockdep_hardirqs_on+0x98/0x150 [ 2945.784087][T28966] do_syscall_64+0x55/0xb0 [ 2945.788509][T28966] ? clear_bhb_loop+0x40/0x90 [ 2945.793216][T28966] ? clear_bhb_loop+0x40/0x90 [ 2945.797905][T28966] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2945.803807][T28966] RIP: 0033:0x7f872219f559 [ 2945.808226][T28966] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2945.827850][T28966] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2945.836286][T28966] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2945.844259][T28966] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2945.852233][T28966] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2945.860217][T28966] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2945.868188][T28966] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2945.876215][T28966] [ 2945.898843][T28968] netlink: 'syz.0.18197': attribute type 39 has an invalid length. [ 2945.907162][T28970] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.18198'. [ 2945.935993][T28970] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2945.953728][T28970] CPU: 0 PID: 28970 Comm: syz.3.18198 Not tainted syzkaller #0 [ 2945.961365][T28970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2945.971460][T28970] Call Trace: [ 2945.974780][T28970] [ 2945.977747][T28970] dump_stack_lvl+0x18c/0x250 [ 2945.982486][T28970] ? show_regs_print_info+0x20/0x20 [ 2945.987733][T28970] ? load_image+0x420/0x420 [ 2945.992297][T28970] sysfs_warn_dup+0x8e/0xa0 [ 2945.996831][T28970] sysfs_do_create_link_sd+0xc0/0x110 [ 2946.002235][T28970] device_add_class_symlinks+0x1cf/0x240 [ 2946.007911][T28970] device_add+0x4f9/0xc40 [ 2946.012273][T28970] wiphy_register+0x1f24/0x2c70 [ 2946.017202][T28970] ? cfg80211_event_work+0x40/0x40 [ 2946.022341][T28970] ? minstrel_ht_alloc+0x88a/0x990 [ 2946.027499][T28970] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2946.033601][T28970] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2946.039128][T28970] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2946.044721][T28970] ? ieee80211_tasklet_handler+0x20/0x20 [ 2946.050377][T28970] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2946.056302][T28970] ? __debug_object_init+0xec/0x450 [ 2946.061531][T28970] ? __asan_memset+0x22/0x40 [ 2946.066156][T28970] ? __hrtimer_init+0x189/0x270 [ 2946.071040][T28970] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2946.076829][T28970] ? mac80211_hwsim_free+0x220/0x220 [ 2946.082139][T28970] ? rcu_is_watching+0x15/0xb0 [ 2946.086929][T28970] ? kstrndup+0xbd/0x140 [ 2946.091218][T28970] hwsim_new_radio_nl+0xdad/0x1a70 [ 2946.096366][T28970] ? __nla_validate+0x50/0x50 [ 2946.101091][T28970] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2946.107471][T28970] ? __nla_parse+0x40/0x50 [ 2946.111917][T28970] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2946.118280][T28970] genl_family_rcv_msg_doit+0x21a/0x310 [ 2946.123866][T28970] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2946.129801][T28970] ? bpf_lsm_capable+0x9/0x10 [ 2946.134493][T28970] ? security_capable+0x89/0xb0 [ 2946.139382][T28970] genl_rcv_msg+0x611/0x7a0 [ 2946.143922][T28970] ? genl_bind+0x360/0x360 [ 2946.148357][T28970] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2946.154706][T28970] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2946.161312][T28970] ? ref_tracker_free+0x686/0x830 [ 2946.166388][T28970] netlink_rcv_skb+0x235/0x4c0 [ 2946.171181][T28970] ? genl_bind+0x360/0x360 [ 2946.175628][T28970] ? netlink_ack+0x1160/0x1160 [ 2946.180441][T28970] ? __lock_acquire+0x7eb0/0x7eb0 [ 2946.185512][T28970] ? down_read+0x1ac/0x2e0 [ 2946.189961][T28970] genl_rcv+0x28/0x40 [ 2946.193968][T28970] netlink_unicast+0x7b1/0x930 [ 2946.198777][T28970] netlink_sendmsg+0x8d0/0xbf0 [ 2946.203581][T28970] ? netlink_getsockopt+0x590/0x590 [ 2946.208806][T28970] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2946.214384][T28970] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2946.219687][T28970] ? security_socket_sendmsg+0x80/0xa0 [ 2946.225173][T28970] ? netlink_getsockopt+0x590/0x590 [ 2946.230404][T28970] ____sys_sendmsg+0x61b/0x980 [ 2946.235203][T28970] ? __asan_memset+0x22/0x40 [ 2946.239818][T28970] ? __sys_sendmsg_sock+0x30/0x30 [ 2946.244859][T28970] ? __import_iovec+0x5f2/0x850 [ 2946.249750][T28970] ? import_iovec+0x73/0xa0 [ 2946.254281][T28970] ___sys_sendmsg+0x2a6/0x360 [ 2946.258980][T28970] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 2946.264820][T28970] ? __sys_sendmsg+0x2b0/0x2b0 [ 2946.269609][T28970] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 2946.275652][T28970] ? lockdep_hardirqs_on+0x98/0x150 [ 2946.280903][T28970] ? kasan_check_range+0x92/0x290 [ 2946.285971][T28970] __se_sys_sendmsg+0x1d0/0x2c0 [ 2946.290844][T28970] ? perf_trace_preemptirq_template+0x269/0x330 [ 2946.297119][T28970] ? __x64_sys_sendmsg+0x80/0x80 [ 2946.302119][T28970] ? lockdep_hardirqs_on+0x98/0x150 [ 2946.307345][T28970] do_syscall_64+0x55/0xb0 [ 2946.311781][T28970] ? clear_bhb_loop+0x40/0x90 [ 2946.316479][T28970] ? clear_bhb_loop+0x40/0x90 [ 2946.321181][T28970] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2946.327094][T28970] RIP: 0033:0x7f041fd9f559 [ 2946.331534][T28970] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2946.351160][T28970] RSP: 002b:00007f0420d5b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2946.359597][T28970] RAX: ffffffffffffffda RBX: 00007f0420025fa0 RCX: 00007f041fd9f559 [ 2946.367586][T28970] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2946.375577][T28970] RBP: 00007f041fe36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2946.383563][T28970] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2946.391551][T28970] R13: 00007f0420026038 R14: 00007f0420025fa0 R15: 00007ffef0fc8458 [ 2946.399571][T28970] [ 2946.646775][T28982] netlink: 'syz.3.18202': attribute type 10 has an invalid length. [ 2947.261117][T28997] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18209'. [ 2947.451413][T29003] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18211'. [ 2947.477808][T29003] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2947.493836][T29003] CPU: 1 PID: 29003 Comm: syz.2.18211 Not tainted syzkaller #0 [ 2947.501470][T29003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2947.511567][T29003] Call Trace: [ 2947.514877][T29003] [ 2947.517839][T29003] dump_stack_lvl+0x18c/0x250 [ 2947.522582][T29003] ? show_regs_print_info+0x20/0x20 [ 2947.527829][T29003] ? load_image+0x420/0x420 [ 2947.532411][T29003] sysfs_warn_dup+0x8e/0xa0 [ 2947.536966][T29003] sysfs_do_create_link_sd+0xc0/0x110 [ 2947.542397][T29003] device_add_class_symlinks+0x1cf/0x240 [ 2947.548087][T29003] device_add+0x4f9/0xc40 [ 2947.552456][T29003] wiphy_register+0x1f24/0x2c70 [ 2947.557356][T29003] ? cfg80211_event_work+0x40/0x40 [ 2947.562482][T29003] ? minstrel_ht_alloc+0x88a/0x990 [ 2947.567620][T29003] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2947.573702][T29003] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2947.579195][T29003] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2947.584764][T29003] ? ieee80211_tasklet_handler+0x20/0x20 [ 2947.590403][T29003] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2947.596306][T29003] ? __debug_object_init+0xec/0x450 [ 2947.601519][T29003] ? __asan_memset+0x22/0x40 [ 2947.606123][T29003] ? __hrtimer_init+0x189/0x270 [ 2947.610982][T29003] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2947.616735][T29003] ? mac80211_hwsim_free+0x220/0x220 [ 2947.622022][T29003] ? rcu_is_watching+0x15/0xb0 [ 2947.626794][T29003] ? kstrndup+0xbd/0x140 [ 2947.631057][T29003] hwsim_new_radio_nl+0xdad/0x1a70 [ 2947.636178][T29003] ? __nla_validate+0x50/0x50 [ 2947.640963][T29003] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2947.647325][T29003] ? __nla_parse+0x40/0x50 [ 2947.651753][T29003] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2947.658095][T29003] genl_family_rcv_msg_doit+0x21a/0x310 [ 2947.663656][T29003] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2947.669572][T29003] ? bpf_lsm_capable+0x9/0x10 [ 2947.674249][T29003] ? security_capable+0x89/0xb0 [ 2947.679116][T29003] genl_rcv_msg+0x611/0x7a0 [ 2947.683637][T29003] ? genl_bind+0x360/0x360 [ 2947.688145][T29003] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2947.694496][T29003] netlink_rcv_skb+0x235/0x4c0 [ 2947.699285][T29003] ? genl_bind+0x360/0x360 [ 2947.703739][T29003] ? netlink_ack+0x1160/0x1160 [ 2947.708601][T29003] ? __lock_acquire+0x7eb0/0x7eb0 [ 2947.713681][T29003] ? down_read+0x1ac/0x2e0 [ 2947.718293][T29003] genl_rcv+0x28/0x40 [ 2947.723006][T29003] netlink_unicast+0x7b1/0x930 [ 2947.727847][T29003] netlink_sendmsg+0x8d0/0xbf0 [ 2947.732691][T29003] ? netlink_getsockopt+0x590/0x590 [ 2947.737912][T29003] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2947.743488][T29003] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2947.748788][T29003] ? security_socket_sendmsg+0x80/0xa0 [ 2947.754260][T29003] ? netlink_getsockopt+0x590/0x590 [ 2947.759478][T29003] ____sys_sendmsg+0x61b/0x980 [ 2947.764261][T29003] ? __asan_memset+0x22/0x40 [ 2947.768900][T29003] ? __sys_sendmsg_sock+0x30/0x30 [ 2947.773964][T29003] ? __import_iovec+0x5f2/0x850 [ 2947.778851][T29003] ? import_iovec+0x73/0xa0 [ 2947.783375][T29003] ___sys_sendmsg+0x2a6/0x360 [ 2947.788082][T29003] ? __sys_sendmsg+0x2b0/0x2b0 [ 2947.792931][T29003] __se_sys_sendmsg+0x1d0/0x2c0 [ 2947.797794][T29003] ? __x64_sys_sendmsg+0x80/0x80 [ 2947.802773][T29003] ? lockdep_hardirqs_on+0x98/0x150 [ 2947.807988][T29003] do_syscall_64+0x55/0xb0 [ 2947.812425][T29003] ? clear_bhb_loop+0x40/0x90 [ 2947.817108][T29003] ? clear_bhb_loop+0x40/0x90 [ 2947.821797][T29003] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2947.827697][T29003] RIP: 0033:0x7feb6359f559 [ 2947.832118][T29003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2947.851728][T29003] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2947.860151][T29003] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2947.868122][T29003] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2947.876094][T29003] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2947.884071][T29003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2947.892042][T29003] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2947.900050][T29003] [ 2948.156564][T29017] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.18215'. [ 2948.466579][T29017] netlink: 'syz.3.18215': attribute type 10 has an invalid length. [ 2949.064840][T29031] FAULT_INJECTION: forcing a failure. [ 2949.064840][T29031] name failslab, interval 1, probability 0, space 0, times 0 [ 2949.114061][T29031] CPU: 1 PID: 29031 Comm: syz.3.18221 Not tainted syzkaller #0 [ 2949.121672][T29031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2949.131752][T29031] Call Trace: [ 2949.135043][T29031] [ 2949.138003][T29031] dump_stack_lvl+0x18c/0x250 [ 2949.142704][T29031] ? show_regs_print_info+0x20/0x20 [ 2949.147913][T29031] ? load_image+0x420/0x420 [ 2949.152426][T29031] ? __might_sleep+0xe0/0xe0 [ 2949.157033][T29031] ? __lock_acquire+0x7eb0/0x7eb0 [ 2949.162056][T29031] ? trace_event_raw_event_lock+0x240/0x240 [ 2949.167950][T29031] should_fail_ex+0x394/0x4c0 [ 2949.172630][T29031] should_failslab+0x9/0x20 [ 2949.177128][T29031] slab_pre_alloc_hook+0x59/0x300 [ 2949.182146][T29031] ? sk_prot_alloc+0xe7/0x210 [ 2949.186822][T29031] ? sk_prot_alloc+0xe7/0x210 [ 2949.191505][T29031] __kmem_cache_alloc_node+0x53/0x260 [ 2949.196875][T29031] ? sk_prot_alloc+0xe7/0x210 [ 2949.201550][T29031] __kmalloc+0xa7/0x240 [ 2949.205709][T29031] sk_prot_alloc+0xe7/0x210 [ 2949.210211][T29031] ? sk_alloc+0x24/0x350 [ 2949.214451][T29031] sk_alloc+0x3a/0x350 [ 2949.218525][T29031] ? bpf_ctx_init+0x154/0x190 [ 2949.223206][T29031] bpf_prog_test_run_skb+0x371/0x18f0 [ 2949.228576][T29031] ? __fget_files+0x28/0x460 [ 2949.233166][T29031] ? __fget_files+0x3fc/0x460 [ 2949.237845][T29031] ? cpu_online+0x60/0x60 [ 2949.242186][T29031] bpf_prog_test_run+0x31f/0x390 [ 2949.247145][T29031] __sys_bpf+0x49d/0x890 [ 2949.251381][T29031] ? bpf_link_show_fdinfo+0x560/0x560 [ 2949.256754][T29031] ? lock_chain_count+0x20/0x20 [ 2949.261692][T29031] __x64_sys_bpf+0x7c/0x90 [ 2949.266102][T29031] do_syscall_64+0x55/0xb0 [ 2949.270514][T29031] ? clear_bhb_loop+0x40/0x90 [ 2949.275186][T29031] ? clear_bhb_loop+0x40/0x90 [ 2949.279858][T29031] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2949.285746][T29031] RIP: 0033:0x7f041fd9f559 [ 2949.290158][T29031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2949.309771][T29031] RSP: 002b:00007f0420d5b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2949.318178][T29031] RAX: ffffffffffffffda RBX: 00007f0420025fa0 RCX: 00007f041fd9f559 [ 2949.326143][T29031] RDX: 0000000000000050 RSI: 0000200000003e40 RDI: 000000000000000a [ 2949.334106][T29031] RBP: 00007f0420d5b090 R08: 0000000000000000 R09: 0000000000000000 [ 2949.342074][T29031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2949.350066][T29031] R13: 00007f0420026038 R14: 00007f0420025fa0 R15: 00007ffef0fc8458 [ 2949.358044][T29031] [ 2949.493297][T29039] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18225'. [ 2949.543748][T29039] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2949.574515][T29039] CPU: 0 PID: 29039 Comm: syz.1.18225 Not tainted syzkaller #0 [ 2949.582149][T29039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2949.592241][T29039] Call Trace: [ 2949.595547][T29039] [ 2949.598514][T29039] dump_stack_lvl+0x18c/0x250 [ 2949.603248][T29039] ? show_regs_print_info+0x20/0x20 [ 2949.608482][T29039] ? load_image+0x420/0x420 [ 2949.613038][T29039] sysfs_warn_dup+0x8e/0xa0 [ 2949.617579][T29039] sysfs_do_create_link_sd+0xc0/0x110 [ 2949.622995][T29039] device_add_class_symlinks+0x1cf/0x240 [ 2949.628682][T29039] device_add+0x4f9/0xc40 [ 2949.633062][T29039] wiphy_register+0x1f24/0x2c70 [ 2949.637999][T29039] ? cfg80211_event_work+0x40/0x40 [ 2949.643153][T29039] ? minstrel_ht_alloc+0x88a/0x990 [ 2949.648418][T29039] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2949.654539][T29039] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2949.660069][T29039] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2949.665678][T29039] ? ieee80211_tasklet_handler+0x20/0x20 [ 2949.671347][T29039] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2949.677269][T29039] ? __debug_object_init+0xec/0x450 [ 2949.682485][T29039] ? __asan_memset+0x22/0x40 [ 2949.687093][T29039] ? __hrtimer_init+0x189/0x270 [ 2949.691958][T29039] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2949.697720][T29039] ? mac80211_hwsim_free+0x220/0x220 [ 2949.703008][T29039] ? rcu_is_watching+0x15/0xb0 [ 2949.707777][T29039] ? kstrndup+0xbd/0x140 [ 2949.712040][T29039] hwsim_new_radio_nl+0xdad/0x1a70 [ 2949.717166][T29039] ? __nla_validate+0x50/0x50 [ 2949.721870][T29039] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2949.728224][T29039] ? __nla_parse+0x40/0x50 [ 2949.732649][T29039] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2949.738994][T29039] genl_family_rcv_msg_doit+0x21a/0x310 [ 2949.744555][T29039] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2949.750465][T29039] ? bpf_lsm_capable+0x9/0x10 [ 2949.755142][T29039] ? security_capable+0x89/0xb0 [ 2949.760010][T29039] genl_rcv_msg+0x611/0x7a0 [ 2949.764533][T29039] ? genl_bind+0x360/0x360 [ 2949.768959][T29039] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2949.775472][T29039] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2949.782063][T29039] ? perf_trace_lock+0xfc/0x3b0 [ 2949.786932][T29039] netlink_rcv_skb+0x235/0x4c0 [ 2949.791707][T29039] ? genl_bind+0x360/0x360 [ 2949.796136][T29039] ? netlink_ack+0x1160/0x1160 [ 2949.800927][T29039] ? __lock_acquire+0x7eb0/0x7eb0 [ 2949.806058][T29039] ? down_read+0x1ac/0x2e0 [ 2949.810482][T29039] genl_rcv+0x28/0x40 [ 2949.814470][T29039] netlink_unicast+0x7b1/0x930 [ 2949.819255][T29039] netlink_sendmsg+0x8d0/0xbf0 [ 2949.824039][T29039] ? netlink_getsockopt+0x590/0x590 [ 2949.829246][T29039] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2949.834804][T29039] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2949.840093][T29039] ? security_socket_sendmsg+0x80/0xa0 [ 2949.845555][T29039] ? netlink_getsockopt+0x590/0x590 [ 2949.850761][T29039] ____sys_sendmsg+0x61b/0x980 [ 2949.855543][T29039] ? __asan_memset+0x22/0x40 [ 2949.860141][T29039] ? __sys_sendmsg_sock+0x30/0x30 [ 2949.865169][T29039] ? __import_iovec+0x5f2/0x850 [ 2949.870040][T29039] ? import_iovec+0x73/0xa0 [ 2949.874557][T29039] ___sys_sendmsg+0x2a6/0x360 [ 2949.879247][T29039] ? __sys_sendmsg+0x2b0/0x2b0 [ 2949.884093][T29039] __se_sys_sendmsg+0x1d0/0x2c0 [ 2949.888955][T29039] ? __x64_sys_sendmsg+0x80/0x80 [ 2949.893921][T29039] ? lockdep_hardirqs_on+0x98/0x150 [ 2949.899132][T29039] do_syscall_64+0x55/0xb0 [ 2949.903574][T29039] ? clear_bhb_loop+0x40/0x90 [ 2949.908258][T29039] ? clear_bhb_loop+0x40/0x90 [ 2949.912943][T29039] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2949.918841][T29039] RIP: 0033:0x7f872219f559 [ 2949.923261][T29039] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2949.942867][T29039] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2949.951285][T29039] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2949.959259][T29039] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2949.967316][T29039] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2949.975288][T29039] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2949.983259][T29039] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2949.991257][T29039] [ 2951.180444][T29069] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18238'. [ 2951.234933][T29069] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2951.264028][T29069] CPU: 1 PID: 29069 Comm: syz.2.18238 Not tainted syzkaller #0 [ 2951.271661][T29069] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2951.281752][T29069] Call Trace: [ 2951.285065][T29069] [ 2951.288023][T29069] dump_stack_lvl+0x18c/0x250 [ 2951.292750][T29069] ? show_regs_print_info+0x20/0x20 [ 2951.297997][T29069] ? load_image+0x420/0x420 [ 2951.302570][T29069] sysfs_warn_dup+0x8e/0xa0 [ 2951.307112][T29069] sysfs_do_create_link_sd+0xc0/0x110 [ 2951.312526][T29069] device_add_class_symlinks+0x1cf/0x240 [ 2951.318207][T29069] device_add+0x4f9/0xc40 [ 2951.322587][T29069] wiphy_register+0x1f24/0x2c70 [ 2951.327520][T29069] ? cfg80211_event_work+0x40/0x40 [ 2951.332716][T29069] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2951.338937][T29069] ? ieee80211_register_hw+0x2cc1/0x3cb0 [ 2951.344639][T29069] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2951.350164][T29069] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2951.355775][T29069] ? ieee80211_tasklet_handler+0x20/0x20 [ 2951.361444][T29069] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2951.367379][T29069] ? __debug_object_init+0xec/0x450 [ 2951.372620][T29069] ? __asan_memset+0x22/0x40 [ 2951.377251][T29069] ? __hrtimer_init+0x189/0x270 [ 2951.382161][T29069] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2951.387970][T29069] ? mac80211_hwsim_free+0x220/0x220 [ 2951.393296][T29069] ? rcu_is_watching+0x15/0xb0 [ 2951.398099][T29069] ? kstrndup+0xbd/0x140 [ 2951.402400][T29069] hwsim_new_radio_nl+0xdad/0x1a70 [ 2951.407570][T29069] ? __nla_validate+0x50/0x50 [ 2951.412315][T29069] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2951.418707][T29069] ? __nla_parse+0x40/0x50 [ 2951.423179][T29069] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2951.429561][T29069] genl_family_rcv_msg_doit+0x21a/0x310 [ 2951.435168][T29069] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2951.441118][T29069] ? bpf_lsm_capable+0x9/0x10 [ 2951.445826][T29069] ? security_capable+0x89/0xb0 [ 2951.450727][T29069] genl_rcv_msg+0x611/0x7a0 [ 2951.455288][T29069] ? genl_bind+0x360/0x360 [ 2951.459750][T29069] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2951.466146][T29069] netlink_rcv_skb+0x235/0x4c0 [ 2951.470948][T29069] ? genl_bind+0x360/0x360 [ 2951.475417][T29069] ? netlink_ack+0x1160/0x1160 [ 2951.480239][T29069] ? __lock_acquire+0x7eb0/0x7eb0 [ 2951.485324][T29069] ? down_read+0x1ac/0x2e0 [ 2951.489786][T29069] genl_rcv+0x28/0x40 [ 2951.493819][T29069] netlink_unicast+0x7b1/0x930 [ 2951.498643][T29069] netlink_sendmsg+0x8d0/0xbf0 [ 2951.503472][T29069] ? netlink_getsockopt+0x590/0x590 [ 2951.508713][T29069] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2951.514308][T29069] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2951.519624][T29069] ? security_socket_sendmsg+0x80/0xa0 [ 2951.525115][T29069] ? netlink_getsockopt+0x590/0x590 [ 2951.530352][T29069] ____sys_sendmsg+0x61b/0x980 [ 2951.535162][T29069] ? __asan_memset+0x22/0x40 [ 2951.539790][T29069] ? __sys_sendmsg_sock+0x30/0x30 [ 2951.544841][T29069] ? __import_iovec+0x5f2/0x850 [ 2951.549750][T29069] ? import_iovec+0x73/0xa0 [ 2951.554295][T29069] ___sys_sendmsg+0x2a6/0x360 [ 2951.559020][T29069] ? __sys_sendmsg+0x2b0/0x2b0 [ 2951.563958][T29069] __se_sys_sendmsg+0x1d0/0x2c0 [ 2951.568867][T29069] ? __x64_sys_sendmsg+0x80/0x80 [ 2951.573893][T29069] ? lockdep_hardirqs_on+0x98/0x150 [ 2951.579138][T29069] do_syscall_64+0x55/0xb0 [ 2951.583597][T29069] ? clear_bhb_loop+0x40/0x90 [ 2951.588311][T29069] ? clear_bhb_loop+0x40/0x90 [ 2951.593033][T29069] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2951.598963][T29069] RIP: 0033:0x7feb6359f559 [ 2951.603407][T29069] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2951.623062][T29069] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2951.631517][T29069] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2951.639521][T29069] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2951.647524][T29069] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2951.655521][T29069] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2951.663525][T29069] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2951.671574][T29069] [ 2951.749755][T29075] netlink: 'syz.3.18239': attribute type 21 has an invalid length. [ 2951.789678][T29075] netlink: 'syz.3.18239': attribute type 6 has an invalid length. [ 2951.828463][T29075] netlink: 132 bytes leftover after parsing attributes in process `syz.3.18239'. [ 2952.376664][T29095] netlink: 'syz.0.18250': attribute type 21 has an invalid length. [ 2952.463751][T29097] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.18249'. [ 2952.650571][T29097] netlink: 'syz.2.18249': attribute type 10 has an invalid length. [ 2952.895654][T29106] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.18252'. [ 2952.935886][T29106] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2952.956410][T29106] CPU: 1 PID: 29106 Comm: syz.0.18252 Not tainted syzkaller #0 [ 2952.964040][T29106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2952.974136][T29106] Call Trace: [ 2952.977546][T29106] [ 2952.980514][T29106] dump_stack_lvl+0x18c/0x250 [ 2952.985246][T29106] ? show_regs_print_info+0x20/0x20 [ 2952.990482][T29106] ? load_image+0x420/0x420 [ 2952.995020][T29106] sysfs_warn_dup+0x8e/0xa0 [ 2952.999534][T29106] sysfs_do_create_link_sd+0xc0/0x110 [ 2953.004914][T29106] device_add_class_symlinks+0x1cf/0x240 [ 2953.010557][T29106] device_add+0x4f9/0xc40 [ 2953.014908][T29106] wiphy_register+0x1f24/0x2c70 [ 2953.019791][T29106] ? cfg80211_event_work+0x40/0x40 [ 2953.024905][T29106] ? minstrel_ht_alloc+0x88a/0x990 [ 2953.030129][T29106] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2953.036220][T29106] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2953.041711][T29106] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2953.047277][T29106] ? ieee80211_tasklet_handler+0x20/0x20 [ 2953.052914][T29106] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2953.058819][T29106] ? __debug_object_init+0xec/0x450 [ 2953.064028][T29106] ? __asan_memset+0x22/0x40 [ 2953.068628][T29106] ? __hrtimer_init+0x189/0x270 [ 2953.073491][T29106] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2953.079246][T29106] ? mac80211_hwsim_free+0x220/0x220 [ 2953.084899][T29106] ? rcu_is_watching+0x15/0xb0 [ 2953.089671][T29106] ? kstrndup+0xbd/0x140 [ 2953.093938][T29106] hwsim_new_radio_nl+0xdad/0x1a70 [ 2953.099061][T29106] ? __nla_validate+0x50/0x50 [ 2953.103810][T29106] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2953.110166][T29106] ? __nla_parse+0x40/0x50 [ 2953.114679][T29106] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2953.121026][T29106] genl_family_rcv_msg_doit+0x21a/0x310 [ 2953.126588][T29106] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2953.132504][T29106] ? bpf_lsm_capable+0x9/0x10 [ 2953.137181][T29106] ? security_capable+0x89/0xb0 [ 2953.142047][T29106] genl_rcv_msg+0x611/0x7a0 [ 2953.146566][T29106] ? genl_bind+0x360/0x360 [ 2953.150987][T29106] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2953.157319][T29106] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2953.163910][T29106] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2953.170514][T29106] netlink_rcv_skb+0x235/0x4c0 [ 2953.175290][T29106] ? genl_bind+0x360/0x360 [ 2953.179715][T29106] ? netlink_ack+0x1160/0x1160 [ 2953.184932][T29106] ? __lock_acquire+0x7eb0/0x7eb0 [ 2953.189964][T29106] ? net_generic+0x1e/0x240 [ 2953.194472][T29106] ? down_read+0x1ac/0x2e0 [ 2953.198895][T29106] genl_rcv+0x28/0x40 [ 2953.202881][T29106] netlink_unicast+0x7b1/0x930 [ 2953.207668][T29106] netlink_sendmsg+0x8d0/0xbf0 [ 2953.212449][T29106] ? netlink_getsockopt+0x590/0x590 [ 2953.217657][T29106] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2953.223212][T29106] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2953.228502][T29106] ? security_socket_sendmsg+0x80/0xa0 [ 2953.233968][T29106] ? netlink_getsockopt+0x590/0x590 [ 2953.239172][T29106] ____sys_sendmsg+0x61b/0x980 [ 2953.243952][T29106] ? __asan_memset+0x22/0x40 [ 2953.248547][T29106] ? __sys_sendmsg_sock+0x30/0x30 [ 2953.253588][T29106] ? __import_iovec+0x5f2/0x850 [ 2953.258457][T29106] ? import_iovec+0x73/0xa0 [ 2953.262969][T29106] ___sys_sendmsg+0x2a6/0x360 [ 2953.267667][T29106] ? __sys_sendmsg+0x2b0/0x2b0 [ 2953.272513][T29106] __se_sys_sendmsg+0x1d0/0x2c0 [ 2953.277373][T29106] ? __x64_sys_sendmsg+0x80/0x80 [ 2953.282339][T29106] ? lockdep_hardirqs_on+0x98/0x150 [ 2953.287567][T29106] do_syscall_64+0x55/0xb0 [ 2953.291989][T29106] ? clear_bhb_loop+0x40/0x90 [ 2953.296690][T29106] ? clear_bhb_loop+0x40/0x90 [ 2953.301375][T29106] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2953.307272][T29106] RIP: 0033:0x7f3f64b9f559 [ 2953.311690][T29106] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2953.331302][T29106] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2953.339725][T29106] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2953.347705][T29106] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2953.355679][T29106] RBP: 00007f3f64c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2953.363830][T29106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2953.371974][T29106] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2953.379978][T29106] [ 2953.580425][T29119] netlink: 'syz.1.18255': attribute type 21 has an invalid length. [ 2953.622701][T29119] netlink: 128 bytes leftover after parsing attributes in process `syz.1.18255'. [ 2953.645702][T29119] netlink: 'syz.1.18255': attribute type 4 has an invalid length. [ 2953.672349][T29119] netlink: 3 bytes leftover after parsing attributes in process `syz.1.18255'. [ 2953.832624][T29131] netlink: 'syz.2.18261': attribute type 21 has an invalid length. [ 2953.855890][T29129] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.18260'. [ 2953.894343][T29129] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2953.919849][T29129] CPU: 0 PID: 29129 Comm: syz.0.18260 Not tainted syzkaller #0 [ 2953.927505][T29129] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2953.937602][T29129] Call Trace: [ 2953.940915][T29129] [ 2953.943876][T29129] dump_stack_lvl+0x18c/0x250 [ 2953.948608][T29129] ? show_regs_print_info+0x20/0x20 [ 2953.953853][T29129] ? load_image+0x420/0x420 [ 2953.958430][T29129] sysfs_warn_dup+0x8e/0xa0 [ 2953.962989][T29129] sysfs_do_create_link_sd+0xc0/0x110 [ 2953.968414][T29129] device_add_class_symlinks+0x1cf/0x240 [ 2953.974111][T29129] device_add+0x4f9/0xc40 [ 2953.978470][T29129] wiphy_register+0x1f24/0x2c70 [ 2953.983422][T29129] ? cfg80211_event_work+0x40/0x40 [ 2953.988584][T29129] ? minstrel_ht_alloc+0x88a/0x990 [ 2953.993763][T29129] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2953.999885][T29129] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2954.005422][T29129] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2954.011039][T29129] ? ieee80211_tasklet_handler+0x20/0x20 [ 2954.016719][T29129] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2954.022669][T29129] ? __debug_object_init+0xec/0x450 [ 2954.027921][T29129] ? __asan_memset+0x22/0x40 [ 2954.032562][T29129] ? __hrtimer_init+0x189/0x270 [ 2954.037569][T29129] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2954.043385][T29129] ? mac80211_hwsim_free+0x220/0x220 [ 2954.048712][T29129] ? rcu_is_watching+0x15/0xb0 [ 2954.053529][T29129] ? kstrndup+0xbd/0x140 [ 2954.057839][T29129] hwsim_new_radio_nl+0xdad/0x1a70 [ 2954.063004][T29129] ? __nla_validate+0x50/0x50 [ 2954.067751][T29129] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2954.074225][T29129] ? kasan_save_alloc_info+0xb/0x20 [ 2954.079492][T29129] ? __nla_parse+0x40/0x50 [ 2954.083958][T29129] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2954.090323][T29129] genl_family_rcv_msg_doit+0x21a/0x310 [ 2954.095902][T29129] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2954.101864][T29129] ? bpf_lsm_capable+0x9/0x10 [ 2954.106543][T29129] ? security_capable+0x89/0xb0 [ 2954.111413][T29129] genl_rcv_msg+0x611/0x7a0 [ 2954.115942][T29129] ? genl_bind+0x360/0x360 [ 2954.120365][T29129] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2954.126789][T29129] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2954.133477][T29129] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2954.140097][T29129] netlink_rcv_skb+0x235/0x4c0 [ 2954.144883][T29129] ? genl_bind+0x360/0x360 [ 2954.149308][T29129] ? netlink_ack+0x1160/0x1160 [ 2954.154095][T29129] ? __lock_acquire+0x7eb0/0x7eb0 [ 2954.159125][T29129] ? net_generic+0x1e/0x240 [ 2954.163639][T29129] ? down_read+0x1ac/0x2e0 [ 2954.168061][T29129] genl_rcv+0x28/0x40 [ 2954.172052][T29129] netlink_unicast+0x7b1/0x930 [ 2954.176838][T29129] netlink_sendmsg+0x8d0/0xbf0 [ 2954.181619][T29129] ? netlink_getsockopt+0x590/0x590 [ 2954.186826][T29129] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2954.192405][T29129] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2954.197697][T29129] ? security_socket_sendmsg+0x80/0xa0 [ 2954.203159][T29129] ? netlink_getsockopt+0x590/0x590 [ 2954.208376][T29129] ____sys_sendmsg+0x61b/0x980 [ 2954.213158][T29129] ? __asan_memset+0x22/0x40 [ 2954.217755][T29129] ? __sys_sendmsg_sock+0x30/0x30 [ 2954.222778][T29129] ? __import_iovec+0x5f2/0x850 [ 2954.227647][T29129] ? import_iovec+0x73/0xa0 [ 2954.232169][T29129] ___sys_sendmsg+0x2a6/0x360 [ 2954.236863][T29129] ? __sys_sendmsg+0x2b0/0x2b0 [ 2954.241711][T29129] __se_sys_sendmsg+0x1d0/0x2c0 [ 2954.246569][T29129] ? __x64_sys_sendmsg+0x80/0x80 [ 2954.251537][T29129] ? lockdep_hardirqs_on+0x98/0x150 [ 2954.256744][T29129] do_syscall_64+0x55/0xb0 [ 2954.261164][T29129] ? clear_bhb_loop+0x40/0x90 [ 2954.265846][T29129] ? clear_bhb_loop+0x40/0x90 [ 2954.270549][T29129] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2954.276452][T29129] RIP: 0033:0x7f3f64b9f559 [ 2954.280885][T29129] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2954.300495][T29129] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2954.308928][T29129] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2954.316903][T29129] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2954.324872][T29129] RBP: 00007f3f64c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2954.332841][T29129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2954.340812][T29129] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2954.348815][T29129] [ 2954.653699][T29150] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.18267'. [ 2954.692057][T29150] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2954.708978][T29150] CPU: 0 PID: 29150 Comm: syz.0.18267 Not tainted syzkaller #0 [ 2954.716606][T29150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2954.726703][T29150] Call Trace: [ 2954.730033][T29150] [ 2954.732999][T29150] dump_stack_lvl+0x18c/0x250 [ 2954.737739][T29150] ? show_regs_print_info+0x20/0x20 [ 2954.742993][T29150] ? load_image+0x420/0x420 [ 2954.747575][T29150] sysfs_warn_dup+0x8e/0xa0 [ 2954.752130][T29150] sysfs_do_create_link_sd+0xc0/0x110 [ 2954.757556][T29150] device_add_class_symlinks+0x1cf/0x240 [ 2954.763301][T29150] device_add+0x4f9/0xc40 [ 2954.767675][T29150] wiphy_register+0x1f24/0x2c70 [ 2954.772591][T29150] ? cfg80211_event_work+0x40/0x40 [ 2954.777729][T29150] ? minstrel_ht_alloc+0x88a/0x990 [ 2954.783012][T29150] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2954.789105][T29150] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2954.794615][T29150] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2954.800183][T29150] ? ieee80211_tasklet_handler+0x20/0x20 [ 2954.805854][T29150] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2954.811763][T29150] ? __debug_object_init+0xec/0x450 [ 2954.816976][T29150] ? __asan_memset+0x22/0x40 [ 2954.821579][T29150] ? __hrtimer_init+0x189/0x270 [ 2954.826521][T29150] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2954.832304][T29150] ? mac80211_hwsim_free+0x220/0x220 [ 2954.837607][T29150] ? rcu_is_watching+0x15/0xb0 [ 2954.842388][T29150] ? kstrndup+0xbd/0x140 [ 2954.846660][T29150] hwsim_new_radio_nl+0xdad/0x1a70 [ 2954.851786][T29150] ? __nla_validate+0x50/0x50 [ 2954.856516][T29150] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2954.862871][T29150] ? __nla_parse+0x40/0x50 [ 2954.867297][T29150] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2954.873645][T29150] genl_family_rcv_msg_doit+0x21a/0x310 [ 2954.879302][T29150] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2954.885215][T29150] ? bpf_lsm_capable+0x9/0x10 [ 2954.889895][T29150] ? security_capable+0x89/0xb0 [ 2954.894763][T29150] genl_rcv_msg+0x611/0x7a0 [ 2954.899299][T29150] ? genl_bind+0x360/0x360 [ 2954.903721][T29150] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2954.910055][T29150] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2954.916663][T29150] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2954.923274][T29150] netlink_rcv_skb+0x235/0x4c0 [ 2954.928074][T29150] ? genl_bind+0x360/0x360 [ 2954.932519][T29150] ? netlink_ack+0x1160/0x1160 [ 2954.937303][T29150] ? __lock_acquire+0x7eb0/0x7eb0 [ 2954.942332][T29150] ? net_generic+0x1e/0x240 [ 2954.946855][T29150] ? down_read+0x1ac/0x2e0 [ 2954.951279][T29150] genl_rcv+0x28/0x40 [ 2954.955264][T29150] netlink_unicast+0x7b1/0x930 [ 2954.960048][T29150] netlink_sendmsg+0x8d0/0xbf0 [ 2954.964842][T29150] ? netlink_getsockopt+0x590/0x590 [ 2954.970047][T29150] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2954.975606][T29150] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2954.980896][T29150] ? security_socket_sendmsg+0x80/0xa0 [ 2954.986363][T29150] ? netlink_getsockopt+0x590/0x590 [ 2954.991579][T29150] ____sys_sendmsg+0x61b/0x980 [ 2954.996350][T29150] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2955.002519][T29150] ? __asan_memset+0x22/0x40 [ 2955.007115][T29150] ? __sys_sendmsg_sock+0x30/0x30 [ 2955.012137][T29150] ? __import_iovec+0x5f2/0x850 [ 2955.017004][T29150] ? import_iovec+0x73/0xa0 [ 2955.021517][T29150] ___sys_sendmsg+0x2a6/0x360 [ 2955.026208][T29150] ? __sys_sendmsg+0x2b0/0x2b0 [ 2955.031046][T29150] __se_sys_sendmsg+0x1d0/0x2c0 [ 2955.035908][T29150] ? __x64_sys_sendmsg+0x80/0x80 [ 2955.040877][T29150] ? lockdep_hardirqs_on+0x98/0x150 [ 2955.046082][T29150] do_syscall_64+0x55/0xb0 [ 2955.050504][T29150] ? clear_bhb_loop+0x40/0x90 [ 2955.055184][T29150] ? clear_bhb_loop+0x40/0x90 [ 2955.059864][T29150] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2955.065759][T29150] RIP: 0033:0x7f3f64b9f559 [ 2955.070177][T29150] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2955.089808][T29150] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2955.098230][T29150] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2955.106204][T29150] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2955.114176][T29150] RBP: 00007f3f64c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2955.122148][T29150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2955.130116][T29150] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2955.138114][T29150] [ 2955.371212][T29161] netlink: 'syz.1.18270': attribute type 39 has an invalid length. [ 2955.419940][T29168] netlink: 'syz.3.18273': attribute type 21 has an invalid length. [ 2955.487536][T29172] netlink: 12 bytes leftover after parsing attributes in process `syz.1.18274'. [ 2955.638547][T29173] netlink: 132 bytes leftover after parsing attributes in process `syz.2.18272'. [ 2956.119591][T29188] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18280'. [ 2956.174795][T29188] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2956.184797][T29188] CPU: 0 PID: 29188 Comm: syz.1.18280 Not tainted syzkaller #0 [ 2956.192407][T29188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2956.202496][T29188] Call Trace: [ 2956.205800][T29188] [ 2956.208772][T29188] dump_stack_lvl+0x18c/0x250 [ 2956.213508][T29188] ? show_regs_print_info+0x20/0x20 [ 2956.218738][T29188] ? load_image+0x420/0x420 [ 2956.223306][T29188] sysfs_warn_dup+0x8e/0xa0 [ 2956.227867][T29188] sysfs_do_create_link_sd+0xc0/0x110 [ 2956.233297][T29188] device_add_class_symlinks+0x1cf/0x240 [ 2956.238972][T29188] device_add+0x4f9/0xc40 [ 2956.243342][T29188] wiphy_register+0x1f24/0x2c70 [ 2956.248270][T29188] ? cfg80211_event_work+0x40/0x40 [ 2956.253408][T29188] ? minstrel_ht_alloc+0x88a/0x990 [ 2956.258569][T29188] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2956.264675][T29188] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2956.270204][T29188] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2956.275802][T29188] ? ieee80211_tasklet_handler+0x20/0x20 [ 2956.281560][T29188] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2956.287496][T29188] ? __debug_object_init+0xec/0x450 [ 2956.292733][T29188] ? __asan_memset+0x22/0x40 [ 2956.297360][T29188] ? __hrtimer_init+0x189/0x270 [ 2956.302248][T29188] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2956.308053][T29188] ? mac80211_hwsim_free+0x220/0x220 [ 2956.313366][T29188] ? rcu_is_watching+0x15/0xb0 [ 2956.318166][T29188] ? kstrndup+0xbd/0x140 [ 2956.322484][T29188] hwsim_new_radio_nl+0xdad/0x1a70 [ 2956.327646][T29188] ? mark_lock+0x94/0x320 [ 2956.332023][T29188] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2956.338390][T29188] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2956.344579][T29188] ? lockdep_hardirqs_on+0x98/0x150 [ 2956.349810][T29188] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2956.356040][T29188] genl_family_rcv_msg_doit+0x21a/0x310 [ 2956.361632][T29188] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2956.367579][T29188] ? bpf_lsm_capable+0x9/0x10 [ 2956.372279][T29188] ? security_capable+0x89/0xb0 [ 2956.377174][T29188] genl_rcv_msg+0x611/0x7a0 [ 2956.381722][T29188] ? genl_bind+0x360/0x360 [ 2956.386170][T29188] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2956.392530][T29188] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2956.399143][T29188] ? perf_trace_lock+0xfc/0x3b0 [ 2956.404043][T29188] netlink_rcv_skb+0x235/0x4c0 [ 2956.408849][T29188] ? genl_bind+0x360/0x360 [ 2956.413302][T29188] ? netlink_ack+0x1160/0x1160 [ 2956.418128][T29188] ? __lock_acquire+0x7eb0/0x7eb0 [ 2956.423205][T29188] ? down_read+0x1ac/0x2e0 [ 2956.427653][T29188] genl_rcv+0x28/0x40 [ 2956.431664][T29188] netlink_unicast+0x7b1/0x930 [ 2956.436488][T29188] netlink_sendmsg+0x8d0/0xbf0 [ 2956.441304][T29188] ? netlink_getsockopt+0x590/0x590 [ 2956.446626][T29188] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2956.452211][T29188] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2956.457526][T29188] ? security_socket_sendmsg+0x80/0xa0 [ 2956.463014][T29188] ? netlink_getsockopt+0x590/0x590 [ 2956.468248][T29188] ____sys_sendmsg+0x61b/0x980 [ 2956.473062][T29188] ? __asan_memset+0x22/0x40 [ 2956.477689][T29188] ? __sys_sendmsg_sock+0x30/0x30 [ 2956.482740][T29188] ? __import_iovec+0x5f2/0x850 [ 2956.487642][T29188] ? import_iovec+0x73/0xa0 [ 2956.492273][T29188] ___sys_sendmsg+0x2a6/0x360 [ 2956.496993][T29188] ? __sys_sendmsg+0x2b0/0x2b0 [ 2956.501846][T29188] ? ktime_get+0x7f/0x280 [ 2956.506190][T29188] ? trace_call_bpf+0xc3/0x6c0 [ 2956.511045][T29188] __se_sys_sendmsg+0x1d0/0x2c0 [ 2956.515969][T29188] ? __x64_sys_sendmsg+0x80/0x80 [ 2956.520980][T29188] ? lockdep_hardirqs_on+0x98/0x150 [ 2956.526220][T29188] do_syscall_64+0x55/0xb0 [ 2956.530683][T29188] ? clear_bhb_loop+0x40/0x90 [ 2956.535396][T29188] ? clear_bhb_loop+0x40/0x90 [ 2956.540092][T29188] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2956.546015][T29188] RIP: 0033:0x7f872219f559 [ 2956.550497][T29188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2956.570148][T29188] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2956.578612][T29188] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2956.586609][T29188] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2956.594604][T29188] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2956.602597][T29188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2956.610581][T29188] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2956.618618][T29188] [ 2956.700598][T29190] netlink: 'syz.3.18282': attribute type 39 has an invalid length. [ 2956.813256][T29195] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.18284'. [ 2956.872923][T29195] netlink: 'syz.1.18284': attribute type 10 has an invalid length. [ 2956.892158][T29197] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.18283'. [ 2957.012802][T29197] netlink: 'syz.2.18283': attribute type 10 has an invalid length. [ 2957.430452][T29208] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18289'. [ 2957.889071][T29224] netlink: 'syz.3.18294': attribute type 39 has an invalid length. [ 2958.364673][T29238] netlink: 'syz.3.18299': attribute type 10 has an invalid length. [ 2959.039641][T29244] __nla_validate_parse: 1 callbacks suppressed [ 2959.039662][T29244] netlink: 132 bytes leftover after parsing attributes in process `syz.2.18302'. [ 2959.125201][T29251] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.18303'. [ 2959.172743][ T1287] ieee802154 phy0 wpan0: encryption failed: -22 [ 2959.179337][ T1287] ieee802154 phy1 wpan1: encryption failed: -22 [ 2960.202575][T29278] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.18312'. [ 2960.228516][T29276] netlink: 129384 bytes leftover after parsing attributes in process `syz.1.18313'. [ 2960.316534][T29278] netlink: 'syz.0.18312': attribute type 10 has an invalid length. [ 2960.329644][T29276] netlink: 'syz.1.18313': attribute type 10 has an invalid length. [ 2960.377181][T29281] netlink: 'syz.3.18314': attribute type 1 has an invalid length. [ 2960.389856][T29281] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.18314'. [ 2960.409194][T29281] netlink: 'syz.3.18314': attribute type 1 has an invalid length. [ 2960.464849][T29284] netlink: 'syz.3.18314': attribute type 1 has an invalid length. [ 2960.473720][T29284] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.18314'. [ 2960.483667][T29284] netlink: 'syz.3.18314': attribute type 1 has an invalid length. [ 2960.536315][T29287] netlink: 'syz.0.18316': attribute type 21 has an invalid length. [ 2960.763811][T29300] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.18321'. [ 2960.862456][T29300] netlink: 'syz.0.18321': attribute type 10 has an invalid length. [ 2961.413939][T29318] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.18324'. [ 2961.502995][T29316] netlink: 'syz.0.18325': attribute type 10 has an invalid length. [ 2961.548114][T29316] netlink: 40 bytes leftover after parsing attributes in process `syz.0.18325'. [ 2961.580837][T29316] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 2961.662918][T29318] netlink: 'syz.2.18324': attribute type 10 has an invalid length. [ 2961.680847][T29325] FAULT_INJECTION: forcing a failure. [ 2961.680847][T29325] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2961.724118][T29325] CPU: 1 PID: 29325 Comm: syz.3.18326 Not tainted syzkaller #0 [ 2961.731725][T29325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2961.741808][T29325] Call Trace: [ 2961.745108][T29325] [ 2961.748060][T29325] dump_stack_lvl+0x18c/0x250 [ 2961.752777][T29325] ? show_regs_print_info+0x20/0x20 [ 2961.757999][T29325] ? load_image+0x420/0x420 [ 2961.762524][T29325] ? __might_fault+0xaa/0x120 [ 2961.767217][T29325] ? __lock_acquire+0x7eb0/0x7eb0 [ 2961.772271][T29325] should_fail_ex+0x394/0x4c0 [ 2961.776972][T29325] _copy_to_user+0x2f/0xa0 [ 2961.781411][T29325] bpf_test_finish+0x4e7/0x650 [ 2961.786202][T29325] ? bpf_test_run+0x174/0x870 [ 2961.790899][T29325] ? convert_skb_to___skb+0x420/0x420 [ 2961.796315][T29325] bpf_prog_test_run_skb+0x1135/0x18f0 [ 2961.801819][T29325] ? cpu_online+0x60/0x60 [ 2961.806166][T29325] bpf_prog_test_run+0x31f/0x390 [ 2961.811124][T29325] __sys_bpf+0x49d/0x890 [ 2961.815383][T29325] ? bpf_link_show_fdinfo+0x560/0x560 [ 2961.820805][T29325] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2961.827001][T29325] __x64_sys_bpf+0x7c/0x90 [ 2961.831433][T29325] do_syscall_64+0x55/0xb0 [ 2961.835870][T29325] ? clear_bhb_loop+0x40/0x90 [ 2961.840566][T29325] ? clear_bhb_loop+0x40/0x90 [ 2961.845264][T29325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2961.851173][T29325] RIP: 0033:0x7f041fd9f559 [ 2961.855608][T29325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2961.875232][T29325] RSP: 002b:00007f0420d5b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2961.883674][T29325] RAX: ffffffffffffffda RBX: 00007f0420025fa0 RCX: 00007f041fd9f559 [ 2961.891657][T29325] RDX: 0000000000000050 RSI: 0000200000000a80 RDI: 000000000000000a [ 2961.899641][T29325] RBP: 00007f0420d5b090 R08: 0000000000000000 R09: 0000000000000000 [ 2961.907625][T29325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2961.915610][T29325] R13: 00007f0420026038 R14: 00007f0420025fa0 R15: 00007ffef0fc8458 [ 2961.923624][T29325] [ 2962.112844][T29329] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.18327'. [ 2963.604328][T29371] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2963.635101][T29371] CPU: 1 PID: 29371 Comm: syz.2.18345 Not tainted syzkaller #0 [ 2963.642782][T29371] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2963.652908][T29371] Call Trace: [ 2963.656341][T29371] [ 2963.659354][T29371] dump_stack_lvl+0x18c/0x250 [ 2963.664152][T29371] ? show_regs_print_info+0x20/0x20 [ 2963.669438][T29371] ? load_image+0x420/0x420 [ 2963.674092][T29371] sysfs_warn_dup+0x8e/0xa0 [ 2963.678685][T29371] sysfs_do_create_link_sd+0xc0/0x110 [ 2963.684151][T29371] device_add_class_symlinks+0x1cf/0x240 [ 2963.689875][T29371] device_add+0x4f9/0xc40 [ 2963.694295][T29371] wiphy_register+0x1f24/0x2c70 [ 2963.699323][T29371] ? cfg80211_event_work+0x40/0x40 [ 2963.704519][T29371] ? minstrel_ht_alloc+0x88a/0x990 [ 2963.709753][T29371] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2963.715911][T29371] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2963.721515][T29371] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2963.727184][T29371] ? ieee80211_tasklet_handler+0x20/0x20 [ 2963.732898][T29371] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2963.738881][T29371] ? __debug_object_init+0xec/0x450 [ 2963.744177][T29371] ? __asan_memset+0x22/0x40 [ 2963.748840][T29371] ? __hrtimer_init+0x189/0x270 [ 2963.753783][T29371] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2963.759692][T29371] ? mac80211_hwsim_free+0x220/0x220 [ 2963.765038][T29371] ? rcu_is_watching+0x15/0xb0 [ 2963.769876][T29371] ? kstrndup+0xbd/0x140 [ 2963.774251][T29371] hwsim_new_radio_nl+0xdad/0x1a70 [ 2963.779468][T29371] ? __nla_validate+0x50/0x50 [ 2963.784378][T29371] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2963.790874][T29371] ? __nla_parse+0x40/0x50 [ 2963.795414][T29371] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2963.801865][T29371] genl_family_rcv_msg_doit+0x21a/0x310 [ 2963.807525][T29371] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2963.813544][T29371] ? bpf_lsm_capable+0x9/0x10 [ 2963.818283][T29371] ? security_capable+0x89/0xb0 [ 2963.823246][T29371] genl_rcv_msg+0x611/0x7a0 [ 2963.827858][T29371] ? genl_bind+0x360/0x360 [ 2963.832347][T29371] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2963.838754][T29371] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2963.845468][T29371] netlink_rcv_skb+0x235/0x4c0 [ 2963.850326][T29371] ? genl_bind+0x360/0x360 [ 2963.854843][T29371] ? netlink_ack+0x1160/0x1160 [ 2963.859735][T29371] ? __lock_acquire+0x7eb0/0x7eb0 [ 2963.864865][T29371] ? down_read+0x1ac/0x2e0 [ 2963.869372][T29371] genl_rcv+0x28/0x40 [ 2963.873428][T29371] netlink_unicast+0x7b1/0x930 [ 2963.878328][T29371] netlink_sendmsg+0x8d0/0xbf0 [ 2963.883214][T29371] ? netlink_getsockopt+0x590/0x590 [ 2963.888500][T29371] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2963.894149][T29371] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2963.899501][T29371] ? security_socket_sendmsg+0x80/0xa0 [ 2963.905019][T29371] ? netlink_getsockopt+0x590/0x590 [ 2963.910293][T29371] ____sys_sendmsg+0x61b/0x980 [ 2963.915174][T29371] ? __asan_memset+0x22/0x40 [ 2963.919839][T29371] ? __sys_sendmsg_sock+0x30/0x30 [ 2963.924922][T29371] ? __import_iovec+0x5f2/0x850 [ 2963.929888][T29371] ? import_iovec+0x73/0xa0 [ 2963.934496][T29371] ___sys_sendmsg+0x2a6/0x360 [ 2963.939273][T29371] ? __sys_sendmsg+0x2b0/0x2b0 [ 2963.944406][T29371] __se_sys_sendmsg+0x1d0/0x2c0 [ 2963.949343][T29371] ? __x64_sys_sendmsg+0x80/0x80 [ 2963.954443][T29371] ? lockdep_hardirqs_on+0x98/0x150 [ 2963.959736][T29371] do_syscall_64+0x55/0xb0 [ 2963.964217][T29371] ? clear_bhb_loop+0x40/0x90 [ 2963.968954][T29371] ? clear_bhb_loop+0x40/0x90 [ 2963.973712][T29371] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2963.979671][T29371] RIP: 0033:0x7feb6359f559 [ 2963.984157][T29371] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2964.003836][T29371] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2964.012333][T29371] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2964.020363][T29371] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2964.028390][T29371] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2964.036419][T29371] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2964.044444][T29371] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2964.052564][T29371] [ 2964.650836][T29384] __nla_validate_parse: 4 callbacks suppressed [ 2964.650855][T29384] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.18349'. [ 2965.071862][T29397] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18354'. [ 2965.449157][T29405] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18358'. [ 2965.509229][T29405] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2965.517583][T29405] CPU: 0 PID: 29405 Comm: syz.1.18358 Not tainted syzkaller #0 [ 2965.525174][T29405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2965.535254][T29405] Call Trace: [ 2965.538560][T29405] [ 2965.541523][T29405] dump_stack_lvl+0x18c/0x250 [ 2965.546238][T29405] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2965.552435][T29405] ? show_regs_print_info+0x20/0x20 [ 2965.557685][T29405] ? load_image+0x420/0x420 [ 2965.562231][T29405] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2965.568337][T29405] sysfs_warn_dup+0x8e/0xa0 [ 2965.572873][T29405] sysfs_do_create_link_sd+0xc0/0x110 [ 2965.578278][T29405] device_add_class_symlinks+0x1cf/0x240 [ 2965.583956][T29405] device_add+0x4f9/0xc40 [ 2965.588327][T29405] wiphy_register+0x1f24/0x2c70 [ 2965.593244][T29405] ? cfg80211_event_work+0x40/0x40 [ 2965.598414][T29405] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2965.604512][T29405] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2965.609998][T29405] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2965.615556][T29405] ? ieee80211_tasklet_handler+0x20/0x20 [ 2965.621297][T29405] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2965.627202][T29405] ? __debug_object_init+0xec/0x450 [ 2965.632406][T29405] ? __asan_memset+0x22/0x40 [ 2965.637001][T29405] ? __hrtimer_init+0x189/0x270 [ 2965.641856][T29405] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2965.647600][T29405] ? mac80211_hwsim_free+0x220/0x220 [ 2965.652972][T29405] ? rcu_is_watching+0x15/0xb0 [ 2965.657739][T29405] ? kstrndup+0xbd/0x140 [ 2965.661991][T29405] hwsim_new_radio_nl+0xdad/0x1a70 [ 2965.667107][T29405] ? __nla_validate+0x50/0x50 [ 2965.671805][T29405] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2965.678142][T29405] ? __nla_parse+0x40/0x50 [ 2965.682559][T29405] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2965.688901][T29405] genl_family_rcv_msg_doit+0x21a/0x310 [ 2965.694455][T29405] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2965.700362][T29405] ? bpf_lsm_capable+0x9/0x10 [ 2965.705037][T29405] ? security_capable+0x89/0xb0 [ 2965.709899][T29405] genl_rcv_msg+0x611/0x7a0 [ 2965.714408][T29405] ? genl_bind+0x360/0x360 [ 2965.718821][T29405] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2965.725158][T29405] netlink_rcv_skb+0x235/0x4c0 [ 2965.729930][T29405] ? genl_bind+0x360/0x360 [ 2965.734347][T29405] ? netlink_ack+0x1160/0x1160 [ 2965.739138][T29405] ? __lock_acquire+0x7eb0/0x7eb0 [ 2965.744180][T29405] ? down_read+0x1ac/0x2e0 [ 2965.748607][T29405] genl_rcv+0x28/0x40 [ 2965.752595][T29405] netlink_unicast+0x7b1/0x930 [ 2965.757367][T29405] netlink_sendmsg+0x8d0/0xbf0 [ 2965.762138][T29405] ? netlink_getsockopt+0x590/0x590 [ 2965.767347][T29405] ? netlink_getsockopt+0x590/0x590 [ 2965.772546][T29405] ____sys_sendmsg+0x61b/0x980 [ 2965.777318][T29405] ? __asan_memset+0x22/0x40 [ 2965.781909][T29405] ? __sys_sendmsg_sock+0x30/0x30 [ 2965.786928][T29405] ? __import_iovec+0x5f2/0x850 [ 2965.791787][T29405] ? import_iovec+0x73/0xa0 [ 2965.796292][T29405] ___sys_sendmsg+0x2a6/0x360 [ 2965.800970][T29405] ? __sys_sendmsg+0x2b0/0x2b0 [ 2965.805780][T29405] __se_sys_sendmsg+0x1d0/0x2c0 [ 2965.810640][T29405] ? __x64_sys_sendmsg+0x80/0x80 [ 2965.815595][T29405] ? lockdep_hardirqs_on+0x98/0x150 [ 2965.820797][T29405] do_syscall_64+0x55/0xb0 [ 2965.825219][T29405] ? clear_bhb_loop+0x40/0x90 [ 2965.829898][T29405] ? clear_bhb_loop+0x40/0x90 [ 2965.834603][T29405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2965.840529][T29405] RIP: 0033:0x7f872219f559 [ 2965.844954][T29405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2965.864566][T29405] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2965.872984][T29405] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2965.880955][T29405] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2965.888919][T29405] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2965.896889][T29405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2965.904859][T29405] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2965.912847][T29405] [ 2966.252190][T29426] validate_nla: 8 callbacks suppressed [ 2966.252228][T29426] netlink: 'syz.1.18365': attribute type 39 has an invalid length. [ 2966.359878][T29428] netlink: 132 bytes leftover after parsing attributes in process `syz.0.18366'. [ 2966.389719][T29430] netlink: 36 bytes leftover after parsing attributes in process `syz.3.18364'. [ 2966.409196][T29430] : renamed from caif0 [ 2966.429051][T29430] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 2966.800997][T29446] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.18371'. [ 2966.996328][T29448] netlink: 'syz.1.18372': attribute type 5 has an invalid length. [ 2967.005493][T29448] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.18372'. [ 2967.115705][T29452] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18374'. [ 2967.137341][T29452] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2967.158544][T29452] CPU: 1 PID: 29452 Comm: syz.1.18374 Not tainted syzkaller #0 [ 2967.166172][T29452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2967.176387][T29452] Call Trace: [ 2967.179691][T29452] [ 2967.182647][T29452] dump_stack_lvl+0x18c/0x250 [ 2967.187374][T29452] ? show_regs_print_info+0x20/0x20 [ 2967.192608][T29452] ? load_image+0x420/0x420 [ 2967.197181][T29452] sysfs_warn_dup+0x8e/0xa0 [ 2967.201713][T29452] sysfs_do_create_link_sd+0xc0/0x110 [ 2967.207117][T29452] device_add_class_symlinks+0x1cf/0x240 [ 2967.212791][T29452] device_add+0x4f9/0xc40 [ 2967.217158][T29452] wiphy_register+0x1f24/0x2c70 [ 2967.222089][T29452] ? cfg80211_event_work+0x40/0x40 [ 2967.227232][T29452] ? minstrel_ht_alloc+0x88a/0x990 [ 2967.232420][T29452] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2967.238527][T29452] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2967.244045][T29452] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2967.249639][T29452] ? ieee80211_tasklet_handler+0x20/0x20 [ 2967.255476][T29452] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2967.261412][T29452] ? __debug_object_init+0xec/0x450 [ 2967.266650][T29452] ? __asan_memset+0x22/0x40 [ 2967.271280][T29452] ? __hrtimer_init+0x189/0x270 [ 2967.276172][T29452] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2967.281971][T29452] ? mac80211_hwsim_free+0x220/0x220 [ 2967.287279][T29452] ? rcu_is_watching+0x15/0xb0 [ 2967.292073][T29452] ? kstrndup+0xbd/0x140 [ 2967.296367][T29452] hwsim_new_radio_nl+0xdad/0x1a70 [ 2967.301516][T29452] ? __nla_validate+0x50/0x50 [ 2967.306252][T29452] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2967.312639][T29452] ? __nla_parse+0x40/0x50 [ 2967.317098][T29452] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2967.323473][T29452] genl_family_rcv_msg_doit+0x21a/0x310 [ 2967.329069][T29452] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2967.335009][T29452] ? bpf_lsm_capable+0x9/0x10 [ 2967.339714][T29452] ? security_capable+0x89/0xb0 [ 2967.344611][T29452] genl_rcv_msg+0x611/0x7a0 [ 2967.349161][T29452] ? genl_bind+0x360/0x360 [ 2967.353604][T29452] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2967.359974][T29452] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2967.366619][T29452] netlink_rcv_skb+0x235/0x4c0 [ 2967.371418][T29452] ? genl_bind+0x360/0x360 [ 2967.375868][T29452] ? netlink_ack+0x1160/0x1160 [ 2967.380694][T29452] ? __lock_acquire+0x7eb0/0x7eb0 [ 2967.385768][T29452] ? down_read+0x1ac/0x2e0 [ 2967.390220][T29452] genl_rcv+0x28/0x40 [ 2967.394231][T29452] netlink_unicast+0x7b1/0x930 [ 2967.399064][T29452] netlink_sendmsg+0x8d0/0xbf0 [ 2967.403885][T29452] ? netlink_getsockopt+0x590/0x590 [ 2967.409128][T29452] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2967.414714][T29452] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2967.420030][T29452] ? security_socket_sendmsg+0x80/0xa0 [ 2967.425521][T29452] ? netlink_getsockopt+0x590/0x590 [ 2967.430753][T29452] ____sys_sendmsg+0x61b/0x980 [ 2967.435578][T29452] ? __asan_memset+0x22/0x40 [ 2967.440218][T29452] ? __sys_sendmsg_sock+0x30/0x30 [ 2967.445278][T29452] ? __import_iovec+0x5f2/0x850 [ 2967.450186][T29452] ? import_iovec+0x73/0xa0 [ 2967.454737][T29452] ___sys_sendmsg+0x2a6/0x360 [ 2967.459464][T29452] ? __sys_sendmsg+0x2b0/0x2b0 [ 2967.464375][T29452] __se_sys_sendmsg+0x1d0/0x2c0 [ 2967.469271][T29452] ? __x64_sys_sendmsg+0x80/0x80 [ 2967.474293][T29452] ? lockdep_hardirqs_on+0x98/0x150 [ 2967.479532][T29452] do_syscall_64+0x55/0xb0 [ 2967.483975][T29452] ? clear_bhb_loop+0x40/0x90 [ 2967.488680][T29452] ? clear_bhb_loop+0x40/0x90 [ 2967.493397][T29452] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2967.499330][T29452] RIP: 0033:0x7f872219f559 [ 2967.503774][T29452] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2967.523418][T29452] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2967.531864][T29452] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2967.539866][T29452] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2967.547866][T29452] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2967.555862][T29452] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2967.563866][T29452] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2967.571900][T29452] [ 2967.822403][T29450] netlink: 'syz.2.18373': attribute type 22 has an invalid length. [ 2967.843403][T29450] netlink: 4 bytes leftover after parsing attributes in process `syz.2.18373'. [ 2967.936709][T29459] netlink: 'syz.0.18376': attribute type 39 has an invalid length. [ 2968.373892][T29474] netlink: 36 bytes leftover after parsing attributes in process `syz.2.18380'. [ 2968.393344][T29474] : renamed from caif0 [ 2968.428934][T29474] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 2968.756731][T29484] netlink: 'syz.2.18385': attribute type 21 has an invalid length. [ 2968.951436][T29493] netlink: 'syz.1.18387': attribute type 39 has an invalid length. [ 2970.257899][T29515] netlink: 36 bytes leftover after parsing attributes in process `syz.0.18395'. [ 2970.276349][T29515] : renamed from caif0 [ 2970.461922][T29515] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 2970.487656][T29520] netlink: 'syz.1.18397': attribute type 21 has an invalid length. [ 2970.511789][T29518] netlink: 'syz.2.18398': attribute type 39 has an invalid length. [ 2970.848921][T29537] netlink: 4 bytes leftover after parsing attributes in process `syz.3.18404'. [ 2970.869543][T29540] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18405'. [ 2970.878952][T29540] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18405'. [ 2971.007111][T29547] FAULT_INJECTION: forcing a failure. [ 2971.007111][T29547] name failslab, interval 1, probability 0, space 0, times 0 [ 2971.046063][T29547] CPU: 0 PID: 29547 Comm: syz.0.18407 Not tainted syzkaller #0 [ 2971.053694][T29547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2971.063790][T29547] Call Trace: [ 2971.067100][T29547] [ 2971.070071][T29547] dump_stack_lvl+0x18c/0x250 [ 2971.074810][T29547] ? show_regs_print_info+0x20/0x20 [ 2971.080064][T29547] ? load_image+0x420/0x420 [ 2971.084630][T29547] ? __might_sleep+0xe0/0xe0 [ 2971.089281][T29547] ? __lock_acquire+0x7eb0/0x7eb0 [ 2971.094379][T29547] should_fail_ex+0x394/0x4c0 [ 2971.099123][T29547] should_failslab+0x9/0x20 [ 2971.103666][T29547] slab_pre_alloc_hook+0x59/0x300 [ 2971.108736][T29547] ? aa_path_link+0xf80/0xf80 [ 2971.113474][T29547] kmem_cache_alloc_node+0x5e/0x320 [ 2971.118743][T29547] ? __alloc_skb+0x103/0x2c0 [ 2971.123499][T29547] __alloc_skb+0x103/0x2c0 [ 2971.127981][T29547] ppp_write+0xb4/0x3e0 [ 2971.132178][T29547] ? vfs_write+0x283/0x9a0 [ 2971.136642][T29547] ? ppp_read+0x860/0x860 [ 2971.141025][T29547] vfs_write+0x299/0x9a0 [ 2971.145357][T29547] ? file_end_write+0x250/0x250 [ 2971.151051][T29547] ? __fget_files+0x28/0x460 [ 2971.155693][T29547] ? __fget_files+0x3fc/0x460 [ 2971.160441][T29547] ? __fdget_pos+0x1d8/0x330 [ 2971.165077][T29547] ? ksys_write+0x74/0x260 [ 2971.169553][T29547] ksys_write+0x151/0x260 [ 2971.173935][T29547] ? __ia32_sys_read+0x90/0x90 [ 2971.178803][T29547] ? lockdep_hardirqs_on+0x98/0x150 [ 2971.184059][T29547] do_syscall_64+0x55/0xb0 [ 2971.188519][T29547] ? clear_bhb_loop+0x40/0x90 [ 2971.193240][T29547] ? clear_bhb_loop+0x40/0x90 [ 2971.197959][T29547] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2971.203892][T29547] RIP: 0033:0x7f3f64b9f559 [ 2971.208343][T29547] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2971.227990][T29547] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2971.236452][T29547] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2971.244459][T29547] RDX: 000000000000000a RSI: 0000200000000080 RDI: 0000000000000005 [ 2971.252475][T29547] RBP: 00007f3f62df6090 R08: 0000000000000000 R09: 0000000000000000 [ 2971.260492][T29547] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2971.268506][T29547] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2971.276571][T29547] [ 2971.455258][T29553] netlink: 'syz.2.18409': attribute type 39 has an invalid length. [ 2971.719260][T29566] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18414'. [ 2971.738891][T29566] netlink: 60 bytes leftover after parsing attributes in process `syz.2.18414'. [ 2971.874799][T29570] FAULT_INJECTION: forcing a failure. [ 2971.874799][T29570] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 2971.908962][T29570] CPU: 1 PID: 29570 Comm: syz.0.18416 Not tainted syzkaller #0 [ 2971.916581][T29570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2971.926665][T29570] Call Trace: [ 2971.929975][T29570] [ 2971.932937][T29570] dump_stack_lvl+0x18c/0x250 [ 2971.937664][T29570] ? show_regs_print_info+0x20/0x20 [ 2971.942897][T29570] ? load_image+0x420/0x420 [ 2971.947436][T29570] ? __lock_acquire+0x7eb0/0x7eb0 [ 2971.952495][T29570] should_fail_ex+0x394/0x4c0 [ 2971.957211][T29570] prepare_alloc_pages+0x1e1/0x5b0 [ 2971.962350][T29570] __alloc_pages+0x134/0x460 [ 2971.966934][T29570] ? zone_statistics+0x170/0x170 [ 2971.971901][T29570] __pmd_alloc+0x9a/0x8c0 [ 2971.976262][T29570] ? __rwlock_init+0x150/0x150 [ 2971.979134][T29575] netlink: 36 bytes leftover after parsing attributes in process `syz.1.18415'. [ 2971.981035][T29570] ? __pud_alloc+0x200/0x200 [ 2971.994645][T29570] ? do_raw_spin_unlock+0x121/0x230 [ 2971.999880][T29570] ? hugepage_vma_check+0x1e4/0x7f0 [ 2972.005098][T29570] handle_mm_fault+0xb72/0x4a40 [ 2972.009963][T29570] ? handle_mm_fault+0xe6/0x4a40 [ 2972.014907][T29570] ? numa_migrate_prep+0x350/0x350 [ 2972.020030][T29570] ? lock_chain_count+0x20/0x20 [ 2972.024902][T29570] ? perf_trace_lock+0xfc/0x3b0 [ 2972.029778][T29570] ? lock_mm_and_find_vma+0x9c/0x2f0 [ 2972.035060][T29570] do_user_addr_fault+0x736/0x12d0 [ 2972.040184][T29570] exc_page_fault+0x64/0x100 [ 2972.044776][T29570] asm_exc_page_fault+0x26/0x30 [ 2972.049626][T29570] RIP: 0010:__put_user_4+0x11/0x20 [ 2972.054732][T29570] Code: 01 ca c3 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb 66 89 01 31 c9 0f 01 ca c3 f3 0f 1e fa 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca c3 90 90 90 90 90 90 90 f3 0f 1e fa 0f 01 cb [ 2972.074335][T29570] RSP: 0018:ffffc90004917e80 EFLAGS: 00050206 [ 2972.080401][T29570] RAX: 0000000000000004 RBX: 0000000000000000 RCX: 0000200000000700 [ 2972.088366][T29570] RDX: 0000000000000000 RSI: ffffffff8acae2c0 RDI: ffffffff8b1c5060 [ 2972.096352][T29570] RBP: 0000000000000004 R08: ffffffff8f6bc82f R09: 1ffffffff1ed7905 [ 2972.104317][T29570] R10: dffffc0000000000 R11: fffffbfff1ed7906 R12: 0000000000000000 [ 2972.112301][T29570] R13: 0000200000000700 R14: 0000000000000010 R15: 0000000000000002 [ 2972.120291][T29570] __sys_socketpair+0xb8/0x550 [ 2972.125071][T29570] __x64_sys_socketpair+0x9b/0xb0 [ 2972.130095][T29570] do_syscall_64+0x55/0xb0 [ 2972.134514][T29570] ? clear_bhb_loop+0x40/0x90 [ 2972.139190][T29570] ? clear_bhb_loop+0x40/0x90 [ 2972.143890][T29570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2972.149960][T29570] RIP: 0033:0x7f3f64b9f559 [ 2972.154371][T29570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2972.173974][T29570] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 2972.182383][T29570] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2972.190349][T29570] RDX: 000000000000000b RSI: 0000000000000002 RDI: 0000000000000010 [ 2972.198312][T29570] RBP: 00007f3f62df6090 R08: 0000000000000000 R09: 0000000000000000 [ 2972.206297][T29570] R10: 0000200000000700 R11: 0000000000000246 R12: 0000000000000001 [ 2972.214286][T29570] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2972.222269][T29570] [ 2972.225502][T29575] : renamed from caif0 [ 2972.237071][T29575] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 2972.441732][T29578] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18418'. [ 2972.477943][T29578] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2972.507400][T29578] CPU: 0 PID: 29578 Comm: syz.2.18418 Not tainted syzkaller #0 [ 2972.515043][T29578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2972.525136][T29578] Call Trace: [ 2972.528454][T29578] [ 2972.531422][T29578] dump_stack_lvl+0x18c/0x250 [ 2972.536161][T29578] ? show_regs_print_info+0x20/0x20 [ 2972.541410][T29578] ? load_image+0x420/0x420 [ 2972.545992][T29578] sysfs_warn_dup+0x8e/0xa0 [ 2972.550541][T29578] sysfs_do_create_link_sd+0xc0/0x110 [ 2972.555963][T29578] device_add_class_symlinks+0x1cf/0x240 [ 2972.561647][T29578] device_add+0x4f9/0xc40 [ 2972.566024][T29578] wiphy_register+0x1f24/0x2c70 [ 2972.570967][T29578] ? cfg80211_event_work+0x40/0x40 [ 2972.576124][T29578] ? minstrel_ht_alloc+0x88a/0x990 [ 2972.581299][T29578] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2972.587418][T29578] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2972.592949][T29578] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2972.598560][T29578] ? ieee80211_tasklet_handler+0x20/0x20 [ 2972.604251][T29578] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2972.610195][T29578] ? __debug_object_init+0xec/0x450 [ 2972.615455][T29578] ? __asan_memset+0x22/0x40 [ 2972.620094][T29578] ? __hrtimer_init+0x189/0x270 [ 2972.624994][T29578] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2972.630806][T29578] ? mac80211_hwsim_free+0x220/0x220 [ 2972.636128][T29578] ? rcu_is_watching+0x15/0xb0 [ 2972.640933][T29578] ? kstrndup+0xbd/0x140 [ 2972.645256][T29578] hwsim_new_radio_nl+0xdad/0x1a70 [ 2972.650430][T29578] ? mark_lock+0x94/0x320 [ 2972.654825][T29578] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2972.661200][T29578] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2972.667398][T29578] ? lockdep_hardirqs_on+0x98/0x150 [ 2972.672639][T29578] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2972.679479][T29578] genl_family_rcv_msg_doit+0x21a/0x310 [ 2972.685086][T29578] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2972.691048][T29578] ? bpf_lsm_capable+0x9/0x10 [ 2972.695758][T29578] ? security_capable+0x89/0xb0 [ 2972.700662][T29578] genl_rcv_msg+0x611/0x7a0 [ 2972.705221][T29578] ? genl_bind+0x360/0x360 [ 2972.709677][T29578] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2972.716048][T29578] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2972.722676][T29578] ? ref_tracker_free+0x686/0x830 [ 2972.727769][T29578] netlink_rcv_skb+0x235/0x4c0 [ 2972.732581][T29578] ? genl_bind+0x360/0x360 [ 2972.737048][T29578] ? netlink_ack+0x1160/0x1160 [ 2972.741878][T29578] ? __lock_acquire+0x7eb0/0x7eb0 [ 2972.746971][T29578] ? down_read+0x1ac/0x2e0 [ 2972.751432][T29578] genl_rcv+0x28/0x40 [ 2972.755450][T29578] netlink_unicast+0x7b1/0x930 [ 2972.760278][T29578] netlink_sendmsg+0x8d0/0xbf0 [ 2972.765099][T29578] ? lockdep_hardirqs_on+0x98/0x150 [ 2972.770386][T29578] ? netlink_getsockopt+0x590/0x590 [ 2972.775640][T29578] ? netlink_getsockopt+0x590/0x590 [ 2972.780924][T29578] ____sys_sendmsg+0x61b/0x980 [ 2972.785747][T29578] ? __asan_memset+0x22/0x40 [ 2972.790381][T29578] ? __sys_sendmsg_sock+0x30/0x30 [ 2972.795442][T29578] ? __import_iovec+0x5f2/0x850 [ 2972.800360][T29578] ? import_iovec+0x73/0xa0 [ 2972.804913][T29578] ___sys_sendmsg+0x2a6/0x360 [ 2972.809648][T29578] ? __sys_sendmsg+0x2b0/0x2b0 [ 2972.814561][T29578] __se_sys_sendmsg+0x1d0/0x2c0 [ 2972.819458][T29578] ? __x64_sys_sendmsg+0x80/0x80 [ 2972.824473][T29578] ? lockdep_hardirqs_on+0x98/0x150 [ 2972.829719][T29578] do_syscall_64+0x55/0xb0 [ 2972.834177][T29578] ? clear_bhb_loop+0x40/0x90 [ 2972.838891][T29578] ? clear_bhb_loop+0x40/0x90 [ 2972.843612][T29578] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2972.849547][T29578] RIP: 0033:0x7feb6359f559 [ 2972.853997][T29578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2972.873650][T29578] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2972.882119][T29578] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2972.890136][T29578] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2972.898148][T29578] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2972.906159][T29578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2972.914172][T29578] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2972.922303][T29578] [ 2972.951027][T29584] netlink: 'syz.3.18420': attribute type 39 has an invalid length. [ 2973.466158][T29601] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18426'. [ 2973.491720][T29601] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18426'. [ 2973.710506][T29603] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2973.739116][T29603] CPU: 0 PID: 29603 Comm: syz.3.18427 Not tainted syzkaller #0 [ 2973.746744][T29603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2973.756839][T29603] Call Trace: [ 2973.760152][T29603] [ 2973.763113][T29603] dump_stack_lvl+0x18c/0x250 [ 2973.767865][T29603] ? show_regs_print_info+0x20/0x20 [ 2973.773115][T29603] ? load_image+0x420/0x420 [ 2973.777686][T29603] sysfs_warn_dup+0x8e/0xa0 [ 2973.782407][T29603] sysfs_do_create_link_sd+0xc0/0x110 [ 2973.787826][T29603] device_add_class_symlinks+0x1cf/0x240 [ 2973.793510][T29603] device_add+0x4f9/0xc40 [ 2973.797889][T29603] wiphy_register+0x1f24/0x2c70 [ 2973.802807][T29603] ? cfg80211_event_work+0x40/0x40 [ 2973.807931][T29603] ? minstrel_ht_alloc+0x88a/0x990 [ 2973.813065][T29603] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2973.819154][T29603] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2973.824643][T29603] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2973.830211][T29603] ? ieee80211_tasklet_handler+0x20/0x20 [ 2973.835856][T29603] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2973.841766][T29603] ? __debug_object_init+0xec/0x450 [ 2973.846985][T29603] ? __asan_memset+0x22/0x40 [ 2973.851588][T29603] ? __hrtimer_init+0x189/0x270 [ 2973.856451][T29603] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2973.862210][T29603] ? mac80211_hwsim_free+0x220/0x220 [ 2973.867499][T29603] ? rcu_is_watching+0x15/0xb0 [ 2973.872276][T29603] ? kstrndup+0xbd/0x140 [ 2973.876540][T29603] hwsim_new_radio_nl+0xdad/0x1a70 [ 2973.881665][T29603] ? __nla_validate+0x50/0x50 [ 2973.886366][T29603] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2973.892717][T29603] ? __nla_parse+0x40/0x50 [ 2973.897145][T29603] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2973.903499][T29603] genl_family_rcv_msg_doit+0x21a/0x310 [ 2973.909062][T29603] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2973.914972][T29603] ? bpf_lsm_capable+0x9/0x10 [ 2973.919655][T29603] ? security_capable+0x89/0xb0 [ 2973.924519][T29603] genl_rcv_msg+0x611/0x7a0 [ 2973.929050][T29603] ? genl_bind+0x360/0x360 [ 2973.933471][T29603] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2973.939803][T29603] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2973.946421][T29603] ? ref_tracker_free+0x686/0x830 [ 2973.951479][T29603] netlink_rcv_skb+0x235/0x4c0 [ 2973.956268][T29603] ? genl_bind+0x360/0x360 [ 2973.960697][T29603] ? netlink_ack+0x1160/0x1160 [ 2973.965488][T29603] ? __lock_acquire+0x7eb0/0x7eb0 [ 2973.970534][T29603] ? down_read+0x1ac/0x2e0 [ 2973.974957][T29603] genl_rcv+0x28/0x40 [ 2973.978947][T29603] netlink_unicast+0x7b1/0x930 [ 2973.983760][T29603] netlink_sendmsg+0x8d0/0xbf0 [ 2973.988541][T29603] ? netlink_getsockopt+0x590/0x590 [ 2973.993748][T29603] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2973.999308][T29603] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2974.004598][T29603] ? security_socket_sendmsg+0x80/0xa0 [ 2974.010063][T29603] ? netlink_getsockopt+0x590/0x590 [ 2974.015278][T29603] ____sys_sendmsg+0x61b/0x980 [ 2974.020067][T29603] ? __asan_memset+0x22/0x40 [ 2974.024668][T29603] ? __sys_sendmsg_sock+0x30/0x30 [ 2974.029699][T29603] ? __import_iovec+0x5f2/0x850 [ 2974.034568][T29603] ? import_iovec+0x73/0xa0 [ 2974.039083][T29603] ___sys_sendmsg+0x2a6/0x360 [ 2974.043778][T29603] ? __sys_sendmsg+0x2b0/0x2b0 [ 2974.048619][T29603] __se_sys_sendmsg+0x1d0/0x2c0 [ 2974.053480][T29603] ? __x64_sys_sendmsg+0x80/0x80 [ 2974.058444][T29603] ? lockdep_hardirqs_on+0x98/0x150 [ 2974.063662][T29603] do_syscall_64+0x55/0xb0 [ 2974.068083][T29603] ? clear_bhb_loop+0x40/0x90 [ 2974.072772][T29603] ? clear_bhb_loop+0x40/0x90 [ 2974.077474][T29603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2974.083371][T29603] RIP: 0033:0x7f041fd9f559 [ 2974.087795][T29603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2974.107404][T29603] RSP: 002b:00007f0420d5b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2974.115822][T29603] RAX: ffffffffffffffda RBX: 00007f0420025fa0 RCX: 00007f041fd9f559 [ 2974.123796][T29603] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2974.131769][T29603] RBP: 00007f041fe36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2974.139742][T29603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2974.147713][T29603] R13: 00007f0420026038 R14: 00007f0420025fa0 R15: 00007ffef0fc8458 [ 2974.155715][T29603] [ 2974.270973][T29617] netlink: 'syz.1.18432': attribute type 39 has an invalid length. [ 2974.338957][T29621] netlink: 'syz.0.18434': attribute type 21 has an invalid length. [ 2974.354338][T29621] netlink: 'syz.0.18434': attribute type 4 has an invalid length. [ 2974.391550][T29621] netlink: 'syz.0.18434': attribute type 5 has an invalid length. [ 2975.070840][T29634] syzkaller0: entered promiscuous mode [ 2975.082264][T29635] netlink: 'syz.3.18440': attribute type 3 has an invalid length. [ 2977.738820][T29649] netlink: 'syz.0.18445': attribute type 39 has an invalid length. [ 2977.849563][T29654] __nla_validate_parse: 7 callbacks suppressed [ 2977.849581][T29654] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18448'. [ 2977.866848][T29654] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18448'. [ 2977.877575][T29654] netlink: 60 bytes leftover after parsing attributes in process `syz.3.18448'. [ 2978.001409][T29656] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.18447'. [ 2978.074298][T29656] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2978.139801][T29656] CPU: 0 PID: 29656 Comm: syz.0.18447 Not tainted syzkaller #0 [ 2978.147432][T29656] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2978.157521][T29656] Call Trace: [ 2978.160831][T29656] [ 2978.163788][T29656] dump_stack_lvl+0x18c/0x250 [ 2978.168513][T29656] ? show_regs_print_info+0x20/0x20 [ 2978.173754][T29656] ? load_image+0x420/0x420 [ 2978.178322][T29656] sysfs_warn_dup+0x8e/0xa0 [ 2978.182871][T29656] sysfs_do_create_link_sd+0xc0/0x110 [ 2978.188288][T29656] device_add_class_symlinks+0x1cf/0x240 [ 2978.193969][T29656] device_add+0x4f9/0xc40 [ 2978.198342][T29656] wiphy_register+0x1f24/0x2c70 [ 2978.203279][T29656] ? cfg80211_event_work+0x40/0x40 [ 2978.208422][T29656] ? minstrel_ht_alloc+0x88a/0x990 [ 2978.213591][T29656] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2978.219705][T29656] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2978.225227][T29656] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2978.230832][T29656] ? ieee80211_tasklet_handler+0x20/0x20 [ 2978.236516][T29656] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2978.242458][T29656] ? __debug_object_init+0xec/0x450 [ 2978.247703][T29656] ? __asan_memset+0x22/0x40 [ 2978.252344][T29656] ? __hrtimer_init+0x189/0x270 [ 2978.257241][T29656] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2978.263045][T29656] ? mac80211_hwsim_free+0x220/0x220 [ 2978.268374][T29656] ? rcu_is_watching+0x15/0xb0 [ 2978.273180][T29656] ? kstrndup+0xbd/0x140 [ 2978.277492][T29656] hwsim_new_radio_nl+0xdad/0x1a70 [ 2978.282658][T29656] ? __nla_validate+0x50/0x50 [ 2978.287408][T29656] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2978.293805][T29656] ? __nla_parse+0x40/0x50 [ 2978.298278][T29656] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2978.304666][T29656] genl_family_rcv_msg_doit+0x21a/0x310 [ 2978.310271][T29656] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2978.316219][T29656] ? bpf_lsm_capable+0x9/0x10 [ 2978.320924][T29656] ? security_capable+0x89/0xb0 [ 2978.325911][T29656] genl_rcv_msg+0x611/0x7a0 [ 2978.330471][T29656] ? genl_bind+0x360/0x360 [ 2978.334926][T29656] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2978.341292][T29656] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2978.347922][T29656] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2978.354568][T29656] netlink_rcv_skb+0x235/0x4c0 [ 2978.359380][T29656] ? genl_bind+0x360/0x360 [ 2978.363845][T29656] ? netlink_ack+0x1160/0x1160 [ 2978.368679][T29656] ? __lock_acquire+0x7eb0/0x7eb0 [ 2978.373743][T29656] ? net_generic+0x1e/0x240 [ 2978.378298][T29656] ? down_read+0x1ac/0x2e0 [ 2978.382763][T29656] genl_rcv+0x28/0x40 [ 2978.386781][T29656] netlink_unicast+0x7b1/0x930 [ 2978.391605][T29656] netlink_sendmsg+0x8d0/0xbf0 [ 2978.396422][T29656] ? netlink_getsockopt+0x590/0x590 [ 2978.401660][T29656] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2978.407258][T29656] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2978.412579][T29656] ? security_socket_sendmsg+0x80/0xa0 [ 2978.418084][T29656] ? netlink_getsockopt+0x590/0x590 [ 2978.423316][T29656] ____sys_sendmsg+0x61b/0x980 [ 2978.428114][T29656] ? __asan_memset+0x22/0x40 [ 2978.432748][T29656] ? __sys_sendmsg_sock+0x30/0x30 [ 2978.437781][T29656] ? __import_iovec+0x5f2/0x850 [ 2978.442656][T29656] ? import_iovec+0x73/0xa0 [ 2978.447170][T29656] ___sys_sendmsg+0x2a6/0x360 [ 2978.451867][T29656] ? __sys_sendmsg+0x2b0/0x2b0 [ 2978.456731][T29656] __se_sys_sendmsg+0x1d0/0x2c0 [ 2978.461613][T29656] ? __x64_sys_sendmsg+0x80/0x80 [ 2978.466583][T29656] ? lockdep_hardirqs_on+0x98/0x150 [ 2978.471791][T29656] do_syscall_64+0x55/0xb0 [ 2978.476230][T29656] ? clear_bhb_loop+0x40/0x90 [ 2978.480935][T29656] ? clear_bhb_loop+0x40/0x90 [ 2978.485623][T29656] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2978.491520][T29656] RIP: 0033:0x7f3f64b9f559 [ 2978.495938][T29656] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2978.515573][T29656] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2978.523995][T29656] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2978.531978][T29656] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2978.539957][T29656] RBP: 00007f3f64c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2978.547928][T29656] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2978.555920][T29656] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2978.563920][T29656] [ 2978.591973][T29669] netlink: 'syz.3.18454': attribute type 10 has an invalid length. [ 2978.617515][T29669] bridge0: port 3(bond0) entered blocking state [ 2978.624046][T29669] bridge0: port 3(bond0) entered forwarding state [ 2978.632640][T29669] bridge0: port 2(bridge_slave_1) entered blocking state [ 2978.640395][T29669] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2978.648075][T29669] bridge0: port 1(bridge_slave_0) entered blocking state [ 2978.655441][T29669] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2978.687776][T29669] bridge0: port 3(bond0) entered disabled state [ 2978.695083][T29669] bridge0: port 2(bridge_slave_1) entered disabled state [ 2978.703029][T29669] bridge0: port 1(bridge_slave_0) entered disabled state [ 2978.825977][T29674] syzkaller0: entered promiscuous mode [ 2978.870730][T29677] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18457'. [ 2978.913252][T29677] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2978.926341][T29681] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18459'. [ 2978.929456][T29677] CPU: 1 PID: 29677 Comm: syz.1.18457 Not tainted syzkaller #0 [ 2978.942960][T29677] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2978.953019][T29677] Call Trace: [ 2978.956302][T29677] [ 2978.959242][T29677] dump_stack_lvl+0x18c/0x250 [ 2978.963947][T29677] ? show_regs_print_info+0x20/0x20 [ 2978.969158][T29677] ? load_image+0x420/0x420 [ 2978.973690][T29677] sysfs_warn_dup+0x8e/0xa0 [ 2978.978200][T29677] sysfs_do_create_link_sd+0xc0/0x110 [ 2978.983583][T29677] device_add_class_symlinks+0x1cf/0x240 [ 2978.989230][T29677] device_add+0x4f9/0xc40 [ 2978.993567][T29677] wiphy_register+0x1f24/0x2c70 [ 2978.998453][T29677] ? cfg80211_event_work+0x40/0x40 [ 2979.003570][T29677] ? minstrel_ht_alloc+0x88a/0x990 [ 2979.008713][T29677] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2979.014788][T29677] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2979.020274][T29677] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2979.025848][T29677] ? ieee80211_tasklet_handler+0x20/0x20 [ 2979.031491][T29677] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2979.037399][T29677] ? __debug_object_init+0xec/0x450 [ 2979.042613][T29677] ? __asan_memset+0x22/0x40 [ 2979.047212][T29677] ? __hrtimer_init+0x189/0x270 [ 2979.052072][T29677] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2979.057831][T29677] ? mac80211_hwsim_free+0x220/0x220 [ 2979.063117][T29677] ? rcu_is_watching+0x15/0xb0 [ 2979.067892][T29677] ? kstrndup+0xbd/0x140 [ 2979.072158][T29677] hwsim_new_radio_nl+0xdad/0x1a70 [ 2979.077281][T29677] ? __nla_validate+0x50/0x50 [ 2979.081986][T29677] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2979.088425][T29677] ? __nla_parse+0x40/0x50 [ 2979.092856][T29677] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2979.099203][T29677] genl_family_rcv_msg_doit+0x21a/0x310 [ 2979.104765][T29677] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2979.110678][T29677] ? bpf_lsm_capable+0x9/0x10 [ 2979.115353][T29677] ? security_capable+0x89/0xb0 [ 2979.120215][T29677] genl_rcv_msg+0x611/0x7a0 [ 2979.124739][T29677] ? genl_bind+0x360/0x360 [ 2979.129160][T29677] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2979.135491][T29677] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2979.142101][T29677] netlink_rcv_skb+0x235/0x4c0 [ 2979.146874][T29677] ? genl_bind+0x360/0x360 [ 2979.151297][T29677] ? netlink_ack+0x1160/0x1160 [ 2979.156100][T29677] ? down_read+0x1ac/0x2e0 [ 2979.160525][T29677] genl_rcv+0x28/0x40 [ 2979.164511][T29677] netlink_unicast+0x7b1/0x930 [ 2979.169295][T29677] netlink_sendmsg+0x8d0/0xbf0 [ 2979.174076][T29677] ? netlink_getsockopt+0x590/0x590 [ 2979.179287][T29677] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2979.184848][T29677] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2979.190139][T29677] ? security_socket_sendmsg+0x80/0xa0 [ 2979.195602][T29677] ? netlink_getsockopt+0x590/0x590 [ 2979.200811][T29677] ____sys_sendmsg+0x61b/0x980 [ 2979.205590][T29677] ? __asan_memset+0x22/0x40 [ 2979.210186][T29677] ? __sys_sendmsg_sock+0x30/0x30 [ 2979.215211][T29677] ? __import_iovec+0x5f2/0x850 [ 2979.220078][T29677] ? import_iovec+0x73/0xa0 [ 2979.224596][T29677] ___sys_sendmsg+0x2a6/0x360 [ 2979.229289][T29677] ? __sys_sendmsg+0x2b0/0x2b0 [ 2979.234094][T29677] ? ktime_get+0x7f/0x280 [ 2979.238425][T29677] ? trace_call_bpf+0xc3/0x6c0 [ 2979.243232][T29677] __se_sys_sendmsg+0x1d0/0x2c0 [ 2979.248092][T29677] ? perf_trace_preemptirq_template+0x269/0x330 [ 2979.254373][T29677] ? __x64_sys_sendmsg+0x80/0x80 [ 2979.259346][T29677] ? lockdep_hardirqs_on+0x98/0x150 [ 2979.264553][T29677] do_syscall_64+0x55/0xb0 [ 2979.268973][T29677] ? clear_bhb_loop+0x40/0x90 [ 2979.273654][T29677] ? clear_bhb_loop+0x40/0x90 [ 2979.278337][T29677] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2979.284236][T29677] RIP: 0033:0x7f872219f559 [ 2979.288660][T29677] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2979.308268][T29677] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2979.316691][T29677] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2979.324667][T29677] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2979.332728][T29677] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2979.340698][T29677] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2979.348668][T29677] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2979.356670][T29677] [ 2979.370876][T29679] netlink: 'syz.3.18458': attribute type 39 has an invalid length. [ 2979.382940][T29681] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18459'. [ 2979.397593][T29681] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18459'. [ 2979.566136][T29685] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.18461'. [ 2979.788328][T29691] FAULT_INJECTION: forcing a failure. [ 2979.788328][T29691] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2979.801863][T29691] CPU: 1 PID: 29691 Comm: syz.1.18464 Not tainted syzkaller #0 [ 2979.809452][T29691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2979.819537][T29691] Call Trace: [ 2979.822844][T29691] [ 2979.825791][T29691] dump_stack_lvl+0x18c/0x250 [ 2979.830497][T29691] ? show_regs_print_info+0x20/0x20 [ 2979.835718][T29691] ? load_image+0x420/0x420 [ 2979.840223][T29691] ? __might_fault+0xaa/0x120 [ 2979.844893][T29691] ? __lock_acquire+0x7eb0/0x7eb0 [ 2979.849923][T29691] should_fail_ex+0x394/0x4c0 [ 2979.854610][T29691] _copy_from_user+0x2f/0xe0 [ 2979.859199][T29691] ___sys_sendmsg+0x1c7/0x360 [ 2979.863870][T29691] ? get_pid_task+0x20/0x1e0 [ 2979.868458][T29691] ? __sys_sendmsg+0x2b0/0x2b0 [ 2979.873227][T29691] ? __lock_acquire+0x7eb0/0x7eb0 [ 2979.878281][T29691] __se_sys_sendmsg+0x1d0/0x2c0 [ 2979.883129][T29691] ? perf_trace_preemptirq_template+0x269/0x330 [ 2979.889365][T29691] ? __x64_sys_sendmsg+0x80/0x80 [ 2979.894314][T29691] ? lockdep_hardirqs_on+0x98/0x150 [ 2979.899546][T29691] do_syscall_64+0x55/0xb0 [ 2979.903987][T29691] ? clear_bhb_loop+0x40/0x90 [ 2979.908689][T29691] ? clear_bhb_loop+0x40/0x90 [ 2979.913392][T29691] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2979.919281][T29691] RIP: 0033:0x7f872219f559 [ 2979.923687][T29691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2979.943299][T29691] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2979.951716][T29691] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2979.959698][T29691] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 000000000000000a [ 2979.967688][T29691] RBP: 00007f872312c090 R08: 0000000000000000 R09: 0000000000000000 [ 2979.975661][T29691] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2979.983646][T29691] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2979.991637][T29691] [ 2981.421083][T29685] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2981.436097][T29685] CPU: 0 PID: 29685 Comm: syz.3.18461 Not tainted syzkaller #0 [ 2981.443702][T29685] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2981.453782][T29685] Call Trace: [ 2981.457087][T29685] [ 2981.460035][T29685] dump_stack_lvl+0x18c/0x250 [ 2981.464749][T29685] ? show_regs_print_info+0x20/0x20 [ 2981.469984][T29685] ? load_image+0x420/0x420 [ 2981.474526][T29685] sysfs_warn_dup+0x8e/0xa0 [ 2981.479039][T29685] sysfs_do_create_link_sd+0xc0/0x110 [ 2981.484423][T29685] device_add_class_symlinks+0x1cf/0x240 [ 2981.490067][T29685] device_add+0x4f9/0xc40 [ 2981.494399][T29685] wiphy_register+0x1f24/0x2c70 [ 2981.499266][T29685] ? cfg80211_event_work+0x40/0x40 [ 2981.504376][T29685] ? minstrel_ht_alloc+0x88a/0x990 [ 2981.509489][T29685] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2981.515552][T29685] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2981.521024][T29685] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2981.526573][T29685] ? ieee80211_tasklet_handler+0x20/0x20 [ 2981.532240][T29685] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2981.538152][T29685] ? __debug_object_init+0xec/0x450 [ 2981.543355][T29685] ? __asan_memset+0x22/0x40 [ 2981.547972][T29685] ? __hrtimer_init+0x189/0x270 [ 2981.552826][T29685] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2981.558558][T29685] ? mac80211_hwsim_free+0x220/0x220 [ 2981.563840][T29685] ? rcu_is_watching+0x15/0xb0 [ 2981.568690][T29685] ? kstrndup+0xbd/0x140 [ 2981.572953][T29685] hwsim_new_radio_nl+0xdad/0x1a70 [ 2981.578065][T29685] ? __nla_validate+0x50/0x50 [ 2981.582752][T29685] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2981.589086][T29685] ? __nla_parse+0x40/0x50 [ 2981.593506][T29685] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2981.599851][T29685] genl_family_rcv_msg_doit+0x21a/0x310 [ 2981.605419][T29685] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2981.611323][T29685] ? bpf_lsm_capable+0x9/0x10 [ 2981.615994][T29685] ? security_capable+0x89/0xb0 [ 2981.621626][T29685] genl_rcv_msg+0x611/0x7a0 [ 2981.626156][T29685] ? genl_bind+0x360/0x360 [ 2981.630570][T29685] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2981.636901][T29685] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2981.643492][T29685] netlink_rcv_skb+0x235/0x4c0 [ 2981.648253][T29685] ? genl_bind+0x360/0x360 [ 2981.652673][T29685] ? netlink_ack+0x1160/0x1160 [ 2981.657445][T29685] ? __lock_acquire+0x7eb0/0x7eb0 [ 2981.662473][T29685] ? down_read+0x1ac/0x2e0 [ 2981.666887][T29685] genl_rcv+0x28/0x40 [ 2981.670867][T29685] netlink_unicast+0x7b1/0x930 [ 2981.675769][T29685] netlink_sendmsg+0x8d0/0xbf0 [ 2981.680544][T29685] ? lockdep_hardirqs_on+0x98/0x150 [ 2981.685760][T29685] ? netlink_getsockopt+0x590/0x590 [ 2981.690970][T29685] ? bpf_lsm_socket_accept+0x10/0x10 [ 2981.696278][T29685] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2981.701572][T29685] ? security_socket_sendmsg+0x80/0xa0 [ 2981.707036][T29685] ? netlink_getsockopt+0x590/0x590 [ 2981.712237][T29685] ____sys_sendmsg+0x61b/0x980 [ 2981.717011][T29685] ? __asan_memset+0x22/0x40 [ 2981.721604][T29685] ? __sys_sendmsg_sock+0x30/0x30 [ 2981.726624][T29685] ? __import_iovec+0x5f2/0x850 [ 2981.731479][T29685] ? import_iovec+0x73/0xa0 [ 2981.735983][T29685] ___sys_sendmsg+0x2a6/0x360 [ 2981.740660][T29685] ? __sys_sendmsg+0x2b0/0x2b0 [ 2981.745461][T29685] __se_sys_sendmsg+0x1d0/0x2c0 [ 2981.750309][T29685] ? __x64_sys_sendmsg+0x80/0x80 [ 2981.755256][T29685] ? lockdep_hardirqs_on+0x98/0x150 [ 2981.760450][T29685] do_syscall_64+0x55/0xb0 [ 2981.764868][T29685] ? clear_bhb_loop+0x40/0x90 [ 2981.769560][T29685] ? clear_bhb_loop+0x40/0x90 [ 2981.774233][T29685] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2981.780124][T29685] RIP: 0033:0x7f041fd9f559 [ 2981.784532][T29685] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2981.804131][T29685] RSP: 002b:00007f0420d5b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2981.812543][T29685] RAX: ffffffffffffffda RBX: 00007f0420025fa0 RCX: 00007f041fd9f559 [ 2981.820534][T29685] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2981.828501][T29685] RBP: 00007f041fe36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2981.836480][T29685] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2981.844462][T29685] R13: 00007f0420026038 R14: 00007f0420025fa0 R15: 00007ffef0fc8458 [ 2981.852478][T29685] [ 2981.979486][T29698] netlink: 'syz.0.18466': attribute type 10 has an invalid length. [ 2981.995733][T29702] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18475'. [ 2982.015862][T29702] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 2982.136476][T29706] netlink: 'syz.2.18469': attribute type 39 has an invalid length. [ 2982.411872][T29721] syzkaller0: entered promiscuous mode [ 2982.545579][T29719] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2982.562527][T29719] CPU: 1 PID: 29719 Comm: syz.2.18477 Not tainted syzkaller #0 [ 2982.570124][T29719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2982.580183][T29719] Call Trace: [ 2982.583460][T29719] [ 2982.586384][T29719] dump_stack_lvl+0x18c/0x250 [ 2982.591070][T29719] ? show_regs_print_info+0x20/0x20 [ 2982.596269][T29719] ? load_image+0x420/0x420 [ 2982.600779][T29719] sysfs_warn_dup+0x8e/0xa0 [ 2982.605280][T29719] sysfs_do_create_link_sd+0xc0/0x110 [ 2982.610649][T29719] device_add_class_symlinks+0x1cf/0x240 [ 2982.616281][T29719] device_add+0x4f9/0xc40 [ 2982.620618][T29719] wiphy_register+0x1f24/0x2c70 [ 2982.625491][T29719] ? cfg80211_event_work+0x40/0x40 [ 2982.630606][T29719] ? minstrel_ht_alloc+0x88a/0x990 [ 2982.635724][T29719] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2982.641794][T29719] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2982.647262][T29719] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2982.652813][T29719] ? ieee80211_tasklet_handler+0x20/0x20 [ 2982.658441][T29719] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2982.664334][T29719] ? __debug_object_init+0xec/0x450 [ 2982.669533][T29719] ? __asan_memset+0x22/0x40 [ 2982.674128][T29719] ? __hrtimer_init+0x189/0x270 [ 2982.678982][T29719] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2982.684717][T29719] ? mac80211_hwsim_free+0x220/0x220 [ 2982.689995][T29719] ? rcu_is_watching+0x15/0xb0 [ 2982.694754][T29719] ? kstrndup+0xbd/0x140 [ 2982.699003][T29719] hwsim_new_radio_nl+0xdad/0x1a70 [ 2982.704118][T29719] ? __nla_validate+0x50/0x50 [ 2982.708799][T29719] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2982.715133][T29719] ? __nla_parse+0x40/0x50 [ 2982.719551][T29719] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2982.725889][T29719] genl_family_rcv_msg_doit+0x21a/0x310 [ 2982.731437][T29719] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2982.737331][T29719] ? bpf_lsm_capable+0x9/0x10 [ 2982.742005][T29719] ? security_capable+0x89/0xb0 [ 2982.746858][T29719] genl_rcv_msg+0x611/0x7a0 [ 2982.751365][T29719] ? genl_bind+0x360/0x360 [ 2982.755800][T29719] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2982.762135][T29719] netlink_rcv_skb+0x235/0x4c0 [ 2982.766895][T29719] ? genl_bind+0x360/0x360 [ 2982.771308][T29719] ? netlink_ack+0x1160/0x1160 [ 2982.776079][T29719] ? __lock_acquire+0x7eb0/0x7eb0 [ 2982.781110][T29719] ? down_read+0x1ac/0x2e0 [ 2982.785529][T29719] genl_rcv+0x28/0x40 [ 2982.789513][T29719] netlink_unicast+0x7b1/0x930 [ 2982.794281][T29719] netlink_sendmsg+0x8d0/0xbf0 [ 2982.799047][T29719] ? netlink_getsockopt+0x590/0x590 [ 2982.804250][T29719] ? netlink_getsockopt+0x590/0x590 [ 2982.809447][T29719] ____sys_sendmsg+0x61b/0x980 [ 2982.814215][T29719] ? __asan_memset+0x22/0x40 [ 2982.818810][T29719] ? __sys_sendmsg_sock+0x30/0x30 [ 2982.823828][T29719] ? __import_iovec+0x5f2/0x850 [ 2982.828685][T29719] ? import_iovec+0x73/0xa0 [ 2982.833195][T29719] ___sys_sendmsg+0x2a6/0x360 [ 2982.837874][T29719] ? __sys_sendmsg+0x2b0/0x2b0 [ 2982.842669][T29719] ? ktime_get+0x7f/0x280 [ 2982.847020][T29719] __se_sys_sendmsg+0x1d0/0x2c0 [ 2982.851868][T29719] ? __x64_sys_sendmsg+0x80/0x80 [ 2982.856822][T29719] do_syscall_64+0x55/0xb0 [ 2982.861238][T29719] ? clear_bhb_loop+0x40/0x90 [ 2982.865912][T29719] ? clear_bhb_loop+0x40/0x90 [ 2982.870597][T29719] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2982.876490][T29719] RIP: 0033:0x7feb6359f559 [ 2982.880902][T29719] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2982.900502][T29719] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2982.908912][T29719] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2982.916879][T29719] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2982.924844][T29719] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2982.932811][T29719] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2982.940775][T29719] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2982.948758][T29719] [ 2983.217582][T29734] FAULT_INJECTION: forcing a failure. [ 2983.217582][T29734] name failslab, interval 1, probability 0, space 0, times 0 [ 2983.240524][T29734] CPU: 1 PID: 29734 Comm: syz.0.18481 Not tainted syzkaller #0 [ 2983.248138][T29734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2983.258210][T29734] Call Trace: [ 2983.261516][T29734] [ 2983.264468][T29734] dump_stack_lvl+0x18c/0x250 [ 2983.269184][T29734] ? show_regs_print_info+0x20/0x20 [ 2983.274410][T29734] ? load_image+0x420/0x420 [ 2983.278938][T29734] ? __might_sleep+0xe0/0xe0 [ 2983.283556][T29734] ? __lock_acquire+0x7eb0/0x7eb0 [ 2983.288609][T29734] should_fail_ex+0x394/0x4c0 [ 2983.293314][T29734] should_failslab+0x9/0x20 [ 2983.297830][T29734] slab_pre_alloc_hook+0x59/0x300 [ 2983.302932][T29734] ? __lock_acquire+0x7eb0/0x7eb0 [ 2983.307948][T29734] kmem_cache_alloc_node+0x5e/0x320 [ 2983.313133][T29734] ? __alloc_skb+0x103/0x2c0 [ 2983.317736][T29734] __alloc_skb+0x103/0x2c0 [ 2983.322177][T29734] netlink_sendmsg+0x66a/0xbf0 [ 2983.326976][T29734] ? netlink_getsockopt+0x590/0x590 [ 2983.332196][T29734] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2983.337769][T29734] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2983.343076][T29734] ? security_socket_sendmsg+0x80/0xa0 [ 2983.348561][T29734] ? netlink_getsockopt+0x590/0x590 [ 2983.353783][T29734] ____sys_sendmsg+0x61b/0x980 [ 2983.358575][T29734] ? __asan_memset+0x22/0x40 [ 2983.363189][T29734] ? __sys_sendmsg_sock+0x30/0x30 [ 2983.368237][T29734] ? __import_iovec+0x5f2/0x850 [ 2983.373123][T29734] ? import_iovec+0x73/0xa0 [ 2983.377649][T29734] ___sys_sendmsg+0x2a6/0x360 [ 2983.382361][T29734] ? get_pid_task+0x20/0x1e0 [ 2983.386979][T29734] ? __sys_sendmsg+0x2b0/0x2b0 [ 2983.391785][T29734] ? __lock_acquire+0x7eb0/0x7eb0 [ 2983.396855][T29734] __se_sys_sendmsg+0x1d0/0x2c0 [ 2983.401725][T29734] ? perf_trace_preemptirq_template+0x269/0x330 [ 2983.407991][T29734] ? __x64_sys_sendmsg+0x80/0x80 [ 2983.412966][T29734] ? lockdep_hardirqs_on+0x98/0x150 [ 2983.418188][T29734] do_syscall_64+0x55/0xb0 [ 2983.422628][T29734] ? clear_bhb_loop+0x40/0x90 [ 2983.427326][T29734] ? clear_bhb_loop+0x40/0x90 [ 2983.432026][T29734] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2983.437941][T29734] RIP: 0033:0x7f3f64b9f559 [ 2983.442374][T29734] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2983.462000][T29734] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2983.470444][T29734] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2983.478442][T29734] RDX: 0000000000098010 RSI: 0000200000000740 RDI: 0000000000000004 [ 2983.486438][T29734] RBP: 00007f3f62df6090 R08: 0000000000000000 R09: 0000000000000000 [ 2983.494434][T29734] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2983.502424][T29734] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2983.510429][T29734] [ 2985.273487][T29744] netlink: 'syz.0.18485': attribute type 39 has an invalid length. [ 2985.558258][T29754] __nla_validate_parse: 4 callbacks suppressed [ 2985.558279][T29754] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18488'. [ 2985.636635][T29754] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2985.665693][T29754] CPU: 0 PID: 29754 Comm: syz.1.18488 Not tainted syzkaller #0 [ 2985.673351][T29754] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2985.683463][T29754] Call Trace: [ 2985.686797][T29754] [ 2985.689788][T29754] dump_stack_lvl+0x18c/0x250 [ 2985.694551][T29754] ? show_regs_print_info+0x20/0x20 [ 2985.699821][T29754] ? load_image+0x420/0x420 [ 2985.704455][T29754] sysfs_warn_dup+0x8e/0xa0 [ 2985.709028][T29754] sysfs_do_create_link_sd+0xc0/0x110 [ 2985.714477][T29754] device_add_class_symlinks+0x1cf/0x240 [ 2985.720192][T29754] device_add+0x4f9/0xc40 [ 2985.724600][T29754] wiphy_register+0x1f24/0x2c70 [ 2985.729612][T29754] ? cfg80211_event_work+0x40/0x40 [ 2985.734788][T29754] ? minstrel_ht_alloc+0x88a/0x990 [ 2985.740011][T29754] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2985.746165][T29754] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2985.751757][T29754] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2985.757406][T29754] ? ieee80211_tasklet_handler+0x20/0x20 [ 2985.763116][T29754] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2985.769092][T29754] ? __debug_object_init+0xec/0x450 [ 2985.774378][T29754] ? __asan_memset+0x22/0x40 [ 2985.779051][T29754] ? __hrtimer_init+0x189/0x270 [ 2985.783999][T29754] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2985.789904][T29754] ? mac80211_hwsim_free+0x220/0x220 [ 2985.795234][T29754] ? rcu_is_watching+0x15/0xb0 [ 2985.800049][T29754] ? kstrndup+0xbd/0x140 [ 2985.804414][T29754] hwsim_new_radio_nl+0xdad/0x1a70 [ 2985.809628][T29754] ? __nla_validate+0x50/0x50 [ 2985.814440][T29754] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2985.820900][T29754] ? __nla_parse+0x40/0x50 [ 2985.825412][T29754] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2985.831844][T29754] genl_family_rcv_msg_doit+0x21a/0x310 [ 2985.837514][T29754] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2985.843521][T29754] ? bpf_lsm_capable+0x9/0x10 [ 2985.848253][T29754] ? security_capable+0x89/0xb0 [ 2985.853209][T29754] genl_rcv_msg+0x611/0x7a0 [ 2985.857827][T29754] ? genl_bind+0x360/0x360 [ 2985.862314][T29754] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2985.868721][T29754] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2985.875433][T29754] netlink_rcv_skb+0x235/0x4c0 [ 2985.880247][T29754] ? genl_bind+0x360/0x360 [ 2985.884689][T29754] ? netlink_ack+0x1160/0x1160 [ 2985.889564][T29754] ? __lock_acquire+0x7eb0/0x7eb0 [ 2985.894686][T29754] ? down_read+0x1ac/0x2e0 [ 2985.899179][T29754] genl_rcv+0x28/0x40 [ 2985.903216][T29754] netlink_unicast+0x7b1/0x930 [ 2985.908060][T29754] netlink_sendmsg+0x8d0/0xbf0 [ 2985.912927][T29754] ? netlink_getsockopt+0x590/0x590 [ 2985.918177][T29754] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2985.923775][T29754] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2985.929098][T29754] ? security_socket_sendmsg+0x80/0xa0 [ 2985.934588][T29754] ? netlink_getsockopt+0x590/0x590 [ 2985.939833][T29754] ____sys_sendmsg+0x61b/0x980 [ 2985.944657][T29754] ? __asan_memset+0x22/0x40 [ 2985.949290][T29754] ? __sys_sendmsg_sock+0x30/0x30 [ 2985.954340][T29754] ? __import_iovec+0x5f2/0x850 [ 2985.959260][T29754] ? import_iovec+0x73/0xa0 [ 2985.963819][T29754] ___sys_sendmsg+0x2a6/0x360 [ 2985.968552][T29754] ? __sys_sendmsg+0x2b0/0x2b0 [ 2985.973428][T29754] ? ktime_get+0x7f/0x280 [ 2985.977894][T29754] __se_sys_sendmsg+0x1d0/0x2c0 [ 2985.982797][T29754] ? __x64_sys_sendmsg+0x80/0x80 [ 2985.987920][T29754] ? lockdep_hardirqs_on+0x98/0x150 [ 2985.993166][T29754] do_syscall_64+0x55/0xb0 [ 2985.997609][T29754] ? clear_bhb_loop+0x40/0x90 [ 2986.002318][T29754] ? clear_bhb_loop+0x40/0x90 [ 2986.007036][T29754] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2986.012957][T29754] RIP: 0033:0x7f872219f559 [ 2986.017403][T29754] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2986.037054][T29754] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2986.045506][T29754] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2986.053675][T29754] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2986.061669][T29754] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2986.069668][T29754] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2986.077662][T29754] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2986.085730][T29754] [ 2986.173060][T29753] netlink: 'syz.2.18487': attribute type 10 has an invalid length. [ 2986.510001][T29770] netlink: 132 bytes leftover after parsing attributes in process `syz.0.18495'. [ 2986.636356][T29773] netlink: 'syz.2.18497': attribute type 39 has an invalid length. [ 2986.855496][T29791] netlink: 'syz.1.18504': attribute type 10 has an invalid length. [ 2986.977972][T29792] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18502'. [ 2987.007389][T29792] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2987.016827][T29792] CPU: 1 PID: 29792 Comm: syz.2.18502 Not tainted syzkaller #0 [ 2987.024426][T29792] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2987.034515][T29792] Call Trace: [ 2987.037821][T29792] [ 2987.040778][T29792] dump_stack_lvl+0x18c/0x250 [ 2987.045509][T29792] ? show_regs_print_info+0x20/0x20 [ 2987.050754][T29792] ? load_image+0x420/0x420 [ 2987.055327][T29792] sysfs_warn_dup+0x8e/0xa0 [ 2987.059873][T29792] sysfs_do_create_link_sd+0xc0/0x110 [ 2987.065300][T29792] device_add_class_symlinks+0x1cf/0x240 [ 2987.070972][T29792] device_add+0x4f9/0xc40 [ 2987.075319][T29792] wiphy_register+0x1f24/0x2c70 [ 2987.080209][T29792] ? cfg80211_event_work+0x40/0x40 [ 2987.085328][T29792] ? minstrel_ht_alloc+0x88a/0x990 [ 2987.090459][T29792] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2987.096534][T29792] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2987.102023][T29792] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2987.107590][T29792] ? ieee80211_tasklet_handler+0x20/0x20 [ 2987.113229][T29792] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2987.119134][T29792] ? __debug_object_init+0xec/0x450 [ 2987.124347][T29792] ? __asan_memset+0x22/0x40 [ 2987.128954][T29792] ? __hrtimer_init+0x189/0x270 [ 2987.133819][T29792] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2987.139576][T29792] ? mac80211_hwsim_free+0x220/0x220 [ 2987.144862][T29792] ? rcu_is_watching+0x15/0xb0 [ 2987.149631][T29792] ? kstrndup+0xbd/0x140 [ 2987.153896][T29792] hwsim_new_radio_nl+0xdad/0x1a70 [ 2987.159018][T29792] ? __nla_validate+0x50/0x50 [ 2987.163717][T29792] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2987.170068][T29792] ? __nla_parse+0x40/0x50 [ 2987.174492][T29792] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2987.180835][T29792] genl_family_rcv_msg_doit+0x21a/0x310 [ 2987.186398][T29792] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2987.192308][T29792] ? bpf_lsm_capable+0x9/0x10 [ 2987.196983][T29792] ? security_capable+0x89/0xb0 [ 2987.201846][T29792] genl_rcv_msg+0x611/0x7a0 [ 2987.206360][T29792] ? genl_bind+0x360/0x360 [ 2987.210779][T29792] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2987.217109][T29792] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2987.223711][T29792] ? perf_trace_lock+0xfc/0x3b0 [ 2987.228604][T29792] netlink_rcv_skb+0x235/0x4c0 [ 2987.233383][T29792] ? genl_bind+0x360/0x360 [ 2987.237884][T29792] ? netlink_ack+0x1160/0x1160 [ 2987.242669][T29792] ? __lock_acquire+0x7eb0/0x7eb0 [ 2987.247706][T29792] ? down_read+0x1ac/0x2e0 [ 2987.252133][T29792] genl_rcv+0x28/0x40 [ 2987.256118][T29792] netlink_unicast+0x7b1/0x930 [ 2987.260923][T29792] netlink_sendmsg+0x8d0/0xbf0 [ 2987.265702][T29792] ? netlink_getsockopt+0x590/0x590 [ 2987.270912][T29792] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2987.276473][T29792] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2987.281761][T29792] ? security_socket_sendmsg+0x80/0xa0 [ 2987.287222][T29792] ? netlink_getsockopt+0x590/0x590 [ 2987.292429][T29792] ____sys_sendmsg+0x61b/0x980 [ 2987.297208][T29792] ? __asan_memset+0x22/0x40 [ 2987.301827][T29792] ? __sys_sendmsg_sock+0x30/0x30 [ 2987.306853][T29792] ? __import_iovec+0x5f2/0x850 [ 2987.311721][T29792] ? import_iovec+0x73/0xa0 [ 2987.316233][T29792] ___sys_sendmsg+0x2a6/0x360 [ 2987.320928][T29792] ? __sys_sendmsg+0x2b0/0x2b0 [ 2987.325724][T29792] ? ktime_get+0x7f/0x280 [ 2987.330444][T29792] __se_sys_sendmsg+0x1d0/0x2c0 [ 2987.335307][T29792] ? __x64_sys_sendmsg+0x80/0x80 [ 2987.340285][T29792] do_syscall_64+0x55/0xb0 [ 2987.344705][T29792] ? clear_bhb_loop+0x40/0x90 [ 2987.349470][T29792] ? clear_bhb_loop+0x40/0x90 [ 2987.354149][T29792] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2987.360047][T29792] RIP: 0033:0x7feb6359f559 [ 2987.364462][T29792] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2987.384067][T29792] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2987.392491][T29792] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2987.400463][T29792] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2987.408435][T29792] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2987.416404][T29792] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2987.424374][T29792] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2987.432369][T29792] [ 2988.061787][T29796] netlink: 128 bytes leftover after parsing attributes in process `syz.3.18505'. [ 2988.079419][T29796] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2988.192589][T29814] netlink: 132 bytes leftover after parsing attributes in process `syz.2.18510'. [ 2988.424272][T29822] FAULT_INJECTION: forcing a failure. [ 2988.424272][T29822] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2988.468811][T29822] CPU: 1 PID: 29822 Comm: syz.2.18512 Not tainted syzkaller #0 [ 2988.476429][T29822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2988.486508][T29822] Call Trace: [ 2988.489814][T29822] [ 2988.492757][T29822] dump_stack_lvl+0x18c/0x250 [ 2988.497459][T29822] ? show_regs_print_info+0x20/0x20 [ 2988.502679][T29822] ? load_image+0x420/0x420 [ 2988.507203][T29822] ? __might_fault+0xaa/0x120 [ 2988.511899][T29822] ? __lock_acquire+0x7eb0/0x7eb0 [ 2988.516947][T29822] should_fail_ex+0x394/0x4c0 [ 2988.521646][T29822] _copy_from_iter+0x1cd/0x1290 [ 2988.526526][T29822] ? rcu_is_watching+0x15/0xb0 [ 2988.531312][T29822] ? copyout_mc+0x70/0x70 [ 2988.535651][T29822] ? __virt_addr_valid+0x10c/0x380 [ 2988.540781][T29822] ? __virt_addr_valid+0x10c/0x380 [ 2988.545914][T29822] ? __virt_addr_valid+0x10c/0x380 [ 2988.551047][T29822] ? __check_object_size+0x4fc/0xa40 [ 2988.556350][T29822] netlink_sendmsg+0x76b/0xbf0 [ 2988.561136][T29822] ? netlink_getsockopt+0x590/0x590 [ 2988.566357][T29822] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2988.571926][T29822] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2988.577245][T29822] ? security_socket_sendmsg+0x80/0xa0 [ 2988.582724][T29822] ? netlink_getsockopt+0x590/0x590 [ 2988.587941][T29822] ____sys_sendmsg+0x61b/0x980 [ 2988.592728][T29822] ? __asan_memset+0x22/0x40 [ 2988.597340][T29822] ? __sys_sendmsg_sock+0x30/0x30 [ 2988.602374][T29822] ? __import_iovec+0x5f2/0x850 [ 2988.607240][T29822] ? import_iovec+0x73/0xa0 [ 2988.611763][T29822] ___sys_sendmsg+0x2a6/0x360 [ 2988.616456][T29822] ? get_pid_task+0x20/0x1e0 [ 2988.621074][T29822] ? __sys_sendmsg+0x2b0/0x2b0 [ 2988.625877][T29822] ? __lock_acquire+0x7eb0/0x7eb0 [ 2988.630951][T29822] __se_sys_sendmsg+0x1d0/0x2c0 [ 2988.635828][T29822] ? __x64_sys_sendmsg+0x80/0x80 [ 2988.640806][T29822] ? lockdep_hardirqs_on+0x98/0x150 [ 2988.646026][T29822] do_syscall_64+0x55/0xb0 [ 2988.650464][T29822] ? clear_bhb_loop+0x40/0x90 [ 2988.655164][T29822] ? clear_bhb_loop+0x40/0x90 [ 2988.659866][T29822] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2988.665777][T29822] RIP: 0033:0x7feb6359f559 [ 2988.670204][T29822] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2988.689829][T29822] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2988.698266][T29822] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2988.706257][T29822] RDX: 0000000000000000 RSI: 0000200000000f40 RDI: 0000000000000003 [ 2988.714244][T29822] RBP: 00007feb644cd090 R08: 0000000000000000 R09: 0000000000000000 [ 2988.722231][T29822] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2988.730217][T29822] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2988.738222][T29822] [ 2988.802563][T29829] netlink: 'syz.1.18514': attribute type 10 has an invalid length. [ 2989.243123][T29845] netlink: 16186 bytes leftover after parsing attributes in process `syz.2.18521'. [ 2989.577885][T29853] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18522'. [ 2990.141759][T29860] FAULT_INJECTION: forcing a failure. [ 2990.141759][T29860] name failslab, interval 1, probability 0, space 0, times 0 [ 2990.154614][T29860] CPU: 1 PID: 29860 Comm: syz.0.18527 Not tainted syzkaller #0 [ 2990.162197][T29860] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2990.172285][T29860] Call Trace: [ 2990.175608][T29860] [ 2990.178576][T29860] dump_stack_lvl+0x18c/0x250 [ 2990.183313][T29860] ? show_regs_print_info+0x20/0x20 [ 2990.188557][T29860] ? load_image+0x420/0x420 [ 2990.193128][T29860] ? slab_post_alloc_hook+0x6a/0x4d0 [ 2990.198467][T29860] should_fail_ex+0x394/0x4c0 [ 2990.203209][T29860] should_failslab+0x9/0x20 [ 2990.207745][T29860] slab_pre_alloc_hook+0x59/0x300 [ 2990.212831][T29860] kmem_cache_alloc+0x5a/0x2d0 [ 2990.217637][T29860] ? radix_tree_node_alloc+0x7e/0x3a0 [ 2990.223074][T29860] radix_tree_node_alloc+0x7e/0x3a0 [ 2990.228332][T29860] idr_get_free+0x28f/0xa10 [ 2990.232918][T29860] idr_alloc_cyclic+0x28a/0x610 [ 2990.237839][T29860] ? idr_alloc+0x2e0/0x2e0 [ 2990.242301][T29860] ? do_raw_spin_lock+0x11f/0x2b0 [ 2990.247398][T29860] ? __radix_tree_preload+0x82/0x880 [ 2990.252742][T29860] ? btf_alloc_id+0x30/0x2d0 [ 2990.257380][T29860] btf_alloc_id+0x4f/0x2d0 [ 2990.261856][T29860] btf_new_fd+0x80a/0x9e0 [ 2990.266258][T29860] ? bpf_btf_show_fdinfo+0x80/0x80 [ 2990.271428][T29860] ? capable+0x88/0xe0 [ 2990.275555][T29860] __sys_bpf+0x670/0x890 [ 2990.279848][T29860] ? bpf_link_show_fdinfo+0x560/0x560 [ 2990.285319][T29860] ? lock_chain_count+0x20/0x20 [ 2990.290242][T29860] __x64_sys_bpf+0x7c/0x90 [ 2990.294709][T29860] do_syscall_64+0x55/0xb0 [ 2990.299168][T29860] ? clear_bhb_loop+0x40/0x90 [ 2990.303887][T29860] ? clear_bhb_loop+0x40/0x90 [ 2990.308616][T29860] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2990.314556][T29860] RIP: 0033:0x7f3f64b9f559 [ 2990.319012][T29860] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2990.338658][T29860] RSP: 002b:00007f3f62df6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2990.347130][T29860] RAX: ffffffffffffffda RBX: 00007f3f64e25fa0 RCX: 00007f3f64b9f559 [ 2990.355140][T29860] RDX: 0000000000000028 RSI: 0000200000001640 RDI: 0000000000000012 [ 2990.363153][T29860] RBP: 00007f3f62df6090 R08: 0000000000000000 R09: 0000000000000000 [ 2990.371164][T29860] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2990.379173][T29860] R13: 00007f3f64e26038 R14: 00007f3f64e25fa0 R15: 00007ffc4ec88578 [ 2990.387236][T29860] [ 2990.799453][T29863] netlink: 'syz.3.18528': attribute type 10 has an invalid length. [ 2991.217003][T29879] netlink: 'syz.1.18533': attribute type 21 has an invalid length. [ 2991.557449][T29891] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18537'. [ 2991.794216][T29900] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18542'. [ 2991.813048][T29900] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18542'. [ 2991.823392][T29900] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18542'. [ 2991.878201][T29902] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.18541'. [ 2991.924807][T29902] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2991.950337][T29902] CPU: 1 PID: 29902 Comm: syz.3.18541 Not tainted syzkaller #0 [ 2991.957964][T29902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2991.968053][T29902] Call Trace: [ 2991.971366][T29902] [ 2991.974327][T29902] dump_stack_lvl+0x18c/0x250 [ 2991.979046][T29902] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2991.985250][T29902] ? show_regs_print_info+0x20/0x20 [ 2991.990492][T29902] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2991.996715][T29902] ? dump_stack+0x9/0x20 [ 2992.001015][T29902] sysfs_warn_dup+0x8e/0xa0 [ 2992.005563][T29902] sysfs_do_create_link_sd+0xc0/0x110 [ 2992.010984][T29902] device_add_class_symlinks+0x1cf/0x240 [ 2992.016679][T29902] device_add+0x4f9/0xc40 [ 2992.021061][T29902] wiphy_register+0x1f24/0x2c70 [ 2992.025997][T29902] ? cfg80211_event_work+0x40/0x40 [ 2992.031142][T29902] ? minstrel_ht_alloc+0x88a/0x990 [ 2992.036313][T29902] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2992.042514][T29902] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2992.048041][T29902] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2992.053650][T29902] ? ieee80211_tasklet_handler+0x20/0x20 [ 2992.059328][T29902] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2992.065269][T29902] ? __debug_object_init+0xec/0x450 [ 2992.070512][T29902] ? __asan_memset+0x22/0x40 [ 2992.075143][T29902] ? __hrtimer_init+0x189/0x270 [ 2992.080041][T29902] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2992.085843][T29902] ? mac80211_hwsim_free+0x220/0x220 [ 2992.091164][T29902] ? rcu_is_watching+0x15/0xb0 [ 2992.095963][T29902] ? kstrndup+0xbd/0x140 [ 2992.100267][T29902] hwsim_new_radio_nl+0xdad/0x1a70 [ 2992.105419][T29902] ? __nla_validate+0x50/0x50 [ 2992.110136][T29902] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2992.116495][T29902] ? __nla_parse+0x40/0x50 [ 2992.120926][T29902] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2992.127272][T29902] genl_family_rcv_msg_doit+0x21a/0x310 [ 2992.132836][T29902] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2992.138747][T29902] ? bpf_lsm_capable+0x9/0x10 [ 2992.143424][T29902] ? security_capable+0x89/0xb0 [ 2992.148291][T29902] genl_rcv_msg+0x611/0x7a0 [ 2992.152814][T29902] ? genl_bind+0x360/0x360 [ 2992.157235][T29902] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2992.163567][T29902] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2992.170155][T29902] ? ref_tracker_free+0x686/0x830 [ 2992.175215][T29902] netlink_rcv_skb+0x235/0x4c0 [ 2992.179989][T29902] ? genl_bind+0x360/0x360 [ 2992.184413][T29902] ? netlink_ack+0x1160/0x1160 [ 2992.189724][T29902] ? __lock_acquire+0x7eb0/0x7eb0 [ 2992.194770][T29902] ? down_read+0x1ac/0x2e0 [ 2992.199223][T29902] genl_rcv+0x28/0x40 [ 2992.203210][T29902] netlink_unicast+0x7b1/0x930 [ 2992.207996][T29902] netlink_sendmsg+0x8d0/0xbf0 [ 2992.212774][T29902] ? aa_sock_msg_perm+0x94/0x150 [ 2992.217727][T29902] ? netlink_getsockopt+0x590/0x590 [ 2992.222933][T29902] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2992.228487][T29902] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2992.233776][T29902] ? security_socket_sendmsg+0x80/0xa0 [ 2992.239238][T29902] ? netlink_getsockopt+0x590/0x590 [ 2992.244443][T29902] ____sys_sendmsg+0x61b/0x980 [ 2992.249228][T29902] ? __asan_memset+0x22/0x40 [ 2992.253826][T29902] ? __sys_sendmsg_sock+0x30/0x30 [ 2992.258850][T29902] ? __import_iovec+0x5f2/0x850 [ 2992.263723][T29902] ? import_iovec+0x73/0xa0 [ 2992.268239][T29902] ___sys_sendmsg+0x2a6/0x360 [ 2992.272930][T29902] ? __sys_sendmsg+0x2b0/0x2b0 [ 2992.277779][T29902] __se_sys_sendmsg+0x1d0/0x2c0 [ 2992.282640][T29902] ? __x64_sys_sendmsg+0x80/0x80 [ 2992.287609][T29902] ? lockdep_hardirqs_on+0x98/0x150 [ 2992.292820][T29902] do_syscall_64+0x55/0xb0 [ 2992.297240][T29902] ? clear_bhb_loop+0x40/0x90 [ 2992.301925][T29902] ? clear_bhb_loop+0x40/0x90 [ 2992.306611][T29902] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2992.312508][T29902] RIP: 0033:0x7f041fd9f559 [ 2992.316932][T29902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2992.336538][T29902] RSP: 002b:00007f0420d5b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2992.345046][T29902] RAX: ffffffffffffffda RBX: 00007f0420025fa0 RCX: 00007f041fd9f559 [ 2992.353019][T29902] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2992.360995][T29902] RBP: 00007f041fe36b20 R08: 0000000000000000 R09: 0000000000000000 [ 2992.368967][T29902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2992.376938][T29902] R13: 00007f0420026038 R14: 00007f0420025fa0 R15: 00007ffef0fc8458 [ 2992.384939][T29902] [ 2992.405338][T29910] netlink: 'syz.2.18545': attribute type 21 has an invalid length. [ 2992.546012][T29911] netlink: 'syz.1.18546': attribute type 10 has an invalid length. [ 2992.749042][T29920] netlink: 'syz.2.18548': attribute type 10 has an invalid length. [ 2992.967293][T29931] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18554'. [ 2992.997174][T29931] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18554'. [ 2993.039399][T29938] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18554'. [ 2993.312770][T29944] netlink: 132 bytes leftover after parsing attributes in process `syz.2.18555'. [ 2993.439191][T29947] netlink: 'syz.0.18556': attribute type 21 has an invalid length. [ 2994.373680][T29959] netlink: 129384 bytes leftover after parsing attributes in process `syz.2.18560'. [ 2994.471648][T29959] netlink: 'syz.2.18560': attribute type 10 has an invalid length. [ 2994.940787][T29977] netlink: 'syz.0.18566': attribute type 39 has an invalid length. [ 2995.766808][T30001] netlink: 'syz.1.18577': attribute type 10 has an invalid length. [ 2995.939344][T30003] netlink: 'syz.3.18579': attribute type 39 has an invalid length. [ 2996.731479][T30024] __nla_validate_parse: 10 callbacks suppressed [ 2996.731503][T30024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18585'. [ 2996.751740][T29996] netlink: 128 bytes leftover after parsing attributes in process `syz.0.18575'. [ 2996.820886][T29996] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2996.905204][T30024] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18585'. [ 2996.925472][T30026] netlink: 60 bytes leftover after parsing attributes in process `syz.1.18585'. [ 2996.971130][T30028] netlink: 129384 bytes leftover after parsing attributes in process `syz.3.18588'. [ 2997.023603][T30028] netlink: 'syz.3.18588': attribute type 10 has an invalid length. Stopping sshd: [ 2997.234196][T30037] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.18590'. stopped /usr/sbin/sshd (pid 5528) OK [ 2997.335234][T30037] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2997.349631][T30037] CPU: 0 PID: 30037 Comm: syz.1.18590 Not tainted syzkaller #0 [ 2997.357270][T30037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2997.367396][T30037] Call Trace: [ 2997.370732][T30037] [ 2997.373726][T30037] dump_stack_lvl+0x18c/0x250 [ 2997.378501][T30037] ? show_regs_print_info+0x20/0x20 [ 2997.383784][T30037] ? load_image+0x420/0x420 [ 2997.388422][T30037] sysfs_warn_dup+0x8e/0xa0 [ 2997.393003][T30037] sysfs_do_create_link_sd+0xc0/0x110 [ 2997.398458][T30037] device_add_class_symlinks+0x1cf/0x240 [ 2997.404154][T30037] device_add+0x4f9/0xc40 [ 2997.408527][T30037] wiphy_register+0x1f24/0x2c70 [ 2997.413475][T30037] ? cfg80211_event_work+0x40/0x40 [ 2997.418651][T30037] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2997.424766][T30037] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2997.430306][T30037] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2997.435904][T30037] ? ieee80211_tasklet_handler+0x20/0x20 [ 2997.441570][T30037] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2997.447502][T30037] ? __debug_object_init+0xec/0x450 [ 2997.452739][T30037] ? __asan_memset+0x22/0x40 [ 2997.457365][T30037] ? __hrtimer_init+0x189/0x270 [ 2997.462256][T30037] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2997.468077][T30037] ? mac80211_hwsim_free+0x220/0x220 [ 2997.473389][T30037] ? rcu_is_watching+0x15/0xb0 [ 2997.478189][T30037] ? kstrndup+0xbd/0x140 [ 2997.482494][T30037] hwsim_new_radio_nl+0xdad/0x1a70 [ 2997.487654][T30037] ? __nla_validate+0x50/0x50 [ 2997.492405][T30037] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2997.498835][T30037] ? __nla_parse+0x40/0x50 [ 2997.503319][T30037] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2997.509703][T30037] genl_family_rcv_msg_doit+0x21a/0x310 [ 2997.515307][T30037] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2997.521270][T30037] ? bpf_lsm_capable+0x9/0x10 [ 2997.525964][T30037] ? security_capable+0x89/0xb0 [ 2997.530867][T30037] genl_rcv_msg+0x611/0x7a0 [ 2997.535514][T30037] ? genl_bind+0x360/0x360 [ 2997.539955][T30037] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2997.546317][T30037] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2997.552927][T30037] ? ref_tracker_free+0x686/0x830 [ 2997.558013][T30037] netlink_rcv_skb+0x235/0x4c0 [ 2997.562807][T30037] ? genl_bind+0x360/0x360 [ 2997.567257][T30037] ? netlink_ack+0x1160/0x1160 [ 2997.572095][T30037] ? __lock_acquire+0x7eb0/0x7eb0 [ 2997.577180][T30037] ? down_read+0x1ac/0x2e0 [ 2997.581634][T30037] genl_rcv+0x28/0x40 [ 2997.585643][T30037] netlink_unicast+0x7b1/0x930 [ 2997.590471][T30037] netlink_sendmsg+0x8d0/0xbf0 [ 2997.595294][T30037] ? netlink_getsockopt+0x590/0x590 [ 2997.600533][T30037] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2997.606115][T30037] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2997.611424][T30037] ? security_socket_sendmsg+0x80/0xa0 [ 2997.616904][T30037] ? netlink_getsockopt+0x590/0x590 [ 2997.622134][T30037] ____sys_sendmsg+0x61b/0x980 [ 2997.626951][T30037] ? __asan_memset+0x22/0x40 [ 2997.631572][T30037] ? __sys_sendmsg_sock+0x30/0x30 [ 2997.636617][T30037] ? __import_iovec+0x5f2/0x850 [ 2997.641528][T30037] ? import_iovec+0x73/0xa0 [ 2997.646074][T30037] ___sys_sendmsg+0x2a6/0x360 [ 2997.650800][T30037] ? __sys_sendmsg+0x2b0/0x2b0 [ 2997.655674][T30037] ? ktime_get+0x7f/0x280 [ 2997.660123][T30037] __se_sys_sendmsg+0x1d0/0x2c0 [ 2997.665010][T30037] ? __x64_sys_sendmsg+0x80/0x80 [ 2997.670032][T30037] ? lockdep_hardirqs_on+0x98/0x150 [ 2997.675343][T30037] do_syscall_64+0x55/0xb0 [ 2997.679802][T30037] ? clear_bhb_loop+0x40/0x90 [ 2997.684510][T30037] ? clear_bhb_loop+0x40/0x90 [ 2997.689221][T30037] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2997.695144][T30037] RIP: 0033:0x7f872219f559 [ 2997.699585][T30037] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2997.719215][T30037] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2997.727667][T30037] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 2997.735661][T30037] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2997.743653][T30037] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 2997.751643][T30037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2997.761386][T30037] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 2997.769452][T30037] [ 2997.864604][T30036] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.18591'. [ 2997.941388][T30036] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2997.988446][T30036] CPU: 1 PID: 30036 Comm: syz.2.18591 Not tainted syzkaller #0 [ 2997.996096][T30036] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2998.006186][T30036] Call Trace: [ 2998.009514][T30036] [ 2998.012478][T30036] dump_stack_lvl+0x18c/0x250 [ 2998.017231][T30036] ? show_regs_print_info+0x20/0x20 [ 2998.022479][T30036] ? load_image+0x420/0x420 [ 2998.027067][T30036] sysfs_warn_dup+0x8e/0xa0 [ 2998.031613][T30036] sysfs_do_create_link_sd+0xc0/0x110 [ 2998.037025][T30036] device_add_class_symlinks+0x1cf/0x240 [ 2998.042704][T30036] device_add+0x4f9/0xc40 [ 2998.047174][T30036] wiphy_register+0x1f24/0x2c70 [ 2998.052137][T30036] ? cfg80211_event_work+0x40/0x40 [ 2998.057363][T30036] ? minstrel_ht_alloc+0x88a/0x990 [ 2998.062544][T30036] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2998.068656][T30036] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2998.074198][T30036] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2998.079823][T30036] ? ieee80211_tasklet_handler+0x20/0x20 [ 2998.085491][T30036] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2998.091433][T30036] ? __debug_object_init+0xec/0x450 [ 2998.096681][T30036] ? __asan_memset+0x22/0x40 [ 2998.101312][T30036] ? __hrtimer_init+0x189/0x270 [ 2998.106212][T30036] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2998.112050][T30036] ? mac80211_hwsim_free+0x220/0x220 [ 2998.117364][T30036] ? rcu_is_watching+0x15/0xb0 [ 2998.122167][T30036] ? kstrndup+0xbd/0x140 [ 2998.126483][T30036] hwsim_new_radio_nl+0xdad/0x1a70 [ 2998.131652][T30036] ? __nla_validate+0x50/0x50 [ 2998.136449][T30036] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2998.142854][T30036] ? __nla_parse+0x40/0x50 [ 2998.147318][T30036] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2998.153730][T30036] genl_family_rcv_msg_doit+0x21a/0x310 [ 2998.159371][T30036] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2998.165342][T30036] ? bpf_lsm_capable+0x9/0x10 [ 2998.170058][T30036] ? security_capable+0x89/0xb0 [ 2998.174977][T30036] genl_rcv_msg+0x611/0x7a0 [ 2998.179547][T30036] ? genl_bind+0x360/0x360 [ 2998.184002][T30036] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2998.190374][T30036] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2998.197038][T30036] netlink_rcv_skb+0x235/0x4c0 [ 2998.201847][T30036] ? genl_bind+0x360/0x360 [ 2998.206306][T30036] ? netlink_ack+0x1160/0x1160 [ 2998.211173][T30036] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2998.217396][T30036] ? down_read+0x1ac/0x2e0 [ 2998.221856][T30036] genl_rcv+0x28/0x40 [ 2998.225954][T30036] netlink_unicast+0x7b1/0x930 [ 2998.230795][T30036] netlink_sendmsg+0x8d0/0xbf0 [ 2998.235646][T30036] ? netlink_getsockopt+0x590/0x590 [ 2998.240905][T30036] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2998.246544][T30036] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2998.251867][T30036] ? security_socket_sendmsg+0x80/0xa0 [ 2998.257354][T30036] ? netlink_getsockopt+0x590/0x590 [ 2998.262598][T30036] ____sys_sendmsg+0x61b/0x980 [ 2998.267421][T30036] ? __asan_memset+0x22/0x40 [ 2998.272052][T30036] ? __sys_sendmsg_sock+0x30/0x30 [ 2998.277107][T30036] ? __import_iovec+0x5f2/0x850 [ 2998.282027][T30036] ? import_iovec+0x73/0xa0 [ 2998.286585][T30036] ___sys_sendmsg+0x2a6/0x360 [ 2998.291324][T30036] ? __sys_sendmsg+0x2b0/0x2b0 [ 2998.296304][T30036] __se_sys_sendmsg+0x1d0/0x2c0 [ 2998.301199][T30036] ? __x64_sys_sendmsg+0x80/0x80 [ 2998.306233][T30036] ? lockdep_hardirqs_on+0x98/0x150 [ 2998.311474][T30036] do_syscall_64+0x55/0xb0 [ 2998.315918][T30036] ? clear_bhb_loop+0x40/0x90 [ 2998.320622][T30036] ? clear_bhb_loop+0x40/0x90 [ 2998.325344][T30036] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2998.331263][T30036] RIP: 0033:0x7feb6359f559 [ 2998.335713][T30036] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2998.355345][T30036] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2998.363819][T30036] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2998.371814][T30036] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000b [ 2998.379808][T30036] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2998.387817][T30036] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2998.395810][T30036] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2998.403871][T30036] Stopping crond: [ 2998.661411][T30043] netlink: 132 bytes leftover after parsing attributes in process `syz.0.18589'. stopped /usr/sbin/crond (pid 5513) OK [ 2998.979810][T30051] netlink: 132 bytes leftover after parsing attributes in process `syz.1.18593'. Stopping dhcpcd... [ 2999.236908][T30063] netlink: 60 bytes leftover after parsing attributes in process `syz.0.18597'. stopped /sbin/dhcpcd (pid 5438) [ 2999.287526][T30069] netlink: 'syz.1.18600': attribute type 10 has an invalid length. [ 2999.480682][T30073] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 2999.509753][T30073] CPU: 1 PID: 30073 Comm: syz.2.18601 Not tainted syzkaller #0 [ 2999.517389][T30073] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 2999.527490][T30073] Call Trace: [ 2999.530805][T30073] [ 2999.533794][T30073] dump_stack_lvl+0x18c/0x250 [ 2999.538525][T30073] ? show_regs_print_info+0x20/0x20 [ 2999.543775][T30073] ? load_image+0x420/0x420 [ 2999.548354][T30073] sysfs_warn_dup+0x8e/0xa0 [ 2999.552897][T30073] sysfs_do_create_link_sd+0xc0/0x110 [ 2999.558320][T30073] device_add_class_symlinks+0x1cf/0x240 [ 2999.563989][T30073] device_add+0x4f9/0xc40 [ 2999.568377][T30073] wiphy_register+0x1f24/0x2c70 [ 2999.573319][T30073] ? cfg80211_event_work+0x40/0x40 [ 2999.578477][T30073] ? minstrel_ht_alloc+0x88a/0x990 [ 2999.583657][T30073] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 2999.589779][T30073] ieee80211_register_hw+0x2f3d/0x3cb0 [ 2999.595311][T30073] ? ieee80211_register_hw+0xf01/0x3cb0 [ 2999.600922][T30073] ? ieee80211_tasklet_handler+0x20/0x20 [ 2999.606600][T30073] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 2999.612538][T30073] ? __debug_object_init+0xec/0x450 [ 2999.617777][T30073] ? __asan_memset+0x22/0x40 [ 2999.622402][T30073] ? __hrtimer_init+0x189/0x270 [ 2999.627269][T30073] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 2999.633026][T30073] ? mac80211_hwsim_free+0x220/0x220 [ 2999.638313][T30073] ? rcu_is_watching+0x15/0xb0 [ 2999.643083][T30073] ? kstrndup+0xbd/0x140 [ 2999.647348][T30073] hwsim_new_radio_nl+0xdad/0x1a70 [ 2999.652474][T30073] ? __nla_validate+0x50/0x50 [ 2999.657183][T30073] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2999.663536][T30073] ? __nla_parse+0x40/0x50 [ 2999.667967][T30073] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 2999.674310][T30073] genl_family_rcv_msg_doit+0x21a/0x310 [ 2999.679874][T30073] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 2999.685812][T30073] ? bpf_lsm_capable+0x9/0x10 [ 2999.690512][T30073] ? security_capable+0x89/0xb0 [ 2999.695397][T30073] genl_rcv_msg+0x611/0x7a0 [ 2999.699921][T30073] ? genl_bind+0x360/0x360 [ 2999.704344][T30073] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 2999.710674][T30073] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2999.717265][T30073] ? ref_tracker_free+0x686/0x830 [ 2999.722314][T30073] netlink_rcv_skb+0x235/0x4c0 [ 2999.727087][T30073] ? genl_bind+0x360/0x360 [ 2999.731510][T30073] ? netlink_ack+0x1160/0x1160 [ 2999.736308][T30073] ? __lock_acquire+0x7eb0/0x7eb0 [ 2999.741371][T30073] ? down_read+0x1ac/0x2e0 [ 2999.745798][T30073] genl_rcv+0x28/0x40 [ 2999.749806][T30073] netlink_unicast+0x7b1/0x930 [ 2999.754605][T30073] netlink_sendmsg+0x8d0/0xbf0 [ 2999.759393][T30073] ? netlink_getsockopt+0x590/0x590 [ 2999.764606][T30073] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2999.770172][T30073] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2999.775465][T30073] ? security_socket_sendmsg+0x80/0xa0 [ 2999.780927][T30073] ? netlink_getsockopt+0x590/0x590 [ 2999.786136][T30073] ____sys_sendmsg+0x61b/0x980 [ 2999.790918][T30073] ? __asan_memset+0x22/0x40 [ 2999.795513][T30073] ? __sys_sendmsg_sock+0x30/0x30 [ 2999.800537][T30073] ? __import_iovec+0x5f2/0x850 [ 2999.805404][T30073] ? import_iovec+0x73/0xa0 [ 2999.809916][T30073] ___sys_sendmsg+0x2a6/0x360 [ 2999.814608][T30073] ? __sys_sendmsg+0x2b0/0x2b0 [ 2999.819455][T30073] __se_sys_sendmsg+0x1d0/0x2c0 [ 2999.824313][T30073] ? __x64_sys_sendmsg+0x80/0x80 [ 2999.829281][T30073] ? lockdep_hardirqs_on+0x98/0x150 [ 2999.834486][T30073] do_syscall_64+0x55/0xb0 [ 2999.838907][T30073] ? clear_bhb_loop+0x40/0x90 [ 2999.843584][T30073] ? clear_bhb_loop+0x40/0x90 [ 2999.848270][T30073] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2999.854165][T30073] RIP: 0033:0x7feb6359f559 [ 2999.858581][T30073] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2999.878190][T30073] RSP: 002b:00007feb644cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2999.886610][T30073] RAX: ffffffffffffffda RBX: 00007feb63825fa0 RCX: 00007feb6359f559 [ 2999.894582][T30073] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000c [ 2999.902727][T30073] RBP: 00007feb63636b20 R08: 0000000000000000 R09: 0000000000000000 [ 2999.910697][T30073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2999.918668][T30073] R13: 00007feb63826038 R14: 00007feb63825fa0 R15: 00007ffea82a0258 [ 2999.926679][T30073] Stopping network: [ 3000.032813][T30079] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 3000.055335][T30079] CPU: 1 PID: 30079 Comm: syz.1.18603 Not tainted syzkaller #0 [ 3000.062955][T30079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 3000.073045][T30079] Call Trace: [ 3000.076360][T30079] [ 3000.079329][T30079] dump_stack_lvl+0x18c/0x250 [ 3000.084058][T30079] ? show_regs_print_info+0x20/0x20 [ 3000.089302][T30079] ? load_image+0x420/0x420 [ 3000.093881][T30079] sysfs_warn_dup+0x8e/0xa0 [ 3000.098522][T30079] sysfs_do_create_link_sd+0xc0/0x110 [ 3000.103935][T30079] device_add_class_symlinks+0x1cf/0x240 [ 3000.109585][T30079] device_add+0x4f9/0xc40 [ 3000.113924][T30079] wiphy_register+0x1f24/0x2c70 [ 3000.118815][T30079] ? cfg80211_event_work+0x40/0x40 [ 3000.123930][T30079] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 3000.130097][T30079] ? rtnl_unlock+0x9/0x10 [ 3000.134440][T30079] ieee80211_register_hw+0x2f3d/0x3cb0 [ 3000.139926][T30079] ? ieee80211_register_hw+0xf01/0x3cb0 [ 3000.145490][T30079] ? ieee80211_tasklet_handler+0x20/0x20 [ 3000.151131][T30079] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 3000.157041][T30079] ? __debug_object_init+0xec/0x450 [ 3000.162252][T30079] ? __asan_memset+0x22/0x40 [ 3000.166860][T30079] ? __hrtimer_init+0x189/0x270 [ 3000.171726][T30079] mac80211_hwsim_new_radio+0x2a75/0x4d70 [ 3000.177482][T30079] ? mac80211_hwsim_free+0x220/0x220 [ 3000.182765][T30079] ? rcu_is_watching+0x15/0xb0 [ 3000.187535][T30079] ? kstrndup+0xbd/0x140 [ 3000.191796][T30079] hwsim_new_radio_nl+0xdad/0x1a70 [ 3000.196919][T30079] ? __nla_validate+0x50/0x50 [ 3000.201625][T30079] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 3000.207972][T30079] ? __nla_parse+0x40/0x50 [ 3000.212398][T30079] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 3000.218743][T30079] genl_family_rcv_msg_doit+0x21a/0x310 [ 3000.224301][T30079] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 3000.230208][T30079] ? bpf_lsm_capable+0x9/0x10 [ 3000.234887][T30079] ? security_capable+0x89/0xb0 [ 3000.239759][T30079] genl_rcv_msg+0x611/0x7a0 [ 3000.244277][T30079] ? genl_bind+0x360/0x360 [ 3000.248701][T30079] ? hwsim_tx_info_frame_received_nl+0xce0/0xce0 [ 3000.255043][T30079] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 3000.261637][T30079] ? ref_tracker_free+0x686/0x830 [ 3000.266685][T30079] netlink_rcv_skb+0x235/0x4c0 [ 3000.271458][T30079] ? genl_bind+0x360/0x360 [ 3000.275884][T30079] ? netlink_ack+0x1160/0x1160 [ 3000.280669][T30079] ? __lock_acquire+0x7eb0/0x7eb0 [ 3000.285710][T30079] ? down_read+0x1ac/0x2e0 [ 3000.290134][T30079] genl_rcv+0x28/0x40 [ 3000.294119][T30079] netlink_unicast+0x7b1/0x930 [ 3000.298902][T30079] netlink_sendmsg+0x8d0/0xbf0 [ 3000.303679][T30079] ? netlink_getsockopt+0x590/0x590 [ 3000.308884][T30079] ? apparmor_socket_sendmsg+0x8e/0x330 [ 3000.314439][T30079] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 3000.319726][T30079] ? security_socket_sendmsg+0x80/0xa0 [ 3000.325186][T30079] ? netlink_getsockopt+0x590/0x590 [ 3000.330392][T30079] ____sys_sendmsg+0x61b/0x980 [ 3000.335172][T30079] ? __asan_memset+0x22/0x40 [ 3000.339784][T30079] ? __sys_sendmsg_sock+0x30/0x30 [ 3000.344807][T30079] ? __import_iovec+0x5f2/0x850 [ 3000.349677][T30079] ? import_iovec+0x73/0xa0 [ 3000.354190][T30079] ___sys_sendmsg+0x2a6/0x360 [ 3000.358882][T30079] ? __sys_sendmsg+0x2b0/0x2b0 [ 3000.363719][T30079] __se_sys_sendmsg+0x1d0/0x2c0 [ 3000.368577][T30079] ? __x64_sys_sendmsg+0x80/0x80 [ 3000.373544][T30079] ? lockdep_hardirqs_on+0x98/0x150 [ 3000.378784][T30079] do_syscall_64+0x55/0xb0 [ 3000.383206][T30079] ? clear_bhb_loop+0x40/0x90 [ 3000.387887][T30079] ? clear_bhb_loop+0x40/0x90 [ 3000.392570][T30079] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 3000.398467][T30079] RIP: 0033:0x7f872219f559 [ 3000.402883][T30079] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 3000.422489][T30079] RSP: 002b:00007f872312c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 3000.430905][T30079] RAX: ffffffffffffffda RBX: 00007f8722425fa0 RCX: 00007f872219f559 [ 3000.438873][T30079] RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 000000000000000b [ 3000.446843][T30079] RBP: 00007f8722236b20 R08: 0000000000000000 R09: 0000000000000000 [ 3000.454815][T30079] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3000.462786][T30079] R13: 00007f8722426038 R14: 00007f8722425fa0 R15: 00007fffa76cef08 [ 3000.470783][T30079] [ 3000.556909][T30082] netlink: 'syz.0.18604': attribute type 1 has an invalid length. OK Stopping iptables: OK Stopping system message bus: done Stopping klogd: OK Stopping acpid: OK Stopping syslogd: stopped /sbin/syslogd (pid 5125) OK umount: can't remount debugfs read-only umount: sysfs busy - remounted read-only umount: devtmpfs busy - remounted read-only umount: can't remount /dev/root read-only The system is going down NOW! Sent SIGTERM to all processes [ 3005.897707][ T9205] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3005.988609][ T9205] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3006.112864][ T9205] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 Sent SIGKILL to all processes Requesting system poweroff [ 3006.193341][ T9205] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3007.036221][ T9205] : (slave wlan1): Releasing backup interface [ 3007.137583][T30139] smc: removing ib device rxe0 [ 3007.151829][T30139] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 3007.190863][T30139] ACPI: PM: Preparing to enter system sleep state S5 [ 3007.209246][T30139] kvm: exiting hardware virtualization [ 3007.214902][T30139] reboot: Power down serialport: VM disconnected.