last executing test programs: 4.052835019s ago: executing program 1 (id=3218): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0xa, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_bp={0x0, 0x5}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x2, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000d40)=ANY=[@ANYBLOB="01000000040000000800a19e427690f7679f0000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000010400)={0x11, 0xd, &(0x7f0000000280)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1, r0}, 0xc) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x0, 0x2, 0x0, 0x80}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) (async, rerun: 64) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) (rerun: 64) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000000500000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xd8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0xb, &(0x7f00000004c0)=ANY=[@ANYBLOB="1804000000000000000000000001000018010000202070250000000000202020db1af8ffa0000000bda100000000000007010000f8ffffffb702000008000000b70300000000000085000000a00000009500"], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 64) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={r4, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, &(0x7f0000001080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}, {}, {0x85, 0x0, 0x0, 0xa7}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x2e, &(0x7f0000000000)=r6, 0x4) (async) recvmsg$unix(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x10002) (async) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000200)={@ifindex, 0xffffffffffffffff, 0x2f}, 0x20) (async, rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0xd, &(0x7f0000000240)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x2f}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}]}, &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 64) 4.007355541s ago: executing program 3 (id=3219): r0 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f020033000b35d25a806c8c6f940004000a000400053582c137153e09a1828b14381f4f000300", 0x28}], 0x1}, 0x0) 3.872312299s ago: executing program 3 (id=3220): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000040)={0x1b, 0x0, 0x0, 0x7ff, 0x0, 0x1, 0x721, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5}, 0x50) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_subtree(r2, &(0x7f0000000940)=ANY=[@ANYBLOB="8f03000000000060007538e486dd630ace2200102f00fe80000000000000875a65", @ANYRESOCT], 0xcfa4) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0xc9e, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x2}, 0x50) (async) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000340)={0x1b, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0xc9e, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x2}, 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xe, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2, 0x5}, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x16, &(0x7f00000000c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @alu={0x7, 0x1, 0x3, 0x4, 0xa, 0x2, 0xfffffffffffffffc}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='syzkaller\x00', 0x7, 0xe4, &(0x7f00000001c0)=""/228, 0x41100, 0x40, '\x00', 0x0, 0x25, r2, 0x8, &(0x7f00000002c0)={0x1, 0x1}, 0x8, 0x10, &(0x7f0000000300)={0x5, 0x8, 0xffff, 0x4}, 0x10, 0x0, 0x0, 0x3, &(0x7f0000000480)=[r3, r4, r5], &(0x7f00000004c0)=[{0x5, 0x4, 0x1, 0x2}, {0x4, 0x5, 0xd}, {0x1, 0x1, 0xc, 0x6}], 0x10, 0x8}, 0x94) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000000), 0xfdef) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) (async) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001a00910c07a551559a257aac81"], 0xfe33) 3.65102872s ago: executing program 1 (id=3223): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0xc}, 0x8008, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000b40)=ANY=[@ANYBLOB="b702000009000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2e6405000000000065060400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000002c3f2cc2b7956244cef7baf48e6d2885a09a87507ebfc75b5b0f4e4309ebcdac5f7a860c008cbdd3b4c3b7f28754860c9c781f6410457253e89ad528d985636a86ec0f68f59cd1159a2c2e85d726859a919cc9548a349980d1ccdce27f94bc074c27f81078545c146a0857153b7b8f00034debae58a4ab415b0d7ff0575cc272cd3d7e8d974927676468ff2d86e0ffac94792ed9cf6b40b3cf252a47c05ae8a70d57cc3e067d1867b54d24e20000000000000020009ebf84d3b042d6e432cd080e3b57239f0127473e6ba922aff649609d40b47ec331ccba3cf96f9483ff19a6471bf5abc742d9cbcfb964b11b31034694a6aad86cf08a6c7b2235dc99de9aa3e6b77c7a2877261ed32da90864987f30926c9013eec3b86836ae50447aa5a79f40c235000000453302712c3d8fc4e2b61adb0695e800000000d4f4e91f0000002c33df424d1bafe5725c8a404724f8a4f1cda7997b65954f74097560b91da309b887af2485c2d9ab09b523000000000000000bf7b2ff4602aec1eea200000064881c5630521a08e051374cf05c921a06fb7818000000009dc8d95e0e5b365d10e1004dae58b3b5b89709b0ff47b200000000004000cbef88811dc8c1b27ac7d9a6bb70f60eb9c01dd2fc79b85e4d961498f3a80131d21d856177a2189f45d011ef1da5c6d57bb8fd387ccea9c3899a914e47e82f040000009d81003f927355408f87264797d3fa970949793b94329d580500d1f91c0d22587e05a61e3d8576ca168e88d7a9af95b04a37c27bfffab9abbb31fa8c0080258cfa6d3f166e695f3c56490aeef464d9965d70a50f1282619344f223548e750339643adac1322c87ca253ff2fb1882760d6feab16bacdf83c11816dbe959ebc5ec479c8319f73e2249eab0486b110702a481d3b51976a52303056e800b4ae5acc2dfae60ab958e9f3ef9b4aaa4e8d6166f636a65eb1d672bf2000000cda8462cc9b16624998be65683321e970000000009b8e20762c1bf4a3eb6769f2b23e842bacd9c685edea0ffa3e975424f8ede49e61a4de808a38ba3512d64dc71867df4eee3f1ff791cf7c9862f98b45852e4b2f78721b978a2df2f2a29a387c6f0576b36038f819286eca99a6a434811cf2a117d775fe986a49fb82cf5f15972d5ab18f1045384501adabb20f7b0e15ff47f1744e2341b59034959a1289ba6e243668e6735305707e3de7652bfc5b60c76deff43a1d6fd6a4180ab723735abbeffe7f2ec3a0bb86f9eddfc0f3d1d503d7a54b49e1ae6c5aa620d27e91aa0aa0ed6fcacfc91fbb4c256409e54daefbb107c381fa729ff5f3907d93430da178d685d7730f5e129438a5214f722096d2986334c2576bef69145d3fbd78a9059e454474f92e65828b018174a9f4738b8c71fbdeac26ab95e02f9a847182766964976b1fccdb9f35721e43e33883cf16ed1343fb7429eb395123b0a4262b7023c22039b9002589a378ed4c6267965af78b861bd025312538cec97966b8973d4e299d9802264d06e40ae118e1d242d1128dcedeb44030df12ef68f78215d65f96eb55db8cbcb060008000d988374f85451a694ffe38a1d03916ff10dc82b31c98d42e1a1bda1290de1a499a5a385b31112a48ba3e6d6849914c1788a7aca37177cc341fff44fec5c5e0abae01c439a1b0311e074e81ae9993b5b3459553e4ece78d4c1501c70f5d81e0725d5b273755c0000000000000000aa4234ff82182952a76233d18e7d49638aeb04e7a9e9e7eafb7c255372795d2d192a0a33cab0f5bf2e93e0544fcdf2df2bc6ce96e5a11993d54f97a23754ac828674dbb93c0ad345715be4a13678b01edf76d8a923655800a2c88cce004505ab45d8f5f88aa887bbce5c18970428516f6099bdbb2cd7a2356397f1a0a23e662e2a6c4834400cbaa41c3c574e6e6aefb7a68da5ec1ae49f968bbe0e0bf9878516f553639f5b4828e92019b61f5874be1c7cdd9482df50bc24a8a1fa10d291390eb84e26a2e8dbeaa45604b05a116c1210a7540bf81005044273f5a8ffc538db289350eb248e483bd8920efcf30a798c2b636243e0a37262ca47dfeefa753ba528f7ba77e825051ce69b4475d7d714ba0c636e6ae9f710411d30ef424aeaabe057c7df6ff8f767bcd9012e1047c686f5ccb76ab3a5df53cbc22ba7ea8f6a8e220bb4d83de1e4dc19d6c1be841503850803bc2c2d5e0e34270a7f1cca0c6c53a8e5f891f7a793a70da62d6d88fbb90d220acc687931b42d6be83ab870da3c0a567f5e65ec0457f4ad2a4ec0b671b36388afd5520a8483a4b11f7d02a409315f0f9e59f47668d68a74838d6976e12fd45200014041dffacbf60892ec8bd7560686f137a806d3dfaba900b47cac62f828342fff009adb5b2251461a1b9d6ba625b8fe04e69a1a4be2696f0000000086e172932e03000000000000005942e1b9d6dc28ab8e19e1111dd893e801015642faf21eef40d6e7de3ef62c4bc5ff17e7aeb2841098f845d1cc9ec4eee79c298fb0ba939b13707044e2e9cc0d350438c1c8c6bb9a38c6ac5ca0d9cf1f3d6915f25cb26edfc28b3079b97df32601240e454db103fb0c4a143673a3f160d3a7b83ecd0509ce9eba0c7bf7843799b1b56a234f9eaab8a3f14f1472bb6aaeb8ac9ee4054605558ab31f339f6a4caf2ee2fd01f34dca3300000000000000000000000000000000f59f8e6e00000000c44130098d833a24000000000095e6f945ba9a941cef5e70b8c152321e24b5b29bcf374dcf5a29a35d76e6e2bf8df95462690a4fc9ec8129e92b6ebb4b40a992a75d3c595426ae40d0bfc87db24d856359079b29b3c374d081c300b2cfaa596d24e800ef8e2201f2fb7a9946f89f9f31f7cbd603fd7f8898c70b5c65f2e28f22e1a79a6af3a54861b07f124642e98389557affbdede09b5566a4a1ee73b20846810030a754acddcdafe3ceeeebc0b5f2fedfe7d198e3067f3dbac9441a9ab8409cbbb7e15b9ae3944097de34de2001c8533a3766e6e4c4c4702ccb932a27a3962814cd6aa8fc684beeaa3932efae3a9052be8eec1e95f6ad8d41dd34829503ba4b66e27154cb6e34aa13450522df1723130b6fe347c93f00e40e293c98d849a33f773c743728992f40faccd5c23130a1c6bfd6fc661bca1598137ddd1090ded672f5a48a40cab3f640c8241a364cbdd3f188eec7da7bccafbd5bf28a46f0eecc6b550471b0b0770c6a5a411c0e0b19e15a461e7c6833ba936e214b013f2819ec6572a43b5cd32b11d7e4f8dcf8f7820a17b7b2ee6178a03351dd25091e46bfd82a3979b9cad109fd6217cd52aa81bdabd50826a674bd16b8f7e6aed12a305366599f5f029a7b24558c027518c669760500002f1c19d16a6f391906000000cc0bbbfb8c698ecc137d96711100e0108d3bd2afed0b279ebf0527552a9331e646c424b14ffbb815622bfd2f635855bed1b164d0a56bd104be069854111c5b26ec3c652b5f0a6b9676dae987ec23456ba05a4dfb15321ef6b76e7e547a688c67ab531cfc784c9f940d9fb0464a6cce635e14b80dc5c1c64e75e6bd5355d84f8df272f18f58c570e7afd83ee77f157c146aa747b728969aeb4aba1d8f9de1b3fb8ab6ea50e884c2ea98e6400bf0c5ae2887cd1da0e57ccfdf5eca2b455247efcc13102846c0a85f20c80007c0ce6efce627b95b8ad3003385de97101678fb2163ecea6e70a77a6fbc089e31a5ccece932229b8f79faa6863d6857c3d9a9710f9f8ad16eeb8342278f311cbc226498028234d21466892983378fe64acbb44f694cd78e43c74aa75505cb1c91b189f8f89f233a05f5cd4e173a373178557843dd705268f74a9e5429945503195aefd6706b584d8408c9652b3fe68500747f7ee8375fa559c3ad195d3795df1a8364cd13acc3256ee4634c73eeb6954d0fcf09ab84df0b8900e0c6fea2ccb600ae7a4b128cae19df160e7c207b89132d1d5bdc9ffc79f0549b82df521817651d5fead5128205b92ccdccc69407ab556217af277af911dbd456dfc43dd061b6c91485dcc208cf0b3d0bf851de413f5de5ec015e296914afab6411109355e027ce04990d9aae251b9deb11b7db45b9f15b7b55d8fdbedd9e6cf891205694f02be8b9ea8ecd41308a0e1b93ae3435bfa88b440b1f701b4d0fc49c82193f27f8023b630ea97edbf3bf421a0a1a2b4ac7bb30bcd1cdd172c0df37408fd6827bb03e8742fc1c7a2befd1299928c5f79e846a8dc7ca648d960a759e6711b69776896a9656d59af6d44bc5348229fa84ae78af8421a22c4b4c17a3d24a4a0104000000000000d77cc4eef51c2b417c8c7458ddd7dd9d1a863bf0a9e1a30a19020490038017a5c7e474c83302a2c2b5c976dacf3dda7191c757f208000000000000005f7ed983f65723fbb36b9b51abb0dbcd335700000000000000000000000000000086666201251aa4f139d0485ffcf89f01639fd1579a3802f720a0215c720a97071f5065a23642a58275dbca444b00e2e5835185d5d5b2796eb0fe32cf3b0633f58ecc7648c3c6efe82f93a3008052416512eea30ea9472e0b456a652883c0907323cf03be193a05008cdef7a98a1671a1918df310dc4bfd61c3db4819ab1c57b348a8ff1ed36364a20fe846f1cd086058d139ce528425b31c5d08b433562ffb318c1285011f9b78b2401989384311101e452f54661ecdb2514a6ae50dbdd422de0f0f8c670000000000390be79688f80c47314cb1b14afcaa5d23f9032e0ec51f45f447d6a7c798fcf7e60e2180e289410801e4f03a0e140f388f25b92da1025d8409e171a2336ed71cca86eb4658fe06df286e0e20276b0618eeffd05774f15686cd9d3182ca2fec863875f305fed6baf48a594db12582a38cfdffffffffffffff0cf8d920517835fe7d09cfcb624f6931f1cc6f6b71f58de9ddc38e0c43992f6bc57a718d0cfd197b5324b4e05ef1caa96db3ae1f2f2e5791faba2ebbe1a6faf21f2748fb1fb6743c3ca8af4e6b02518c9b7fdc1b5721eb1c3ed98db25536f74ac7861afc94544e52dcb5c60460a05802e3b437ac977bfa26b887a2443e8d559c58187f004eb82b07937df6e96f77ed551926bec4e0188fae10a35d1c5f1768ac6be829bea46f1babc3d74adc31ca71bdab9079e4288881b434484eadde9da6b81802842abd462d546c59d87acc014f81d3414759bda12d2a2c6bc1bfa807bd3101eb227184a61107b6d0618e2a3b842671e084ac3f0ff94dc48b51601247318ab4d1c5106458000000000008000000000000cfee0107e6c2fe8639d926829fdbbd86bf591a8c3c235d8939af9d923f648165881a6c29997234406400b3b1c321cc158dbe17123eace30000000000009ea77cb4d3ca892600000000796de6ae4ae40bdf9a6e8c5dc29562262af9cd54e8e3ecc7e3c8cba0ecc791683496c4e5c1a5729714d9f9031f49b400cd2667b4ea6df54809615a4f973f93e6ccec72f16ff998e29ed99df733680a9d5cea57f99cc139b6ea9014f3000000000000000000000000000000000000feeab45a4046a622b0dceb413e4e39b7317e92cbed46b41ab5115bfb542c933783d750852dfdc6656aaf15e10615a88821f2f1bc53969b52d6852755e7681ad5beda80b38ccd34116b99f50b4fdd967b3f20f260455412b67563e40e323bde9d673fceda0ad6981565c8a183d928903b4f4472dde41b6dcd75314c31e704dfcb222c8359fe88944f852242270c932abfaeece0843d708f5cd25b2a63ae1e79723c1c3c013836b47da0a35d0f34c070000000000000422ae2c148d444dd437a7d2f5e575009bc2d17a199802409329dae8baa58d3de63ad45328a9d4dc1ace543dfe11913c6c6413f8f7a15657d012fea460bb4656a20df1ba26932b0ef49f8ea88d7b4c1289314ba789661640f1b5d7cbae103fa95b0035f1e8e866307d4796eab0992704f9e00be4b1af8dfa9e94ad74e607ea9d7d7a95ed5a15429426abbed8d2c657018305c6f9e5159a5453f958991a908ff4cb2e8cbccb1d3c8daf754e4b01b2edd023e5bfdf293bd28fc1f8885f6edd5a715df4d180247feb08e9e2e5126c48be6098e711f0d86de5d76fdccae34eef9197c32ab4e6fcb52eb9ce18fdb621a75913a97254d783778203ec0bd1a8859683e1d01da4e81fb73bb3b358340a0310bf5ae17b917208da607fd7b125cf99fd3e9056f5184df7570ede94b736ae354b5b8ae2cc473b455f2f86d47c69027676bf1141f316b0f278f1692406572ee82766f8e5ff1cfec2a7a6cab7d0f2582a877c9bd4ca81089373f738d02e6bb4d3df30ac0f041e51ad36e1ff140812baf54b80635cc80963c8f69fa4506f7a30c99d3e538cc0aeafcad86ead38ed949aa3c204aea50e5e0039f01b82595b7dc921a8acc1f76340f060cc9a3acad3451c17dc9b5ca5d10a0cb1708592d1900a046f33761d50895febd9fd58cb132989766cf7c252daac259576ec218e3857e6fa97fe445d1fab51d87302a4bb28a4cfe462ee4849cc6832650188ca187d85509d8beccf9d9cf752368985804195b9fd2faf1aff8248f3981bd55cbbf514cd8365fee72cc7af053e5388ceadadb967ef735181df6a90cab13f58f6d563c9ab4ad37297aecffd8446cb2b14ec36a99af8393e3760d5970ba1debdcbccd54012c559ee2797ff962328aa6a252c0756e396ce4d52937546675203bdf1d6b120acac576523f8b1daa922188bf61536312f90dba92fb380c3c6fb5f9883a2c4dd99a1bac9b7cb25ff2ef9bd58ff97ddfdd2d4bcc371ee82245b57cd91a7fa3479cd339f54a5c422b753cd42d441ea881d46e419312db1f0cccce"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0xff9d}, 0x48) perf_event_open(&(0x7f0000000ac0)={0x0, 0x80, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) close(r1) ioctl$SIOCSIFHWADDR(r1, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @random="010000000700"}) (async, rerun: 64) r2 = perf_event_open(&(0x7f00000003c0)={0x5, 0x80, 0x3, 0x2, 0x3, 0xd, 0x0, 0x5, 0x2, 0xb, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0xf09, 0x1, @perf_bp={&(0x7f0000000040)}, 0x100000, 0xa79, 0x7, 0x2, 0xc4, 0xffff, 0x1, 0x0, 0x15, 0x0, 0x101}, 0x0, 0x2, r1, 0xa) (async, rerun: 64) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000023000b67d25a806f8c6394f96724fc60", 0x14}], 0x1}, 0x0) (async, rerun: 32) perf_event_open(&(0x7f0000000480)={0x2, 0x80, 0xde, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80720, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_bp={0x0, 0xe}}, 0x0, 0xffffffffffffffff, r2, 0xa) (async, rerun: 32) r4 = socket$kcm(0x2, 0x5, 0x84) (async) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000300)="d8000000180081054e81f782db4cb904021c080406037c09e8fe55a10a0015400200142603600e122f00160004000400a8000600200005400700027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ed50c3e7867a9d3026cd0a23394d78c24cbee5de6ccd40dd6e4edef3d93", 0xd8}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x20000000) sendmsg$inet(r4, &(0x7f00000006c0)={&(0x7f0000000040)={0x2, 0x4e23, @private=0xa010101}, 0x10, &(0x7f0000000140)=[{&(0x7f00000000c0)="e0", 0x1}], 0x1}, 0xc000) r6 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="5c00000014006b03000000d86e6c1d0002847ea622fb564500004e23e3f58e76110165f450e71b0075e3002500028d459e37000f0000000000bf9367b47e51f60a64c9f4d4938037e786a6d0bdd700"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r6, &(0x7f0000002f80)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000cc0)=""/4096, 0x1000}, {&(0x7f0000001ec0)=""/4096, 0x1000}], 0x2}, 0x10000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg$unix(r7, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000002c0)=""/42, 0x2a}, {&(0x7f0000000700)=""/240, 0xf0}, {&(0x7f0000000800)=""/149, 0x95}, {&(0x7f00000008c0)=""/62, 0x3e}], 0x4, &(0x7f0000000940)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x78}, 0x141) (async) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x8) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x20e, 0xe40, 0xfd000004, &(0x7f00000004c0)="b9180bb76003070c009e40f086dd1fff310000003c0020010010ac14142ee0080001c699da153f0ae0e6e380f60115f683317585d7472ce0ab4439f0f570ff155bc5f73ba3f8bb99a6e8ded1ce485cf058105cd981b42493481cd659416a2e10c9119664f36eb00b333c20c9ec0c222d644bdcb178c1cc53d6960fbb842d6a33dfcde3a1e1848135214baf139753866cadcbe3ce52505e992818cc452bee339d9ab076f484020eaa348a21d7911e4c44905256ec2cc54cca47a198b00c10aff62a4bed43a2ebcad92743fb22c593f28fd4bb7c703cde9cae0569d4c8d9a823f2c12863f7a6c0cf88ed22aae4f6f084508833b61429a25773eedf63dd9f33d430f2a0a30a7761db16fe0f743b95ded898c28aac1256ce2751b3d738899b8b19d9052b7f13ff94", 0x0, 0x31, 0x6000000000000000, 0xfffffffffffffe7e, 0x1d4}, 0x28) 3.4642315s ago: executing program 1 (id=3225): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffff7e, 0x0, 0x0, 0x0}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b80)={r0, 0xe0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1, &(0x7f0000000840)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000940)=[0x0], 0x0, 0xd2, &(0x7f0000000980)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f00000009c0), &(0x7f0000000a00), 0x8, 0x1a, 0x8, 0x8, &(0x7f0000000a40)}}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000300)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000066680000", @ANYRESDEC], 0xffdd) 2.949090886s ago: executing program 3 (id=3228): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x809, 0x640b9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0xb, 0x8}, 0x200, 0x35, 0x43a1bd76, 0x1, 0x3, 0x8, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xf, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000040)={0x0, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_bp={0x0, 0xa}, 0x114304, 0x8, 0x0, 0x1, 0x1, 0x0, 0x1}, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x2, 0x3, 0x2) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x4, 0x10000, 0x9e8, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8000, 0x590f}, 0x2920, 0x0, 0x0, 0x8, 0x80000000, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="02000000040000"], 0x50) (async) recvmsg$kcm(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x2002) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 64) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001200)=@bpf_lsm={0x1d, 0x4, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000001000000000000008700000095000000000000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x7, 0xab, &(0x7f0000000300)=""/171, 0x1e00, 0x65, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000880)={0x1, 0x5}, 0x8, 0x10, &(0x7f00000008c0)={0x5, 0x2, 0x8, 0x101}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000001140)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r2, r2, r2, r2, r2, r2, r2], &(0x7f0000001180)=[{0x1, 0x4, 0x6, 0x7}, {0x4, 0x2, 0x9, 0x8}, {0x2, 0x1, 0x10, 0x6}, {0x2, 0x5, 0x6, 0x3}, {0x0, 0x1, 0x6, 0x2}, {0x2, 0x4, 0xa, 0x7}], 0x10, 0x8}, 0x94) (rerun: 64) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) r3 = socket$kcm(0x2, 0x4, 0x84) setsockopt$sock_attach_bpf(r3, 0x1, 0x3c, &(0x7f0000000000), 0x4) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) ioctl$SIOCSIFHWADDR(r1, 0x8916, &(0x7f0000000000)={'veth1_to_bridge\x00', @random="02000400ac14"}) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r4) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0x0, &(0x7f0000000c40)=[{0x4, 0x0, 0xb, 0x4}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x4, 0x10006}]}, 0x94) r5 = socket$kcm(0x10, 0x3, 0x10) r6 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002380)="1b0000001a007f029e741683c28f", 0xe}], 0x1}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff}) (async, rerun: 64) r8 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) (async, rerun: 64) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r8, 0x40042408, r9) (async, rerun: 64) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="02000000040000"], 0x50) (async, rerun: 64) sendmsg$unix(r7, &(0x7f0000000f00)={&(0x7f0000000500)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000e40)=[{&(0x7f00000006c0)="6bc121b26cde081d90bceb23c44f6347ab1a06305fc39589af0de1fac10744a0253efe9784f93f4decf9fe4fbc7bcab4b36799f67e85d24f422277f8b42c5649abafa7d2b03b5db23814416f", 0x4c}, {&(0x7f0000000240)}, {&(0x7f00000009c0)="a163f6c163a50c9288dbc2f16df338db03c671eff82b5824eb22850b974f90cf1827b36c83891695f546e0a1b345da71d724250e2557f2f87df7cfccba9618b5fed0abbc55821d7e800ebffb7930bbf6b5d7082a53417e18257e70ca66753add5858639c5892211d2c758449d94d3d731d8bff27c298cda3a8e46f6813f7e35de3c05609e5601cb4ce6e13156b33c645c2046c581fc735fa15cace7c2d2735181bac3727b1a4e0234e10b575c6d42889cd2c40ff89c2649830836029db09018940db3ae674529edfa79f910cf296b3", 0xcf}, {&(0x7f0000000740)="f24f5fe43d371cb9383c699cd0f9cc1dcac1ab864eb97e30c352b26a58ed98fb9cf8eb7197b406850bb2b691b2aa92094ccff7ce1770ffd9d6306f484794e4e3d3034afeadedbb12f6d98eb3311894b59727b43e7aebd079446a91f87370ca51bd29d146148f8ce84a191d9533cc525638d626b74ba9106c6d3668d4ada40813464b15c0d8e4d31c4f1f4c3ab96ee4b5d379d10e760ab5314b38bcfb154b4db4bc37f206456a08c742a0f2d2c85ca23daee5e56c926b97f88705e0eb13a61e6de94d0ce4", 0xc4}, {&(0x7f00000003c0)="574caf09184018e4e3a4f0f65b3e19e7cdb6e955d7d171564f103a8942e87e9e960b5a60e510ac726f777c0c16af518a09f7cb680d13428ac02037c641e06cd0f077a39dc7cae5d47d88004f9da87f45271db2acb3b0babb0651e52174481841b8db3cd8886587b159707d042ffe01da785d6f23ed216cb3954fa0ed64c5189826636ff353fad6ff60f598b8fd1fd7736de89559d9d5487eac169d316e75929670bd", 0xa2}, {&(0x7f0000000c80)="c4a44e08ffd5a9f1225261c0950dbd138515bc3556a4cca52a33612d3a3ce2874dcb2d73012040c0099c3ab1e869f6e6cd449f81c74bd43cd7640f6267c5429cf9a11177c9293ed02963a8c129543b09b1dd712f55da5d59bf300a6214ba5cd079f640251a85ad6af28f82c59584638f26f2bb210a81237edd4f1a54e7e51f0d92ae6dca4dd44e6e2ff7592f344c3175a7b292f5e4fcbd8e00e0ea48577c7cc4de9861d355d95d5891dd0a16065ae74970a20fe41c3c624aca20e1dcd1a6df39ff8b1b549856973fc04c5a", 0xcb}, {&(0x7f0000000d80)="e0fb7951a5f055bf5337370e1c1a2dd4219af0d03f8bb356055f2401fcdcdaefe4d9cd802e6c5afdacd6a486eb86af72d09b2e2f97cd6d3d1a7fbb5b075683c010a012598831db031fa89e0f0e73b66f9c71449daa72cc7e590b201503da71a5cedbfbbd957f312bf286d4982823fc01868b199996f6b99d718b8881747bd09d2e174a9daa24bd153ffea80e37c51049a175c320c22602ceab6bcfcae53bae4d7758e5c444f4e15178b4b05d", 0xac}], 0x7, &(0x7f0000000240)=[@cred={{0x1c, 0x1, 0x2, {0xffffffffffffffff, 0x0, 0xee00}}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee00}}}], 0x40, 0x200000c0}, 0x800) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030030000b12d25a80648c2594f90224fc60100c034002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) (rerun: 64) 2.947148797s ago: executing program 0 (id=3229): r0 = bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socket$kcm(0xa, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0xc}, 0x94) (async) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0xc, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB='&\x00\x00'], 0x20) (async) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0xdf, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @perf_bp={&(0x7f0000000140), 0x6}, 0x100, 0x0, 0x800000, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.time\x00', 0x26e1, 0x0) close(r4) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r6 = openat$cgroup_devices(r5, &(0x7f00000004c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r6, &(0x7f0000000000)=ANY=[@ANYBLOB='b 75:*\tm\nr'], 0xa) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8b18, &(0x7f0000000000)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1d}}) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @local}) (async) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) (async) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x3, '\x00', 0x0, 0x0}, 0x50) 2.680283121s ago: executing program 0 (id=3230): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="85000000c40000007d000000000000189500000000000000"], &(0x7f0000000000)='GPL\x00', 0x5, 0x487, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffdfd}, 0x48) r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000480)="5c00000012006bab9a3fe3d86e17aa0b046b876c1d0048380019001931a0e69ee517d34460bc06000000a701251e6182949a3651f60a84c9f4d4938037e70e4509c51c268811000000000000000000002571cd53b9851b30599980bc", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000002a00)=""/238, 0xee}, {&(0x7f0000000780)=""/4043, 0xfcb}, {&(0x7f0000003b00)=""/4130, 0x1022}, {&(0x7f0000003a40)=""/166, 0xa6}, {&(0x7f00000000c0)=""/117, 0x75}, {&(0x7f0000000140)=""/99, 0x63}, {&(0x7f0000000500)=""/225, 0xe1}, {&(0x7f0000001980)=""/4096, 0x1000}, {&(0x7f00000001c0)=""/66, 0x42}, {&(0x7f0000000240)=""/182, 0xb6}], 0xa}, 0x0) r2 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0x12, &(0x7f00000000c0)=r2, 0x4) r3 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r3, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r3, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000480)="ec000900062b2c25fe800000f7ffffffdc8b851a238466cc80007a000000ad6e911b51818462b4003a000001", 0x2c}], 0x1}, 0x0) 2.422190864s ago: executing program 2 (id=3231): r0 = socket$kcm(0x2, 0x1000000000000002, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0xe, &(0x7f0000000b00)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff6a0af0fff8ffff1971a400fe00000000b7060000080000002d6400000000000045040300010000001704000001000a00b7040000ff010000720af2fe000000008500000049000000b700000070b2000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d761ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000f0000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a8321e056acf27c34bed69d32394c53361d7e43c5cbd8000000000000080231c61ccd106cb93ce1c0983cdcb48477b450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e44c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6bc7c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c460880000000000000000000000000000007a4604baa70bda5d5f18f54e9638350a6dd81a55ab5528efd1ef5a564908db7cce99e5c569c2947763b90e03b6d1a53b590e4ff4867f0d86b9af58244866b9df33634c8d85ce1b3bfa3e5bec6989c907c2f46b9a837676e07d87bb7dba3f34694ceb5b9faf10eece00bcfd503ed3f3048782665a848d79e443de4ba97db3a9bde69be7612cb1441c61eadd5bb4494ff2eb189c2ab3a241c12f764c0719650c1b"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x8, &(0x7f0000000080), 0x8, 0x10, &(0x7f0000000340)={0x0, 0x0, 0x4}, 0x10}, 0x94) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001e00)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a118000600014002020a600e41b0000900ac00040211000000160012000a00ff020048035c4c61c1d67f6f94007133cf6efb8000a007a290457f01a7cee4090000001fb7d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de61fccd40dd6e4edef3d93452a9247c47870ae1d092665c07a81ead0f98a952c795c0e9703920723f9000000008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x40000c5) sendmsg$inet(r0, &(0x7f0000000b40)={&(0x7f0000000400)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000100)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @loopback}}}], 0x20}, 0xe900) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r2 = socket$kcm(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$nbd(0x1, 0x1, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000980)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00009204000000000000000000000604000000005f6100"], 0x0, 0x28, 0x0, 0x1, 0xfffffffa}, 0x28) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x4, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000280), 0x4}, 0x806, 0x0, 0x0, 0x8, 0x0, 0xfffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) unlink(&(0x7f0000000080)='./cgroup/cgroup.procs\x00') r3 = perf_event_open(&(0x7f0000000000)={0x8, 0x80, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000080)}, 0x800, 0x0, 0x0, 0x2, 0x8, 0x3ac, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) perf_event_open(&(0x7f00000001c0)={0x8, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x910a4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_config_ext={0x6, 0x6ff}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x10000, 0x0, 0x0, 0x3, 0x0, 0x4}, 0x0, 0x0, r3, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x24048811) recvmsg$unix(0xffffffffffffffff, 0x0, 0x12023) syz_clone(0xae12e400, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$kcm(0x11, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0x14, &(0x7f0000000000), 0x4) sendmsg$kcm(r4, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x4000080) sendmsg$inet(0xffffffffffffffff, 0x0, 0x8000) ioctl$sock_kcm_SIOCKCMUNATTACH(0xffffffffffffffff, 0x8907, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$kcm(0xa, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8936, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_PROG_ATTACH(0x8, 0x0, 0x0) 2.11086057s ago: executing program 2 (id=3232): r0 = socket$kcm(0x2, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xffff7ffd}, [@alu={0x4, 0x0, 0xd, 0xa, 0x0, 0x0, 0x20}]}, &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x65, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000200), 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0}, 0x4, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8000, 0x590f}, 0x2920, 0x0, 0x0, 0x8, 0x80000000, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)="6000000022007f029e607dd75fcb520000a124b244de91f7f414adcf41bfafdd1b1e93c6292aefa3ca89563a63fb94b2584ca2faa20f2c308b0fe298acec10e3019e1e26e6efd0166e6c1b01132e5423294ac2f4d53c3870c3068461957e5357", 0x60}], 0x1, 0x0, 0x0, 0x6}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000000)={@map, 0xffffffffffffffff, 0x2f, 0x2028, 0x4, @void, @void, @value=0xffffffffffffffff}, 0x20) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x20) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000280)={0x3, &(0x7f00000001c0)=[{0x200, 0x9, 0xf1, 0x2}, {0x2, 0x1, 0x80, 0x10000}, {0x8c, 0xfb, 0x3, 0xd}]}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0), 0x8) socketpair$nbd(0x1, 0x1, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8916, &(0x7f0000000000)={'veth1_to_bridge\x00', @random="02000400ac14"}) 704.346193ms ago: executing program 0 (id=3233): socket$kcm(0x10, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x1c1341, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f00000002c0)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x4403b, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f, 0x2, @perf_config_ext={0x40000000000000, 0x3fef8000}, 0x0, 0x701, 0x43a1bd76, 0x0, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4140, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xe}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000240)={0x1, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa66a6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f375ffff86dd6317ce62070000000000000000431ccaf57b00000000000000000104"], 0xfe1b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="851000000000000018100000", @ANYRES32, @ANYBLOB="f0f605748aed0000000000000c00000045"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x90) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip_vti0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f2, &(0x7f0000000080)) 703.007854ms ago: executing program 3 (id=3234): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000300)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d004892e822a6abc02ad2602a5ad6f7007ea60864160af365935cfaea3f49d8df1931a0e64ffc4c78029ee517d34460bc06000000938037e70e457ae2bb24ef6697070000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r1 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x1ef7}, 0x11efa, 0x4, 0x98, 0x0, 0x2, 0xfffff274, 0xfffc, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r2, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000200)=r1}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x2c}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={r4, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8, &(0x7f0000001380)}}, 0x10) r6 = socket$kcm(0x11, 0x200000000000002, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYRES64=r6, @ANYRES32=r5, @ANYBLOB="0000000000000096e0326461a44dd3542a0b84501400"/35, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000049d4000000000000"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x7, 0x15, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x3}, [@map_idx={0x18, 0x1, 0x5, 0x0, 0x1}, @generic={0x1, 0x2, 0x5, 0x9, 0x7fffffff}, @alu={0x7, 0x1, 0x2, 0x1, 0x4, 0x100, 0xfffffffffffffffc}, @ldst={0x1, 0x3, 0x0, 0xb, 0x1, 0xffffffffffffffe0, 0x1}, @tail_call={{0x18, 0x2, 0x1, 0x0, r3}}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}]}, &(0x7f0000000480)='syzkaller\x00', 0x3ff, 0x0, 0x0, 0x21780, 0x79, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000540)={0x5, 0xb, 0x1, 0x7}, 0x10, r5, 0xffffffffffffffff, 0x5, &(0x7f00000005c0)=[r2, r2, r2], &(0x7f00000006c0)=[{0x0, 0x4, 0xb, 0x3}, {0x4, 0x4, 0xf, 0x6}, {0x5, 0x5, 0x7, 0x9}, {0x0, 0x2, 0x7}, {0x4, 0x3, 0x10, 0x5}], 0x10, 0x8}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r2}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="d800000018007b29e00212ba0d8105040a601100fe0f040b067c55a1bc000900090006990600000015000500fe800000000000000300014002000c0901ac04000bd67f6f94007100a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4b11602b2a10c11ce1b14d6d930dfe1d9d322fe04fb95cae8c9010000730d7a5025ccca262f3d40fad95667e04adcdf634c1f215ce3bb9ad8ffd5e1cace81ed0b7fece0b42a9ecbee5de6ccd40dd601edef3d93452a92307f00000e9703", 0xca}], 0x1, 0x0, 0x0, 0x2663}, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$kcm(0xa, 0x2, 0x73) recvmsg(r7, 0x0, 0x1f00) sendmsg$tipc(r8, &(0x7f0000000240)={0x0, 0xd, &(0x7f0000000200), 0x1}, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000004c0)={r2, &(0x7f0000000300), 0x0}, 0x20) recvmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000002e00)=""/4104, 0x1008}, {&(0x7f0000002d00)=""/197, 0xc5}, {&(0x7f0000001ac0)=""/4147, 0x1033}, {&(0x7f0000000040)=""/43, 0x2b}], 0x4}, 0x0) 701.591914ms ago: executing program 2 (id=3235): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1800}}, &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0x3, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xc4f, 0x0, 0x0, 0x0, 0xfffffffc}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x20, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r3, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) r4 = socket$kcm(0x11, 0x2, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) close(r5) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000180)="5c00000013006bcc9efab0a6ffbbdca6156b876c1d0000007ea60864160afd6514001ac00800020002000200050007c00364bc24eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0001000000e4509c5bbcd72c6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x1, 0xa, 0x5, 0x7, 0xc1}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000000)={r6, &(0x7f0000000100), 0x0}, 0x20) setsockopt$sock_attach_bpf(r1, 0x107, 0x12, &(0x7f00000000c0)=r4, 0x4) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x89e2, &(0x7f0000000040)={r1}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x4}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee162fd4b8bf4a31accbe1ba0777cfbf6ae77256da82f6184b8a34f901", 0x39}, {&(0x7f0000000440)="63f805d7649496db729598", 0xb}], 0x2}, 0x200100c0) 678.224665ms ago: executing program 1 (id=3236): r0 = openat$cgroup(0xffffffffffffffff, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) openat$cgroup_devices(r0, &(0x7f0000000100)='devices.allow\x00', 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="12000000010000000400000008"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800"/31], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) r5 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0x5}, 0x104101, 0x4, 0x0, 0x6, 0x0, 0x0, 0x1}, 0x0, 0x1, r3, 0x0) openat$cgroup_int(r0, &(0x7f00000001c0)='cpuset.mems\x00', 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRESOCT=r7, @ANYBLOB="a66e9518d1b3ad320892e11b322b1afe7ad5816f438ea5ce468e02", @ANYRESOCT=r8], 0x50) r9 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r10 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1400000035000b63d25a80648c2594f90724fc60", 0x14}], 0x1}, 0x0) r11 = socket$kcm(0x10, 0x2, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000f40)=ANY=[@ANYBLOB="7a0af8ff75250000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000007000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651064d08dde084e0c7ffddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e13b2f9614d547244a22000000000000db453620ce72d75946c0b638d91dbef661935839c77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f4942eb613eff289026d5045ef4a96279856076ff7ac9ba09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be22dda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed5441218c54d0b3e9f298392b3276fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314d7bb31ad9713d249499ed0d8a24abd57e052888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f000000eaffffffffffffff0000000000c9b46ff99a039eda74f74fe532dcfcd2c315b626fd768dbdf00fd532575767a7bca3968f50c20cfcaf91ab14b77f87e476bcf45fff904531adea62a517702743bf3492c8952c8e1fc37674de47d5881750516404c647fe02085b1a9603227411b17b6c7bc84fdfa0cfce589550df8faeeae5ca5024b374da260be559a741d22370373392ed74a7d1aff96a5b59775237f50c6bd8e0c4a7666be5962cd0931845e659a03a48fe85d370d9b6b755a2f66989da880c899d4d1c6757be6baffdce49b8c81f43d933549289dd475e39f399f6822a111ed8142b5dd2c01a15c949d86bd93b580800"/798], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff96}, 0x48) setsockopt$sock_attach_bpf(r11, 0x1, 0x32, &(0x7f00000008c0)=r12, 0x4) sendmsg$kcm(r11, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000320081184e81f782db44b904021d080005000000e8fe55a1180015000600142603600e120900210000000401a80016000400014006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0xf1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e009, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x2, 0xf}, 0x2018, 0x0, 0x0, 0x8, 0x1002, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r13 = socket$kcm(0x10, 0x3, 0x10) r14 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r15 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x1f, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000feffffff180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000800000085000000b000000018110000", @ANYRES32=r14, @ANYBLOB="0000000000000000b7080000000200007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$PERF_EVENT_IOC_ID(r9, 0x80082407, &(0x7f0000000200)) sendmsg$kcm(r13, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03003b000b06d25a806c8c6f94f90324fc600e0005000a000200053582c137153e3708500180040010000400", 0x33fe0}], 0x1}, 0x0) 544.296782ms ago: executing program 2 (id=3237): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="06000000040000000900000008"], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0xd, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018150000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000ffffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000d000000850000000500000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000040)="5a6e41dea43e63a3f70cff11c72b", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 415.969178ms ago: executing program 3 (id=3238): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000400000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x100000, 0x4, 0x2, 0x0, 0x80, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffff7fffffffff, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x7, @perf_bp={0x0}, 0x0, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xfffffffeffffffff, 0xffffffffffffffff, 0x2) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) close(0x3) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000001100), 0x8) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@bloom_filter={0x1e, 0x0, 0x1, 0x7, 0x4, 0xffffffffffffffff, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x5, 0x4}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000013"], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x26}, 0x28) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000780)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) recvmsg$unix(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001780)=""/4071, 0xfe7}], 0x12, 0x0, 0x0, 0x406}, 0x40020000) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0xfffe}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="1c0000005e007f02bb3b472a0c9b72ab25399cd956c07dead6a93690", 0x1c}], 0x1}, 0x0) recvmsg$kcm(r6, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x10122) r7 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r8 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r7, 0x89e0, &(0x7f0000000200)={r8, r0}) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) 414.638949ms ago: executing program 0 (id=3239): perf_event_open(&(0x7f0000000040)={0x4, 0x80, 0xf0, 0x0, 0x0, 0x0, 0x0, 0xaa9e, 0xa3141, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x10094c, 0x0, 0x0, 0x7, 0x0, 0x80000, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffffe}, 0x0, 0x4, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x9, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000", @ANYBLOB="0000000000000000b7030000000000008500000087000000b7000000000000008500000008"], 0x0, 0xfffffffd, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$kcm(0x11, 0x2, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x40000004, 0xa021, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_bp={0x0, 0xc}, 0x100084, 0x10000, 0x0, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = socket$kcm(0x21, 0x2, 0x2) r2 = socket$kcm(0x2b, 0x1, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b28, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0xaf) recvmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x11164) setsockopt$sock_attach_bpf(r0, 0x1, 0x26, &(0x7f0000000100), 0x4) socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000900)=[{&(0x7f00000001c0)="720bc7a8f18963ebeeca69e314d5d936f80df22fcb5ddfe7786ebfd39e4d44181794c0366d2146bd3eaf84af42390945cc4c2bd6e6ef0b7a7a59f716445ebde3859a496903fdc34452a229f701bdf1a1d8ea0cdc3547b0afc7d8d0756848cfe01a49634e2954fe9a85e185b7140e11a96572daef76c35ba64dacc54d15eb967cfd9ed639865b491e48ce139fdc8f43e00740e3059ecd04191915638a3275ec893be2621f968a0f209c13aa8c188deeb0cc5d98e71a1e3f5eea7143bde0ef2475af66267aa98796883aefdd380d1fbe9e5101f8f975e2facf33025df7bb22d45855c9d66ba6984e"}, {&(0x7f00000002c0)="eebc9095ab17687d6df3fb6bac980c90766b7dac0022a64dc6f3e92cbcf9cd1e1352fe2c52"}, {&(0x7f0000000300)="d6573f5f3340a95066a83bd5135ec9c92edcffec3937c14ec6c768ca3e14e0023fa18e97c5295ad7331fbdf724d236c728043cfb809ba65b51528186e34cc4e142eeef0de3ab2b3babdd906e1c951ea236d32ff8a158014b73c5f9997e4573010c85eb918ecad582aa5c79aa3fb9e2e6fae53669e7825744193e01172c3ef308602268ad7858e0815ec83a0e809b2a31"}, {&(0x7f0000000500)="169cca9b20f534b547a05f07e8dfe148e5b1bae2e8502fb41bb29a59d8c54320329d662842ba5e5da31a242786b6cde99453b7819e81d9bc5b8637207284e49a0705aed53db670bd6504a3cb3af30ca61c5d69fccab90da117542f0bfa7d7265960b121ec65acc41cc4b60df1d6eb4899dd8576f05f2687dcac854661feaf94f40ca7e25dfbb4dd6dcb04fa820e0de8d2c1d81f9cab780b8e1614f65627f5db38efd45d13bed87611fb1ae1e80ce7d96f8a21ff8139bbbb60e6d55578c89337752f9d175951ec0b26aa515a310d101310fdf19c6c01e11133db1"}, {&(0x7f0000000600)="3779a6314fcd7a5931ed9683ef0b060dbde0d441e362db4e5a5e9dbffbb2d83d7263202bf1cbfb09795f852baf5885370e040c8a"}, {&(0x7f00000006c0)="6b965d7d8527bba96b370935467f379b67a0653dc5c4180c34c73c077bd8ea13ee8fd049f32017c2fdbf3c2832b39c85953e5e68003c8e77037723b29e201ec339c7e8e5aaef3f862e5a8a97b63dfa7da656d29b8fc7208da4e19791a4f4f68462833bbb6542fbc60597173c202613464d3e00873c681a565f195fdc4a0ffe8082d67670ab3406187f8b8777db506ea6e886471664f8cacdd3557ac8602709d547a76b"}, {&(0x7f0000000780)="57fce473b8aa53f26f3e0c659ae708d167e62ee4c992ab93a322dc3e5a95c6c86fded2edd1ee6b47a1688d8887db5151919819d5c6116b5ba9a4ae79efe4ba5526"}, {&(0x7f0000000800)="f9db55dd89bd2ca1dce4800bbf931a2b6171"}, {&(0x7f0000000840)="07a7e609cea2c1cefabb0a3dfcade2c6ae16308ff6fbcb9bbcb6f0229a"}, {&(0x7f0000000880)="b946c419107c7fa7fe0619fda5effe2f2f2d2c91e775321320222027eaa18a931de45e786ce89b66c046c851394f69bc3fb96e7d30860af728650fa26f48711fe3ced60aed4d2a21f853e802c92e0b1d393fc0e1de"}], 0x0, 0x0, 0x38}, 0x84) r3 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f0000000a40)="1400000029000b059c5e9e41041b5ad22507a178", 0x14}], 0x1}, 0x400c810) write$cgroup_subtree(r3, &(0x7f00000003c0)=ANY=[@ANYBLOB="08667265657a6572202d70696473202d64657669636573202d63707561636374202d72646d61202b637075736574202b63707573657420e1f9e53b36f294dc744f00400c8b32a3d5454c3860f5285f6a9404c44a"], 0x37) 374.55073ms ago: executing program 1 (id=3240): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r0, 0x1, 0x9, &(0x7f00000006c0), 0x4) sendmsg(r0, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001b00)=ANY=[], 0x1160}, 0x24000001) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000019c0)={0xffffffffffffffff, 0xe0, &(0x7f00000018c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000001700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, &(0x7f0000001740)=[0x0, 0x0, 0x0], &(0x7f0000001780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe9, &(0x7f00000017c0)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000001800), &(0x7f0000001840), 0x8, 0x20, 0x8, 0x8, &(0x7f0000001880)}}, 0x10) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000001a00), 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001d40)={0xffffffffffffffff, 0xe0, &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001a80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, &(0x7f0000001ac0)=[0x0, 0x0], &(0x7f0000001b00)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x61, &(0x7f0000001b40)=[{}, {}, {}], 0x18, 0x10, &(0x7f0000001b80), &(0x7f0000001bc0), 0x8, 0xc2, 0x8, 0x8, &(0x7f0000001c00)}}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x5, 0xf, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000ea000000000000000700000218110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b70200001e786219b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f00000005c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100ff}, 0x94) r6 = socket$kcm(0x23, 0x2, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r6, 0x1, 0x3e, &(0x7f00000000c0)=r7, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89e0, &(0x7f0000000940)={r7, r7}) r8 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d80)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xdb5, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x50) r9 = socket$kcm(0x11, 0x200000000000002, 0x300) sendmsg$sock(r9, &(0x7f00000000c0)={&(0x7f0000000040)=@phonet={0x23, 0x0, 0x0, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000440)=[@timestamping={{0x14, 0x1, 0x25, 0x3}}], 0x18}, 0x0) recvmsg(r9, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000140)=""/25, 0x19}], 0x1}, 0x2002) bpf$PROG_LOAD(0x5, &(0x7f0000001e80)={0x2, 0x1c, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x633d49e7, 0x0, 0x0, 0x0, 0x1}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x1}, @jmp={0x5, 0x1, 0x9, 0x6, 0x7, 0x2, 0xffffffffffffffff}, @call={0x85, 0x0, 0x0, 0x2a}]}, &(0x7f0000000140)='GPL\x00', 0x9, 0x1000, &(0x7f0000000700)=""/4096, 0x41100, 0x1, '\x00', r2, @fallback=0x38, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001a40)={0x2, 0x0, 0x3, 0x7ff}, 0x10, r4, 0xffffffffffffffff, 0x2, &(0x7f0000001e00)=[r5, r7, r8], &(0x7f0000001e40)=[{0x0, 0x1, 0x5, 0xb}, {0x5, 0x5, 0xe, 0x8}], 0x10, 0x3916}, 0x94) 297.447235ms ago: executing program 0 (id=3241): socket$kcm(0x10, 0x7, 0x0) socket$kcm(0x1e, 0x2, 0x0) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x1546a, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x8, 0xffffffffffffffff, 0x0) (async) r0 = socket$kcm(0x10, 0x2, 0x10) r1 = perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x804, 0x14c9, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x803, 0x0, @perf_config_ext={0x1, 0x4}, 0xa0, 0x58, 0x0, 0x4, 0x2, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x8) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x114905, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) (async) r5 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000640)="1400000028000b6394f90509a16dd8e50000cc5778", 0x15}], 0x1}, 0x4000000) (async) r6 = socket$kcm(0xa, 0x2, 0x88) sendmsg$kcm(r6, &(0x7f0000000480)={&(0x7f00000002c0)=@in6={0xa, 0x4e23, 0xfffffffc, @loopback={0xfe80000000000000}, 0x4}, 0x80, 0x0}, 0x20008810) (async) r7 = socket$kcm(0x29, 0x2, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={0xffffffffffffffff}, 0x4) (async) ioctl$sock_kcm_SIOCKCMCLONE(r7, 0x89e2, &(0x7f0000000080)={r7}) (async) r8 = socket$kcm(0xa, 0x6, 0x0) (async) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000e000000850000000800000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) setsockopt$sock_attach_bpf(r8, 0x10d, 0xa, &(0x7f0000000000)=r9, 0x11) (async) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x7, 0x441e, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0x4}, 0x0, 0x10000, 0x8, 0x1, 0x8, 0x2020005, 0xb, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) (async) r10 = socket$kcm(0xa, 0x1, 0x106) sendmsg$sock(r10, &(0x7f0000000400)={&(0x7f0000000180)=@l2tp6={0xa, 0x0, 0x7, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x6}, 0x80, 0x0}, 0x2004c040) (async) sendmsg$kcm(r10, &(0x7f00000019c0)={&(0x7f0000000080)=@l2tp6={0xa, 0x0, 0x703, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}, 0x400000, 0x4}, 0x80, 0x0}, 0x20040010) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0x40086602, 0x110e22fff2) (async) bpf$MAP_CREATE(0x0, 0x0, 0x50) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffffffffffff49, &(0x7f0000000380)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90124fc60100c044002000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) (async) socketpair$unix(0x1, 0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) socket$kcm(0x10, 0x2, 0x0) 234.921328ms ago: executing program 1 (id=3242): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7f, 0x7}, 0x104101, 0x4, 0x7fff, 0x1, 0x10, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x6, 0xf, 0x8, 0x41}, 0x50) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe5}, 0x94) r1 = perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x4044}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/ipc\x00') syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = syz_clone(0xc0400, 0x0, 0x0, &(0x7f0000000280), 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9c, 0x1, 0x0, 0x0, 0x0, 0x5, 0x10102, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x40000}, r4, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r5 = openat$cgroup_int(r3, &(0x7f0000000040)='cpuset.sched_load_balance\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f00000000c0)=0x100000000, 0x12) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000ea05080000000000000000000000b989a7f60ee033743dc32e786c669113e8afeb8fad", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x10, &(0x7f0000000340)=ANY=[@ANYBLOB="1806000000000000000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7030000ff900000850000000c000000b707000000000000180100002020702500000000002020207b1af8ff00e90800000000000000000007010000f8ffffffb702000008000000b7030000000000008500000000000000950003000000000033bf82144c01a46ce68ec13b45db"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) recvmsg$unix(r8, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0x12, &(0x7f00000008c0)=r9, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback, r9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='hugetlb.1GB.usage_in_bytes\x00', 0x26e1, 0x0) close(r10) socket$kcm(0x10, 0x2, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$SIOCSIFHWADDR(r10, 0x8b05, &(0x7f0000000000)={'wlan1\x00', @broadcast}) 233.394698ms ago: executing program 2 (id=3243): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x2800000002000000, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x500, 0x4000000, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="0d2e0020fdcc6177d93790ff", @ANYRES32, @ANYBLOB='\b'], 0x0}, 0x94) (async) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000), 0x10) (async) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000004c0)={'ip6tnl0\x00'}) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8003}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x8, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) (async) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000002c0)={0x4, 0x80, 0x1, 0x9, 0x12, 0x1f, 0x0, 0x0, 0x802, 0x3, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1000, 0x4, @perf_bp={&(0x7f0000000200), 0x6}, 0x2, 0x8f9, 0x6, 0x0, 0x9, 0x6, 0x0, 0x0, 0x4, 0x0, 0x100000000}) (async) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f1, &(0x7f0000001f00)='\x14\xa2\xce\xba\rC1\xeb\xb7\x15\xf88\xd3\xedC\xb2\x92\xb0\x9c\x90ZI\xaa6U1\x00'/37) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x34542, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0xe0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x7, &(0x7f0000000140)=[0x0], &(0x7f0000000b80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2a, &(0x7f0000000700)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x75, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) r5 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0xf, &(0x7f00000002c0), 0x161) (async) sendmsg$inet(r5, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x4000000) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r5, 0x1, 0x3e, &(0x7f00000001c0)=r6, 0x4) (async) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000001ec0)={&(0x7f0000000580)="ef4713ff8cc3ecc23bb7df0b4704b32d4e6b2f7e98f0e58fe635153236519d561366f5e2", &(0x7f0000000d40)=""/66, &(0x7f0000000dc0)="141758125b24b332401cdd66587324f5d1a445a31078593d30a9a3100b586a2fa26ca380eb33a1b342e2bde0d5bc14aacb69cfc40c6626201da4b8d575f82839de4711b75362bd2df9a9f91c6d995bc46def0310575c75e64258c11b45d0441914f2488fcf17c5521178b5440c7f92450e7ee56942251f86c088454c2b3c4c7a1c7e52dbdd26fa25a52256b58836b3fb4c342f10acc164c1496032110d1c752df42212e172c1ba658581e73cd0d907e960dc4731e1d184a08934f58eb2ddeee16e27f09e227645a1d481c8ad3f94d86cd4d65e74df49a56b297d81dbf34c7a03975f7516b94e4eea2465205f4a8240aefe7706873568bcc1c80ac53eb31bee75f44cd93713282a447d6e430536efefc03fc68cf8798e64be5816e8182a1211b2afad67e34480cf00b31eb30645917cfcb3adf1067f4c9a908412ec7037fedbec8908c93c14610fb6a62f283d0974c6ee566a02428efb3a796437f327e85240e25ad6fdffee81e53c845285b6945e97dd991a85761cca2b8cbb7be89a1cd154828057ead72e838b0cb6014d5c33a7ab18ce3d18f9b587944c369d053d92736f44fba874c1069743ce1738fc8f943bfc5a85087977864ffc60e21aef7aeca3eada445b3fecd89284174c9fdbd6b063d75de6aa364a8df47d42fc83ce446523f311860f21978f245ba6b1ee87c6e5300efe247fe1d7db84eb93b08eb2aef6069aa4e9f3f2002aadce5d5b23da9b68deb302ed285ca49e9b8f60aaaef4bb52f1b015ad51836c19af24e8875f4d41e5295b4a86b9298b0733c7e2003fe1a0c881495c07fab2a434ceb8ca0e1c03d2ff1e33f11fc05a669328c8049873646a5a8713db05af7c5e67422d7b96419e4b9b0d471287a0790d7847bf15e52863910eff8d3a4a3c9b71aabd7d6d6e795cbe57317c1feb501cf73d55a3a9b16fd6c2555ce0895fdff56c5c72b48ef530ba73d6ed38dc33ffb9cc1d7b7d8527d8534160d955104cce97498e4ca10dd8985efbfa7fe8f8582ac58211f818449f92eb0613fdddf4dc38851371871a22655239577b191e4045b620ce59f4e6a507e30095e25b5d02203760549996ea711597ca8387fdeffb813024d4d2ae4d589251b18d7857bf2229dec77f1be43c64e1725b33502a5e84eb0bc662b5be1b4e66083b418d5f2df3aafbd0e3d9561eec48209f2c22083047d40e82e70df18f80d4d45ab7eeee93273ef8f76d8fbd6c4572db799a59494853a192a7f5eccc0086917e5ac95dacc0f6bfee84bd8e48477233992fa9228bfb41e73b421abe454d02805be993bc321e0528b48c31594d0c4ad9d9addf371c4b37f46222836896ec19c5e958a3c517d092b230ffa74e03b702d8ad8fe8a0f7b6ee2bd244b313bad85d88c1327acc4e0169504301f4059d05cf46edef1faebe15ac32f4323a9b05d350c06b90cbcaea5d1ae8ba7827669cc3fddd037295d1dfb5e30a9aaee7a395f6cc8b0412b72672d73457c11dfd6656c59af86d2861f050b5a6cc5f285473992738e7b0b7c056433be5940da355871165cc3deecf20719c5d51728bd3ab67c5e9cf7bfbce9533bdad193bc60fad95dc4eeba3af6fc295a1f081509a9d96091f1e16f36697cb8c0a5ff6a424fec1a511b587e5dfbf3ff2b9f746afe9798bf1552a47b21539f72a6be7033c9ae077e8760f5b1e842de8b2ef243dc6821b1f592151a4bd3d4407674bf751e670c08ac59511825b6434f3b00c2a57332c3e77ef0d189d2a3c3e9ee82e32012ac744ee71912747d6e47f8aac496eecb96c3a3f49a946b63f1cb0447c8f48758c27618ead4f93c9807ade67b902c7901aa18795a2e322ead53145d36e26f002b1a2e33d3344a2cf64eaff0d360f6a305e1c432ef57f9a652ce3743b5fce4491df527399dc8ebc8d8b200832d97583819bb5dcfd4a6db66db03d84b17bcf9e7e88d3df6c425236ff67467e569323b82f4a5f9be15be334e13c553ce81a55c3195f171ab97b458300894e99e7f5ea8f4a026a86b480c0601c9021214d9e1faca1417fcc53e20f42736851415b005bb3bb11bf81ed6878f7e42f793b1bd745166336bef0aaddc566c48036d89e51af9e98e38d65ad56c61ca300b52d92a07003e946b7e9ccbf36804c3659e56129e4701a3c6de20233be93a8a2c0783bbcca4f96a0459d938c55f32090ecfce760c7c63cd7aeaac9259a6959b2d81da47e8a957ac01949d5995ae6fa97651ae5ca25151cd5f555f6f70ca22b919764cc5b3878bb74601149ccfb4ee1531b0322f9747b7685118d0e9fb0de7df91becd21d36906c3b13dc42990d6a947023d3559131b3a81837ba8301391fc2037afda4c86b580ff0675d0137217d2d4e64b72d38cffb9079886b8e53a37d6bb1400ff02b30cf2458a5c00ec5e58d9d0a5f4193e9fc711f2d142b3419cbdebd6f36e67518ad74ee82206c16c9b6649b939f3cd0bdc7c666fed354f9cafcdb5a2a170164a8b0a543bde24e0abf0b4d0282c0f5204b97b6b3d2c043db22ea7e3262705110cd10e7acb41ce5cb79431ab22cd0a82a2ae1071519bc65f7b4ddfab05dd4f463335819acac9838705f371cc4bde7ccceb1a8e1c9a6ff9138e3b2f71037d6030314fd2640e319e4c6881f54781010211115ca243227ae9f5bf213b28dfe03607fb141ea079de6a03a5e33795ff8d882a5d5e4c7aa0ec2a97f25bbf740c6b6f6427c8233644afc74edc7a40883ac038734b4339cb62c33965380d287aa11c39f16fb7c60dae3ec22471c1031098cb973e966aeb16ad934a20a7b7c533ddb8f11bd62877bfaf20d816d8650ca4503ed8d7998d1dcbf4e1d02c8f9fe97a0f0cf87562581e0267d188dd03f4dfc65a8c4fff64e37fba7ad4497cecb1f27de23a30d9440f839f8329f1425ea645ee784a4cb516b81cbf96c36094d4370284a2b68ec807041443dd30a6642bc1ba27be736734513d1f0fd3a12458f367bda1d7aeb796c3eb492288090cb506f63ff2e6a1d382ce7841763aec51c18851bc7f638894cdedb6560c577c5412bb1e533427afaebc147787ec1b548afc6d4c78c2b38167c012f6b5e88c3579842da0bb68fa5e09bc068929e085aa0f26bfa69cf991b11d0e36c2cee10173e7c624ecfb4dac514e5998b77f3e5ec70fbc1f8fb8d2a24788b901ff61aed7eb6763c17e510c360aee4a3ee15309431ac9082a7a512cec0019255e5f0e1cd26ac1e3aea772be605a7fcbf2521125aaee9a6e074bcb8ada6b8b52a271e5c534d6e525db458bc323d6436f790b118660d5ed32ef1c921cd1d6a19e4ffe0704d1ad84cd303a80bbbe96738a94737a742112804303e9875cc92e99a1bf6b814addf891d049a847d5dde6f0bc504f56765e9c46bed3bee96619ebc2d053dce30cc7f9391965ca0cdf4c7e1b477c0e37a7a81ddbdf609ab9691176e5e1f1961252b59eeb90efdf18c4a1204e42da91134058754907bf5d11ced66a8e3b0be8fd382223f677a8b4ee2dfaa3d22e6ad915e16beb6996f76005cb2de269497db757e91cc8daa59f4715b8502a71e6175e7a029b027369bf80f25d67a56f16125227a7b90a69a5826af29bfd24736468981a70e01bdff9f0d71213ca9a5bef83c85fcf546d031c2f0a5c5446619a11bd9d9883587f078cdd9079698c14f22997f0cac0a738ecc597ebc0f25baabe4b2b6dba0bf6a1ca146d19b49fc8b71bd5e2a285d255b9ff8437e3bfe1e9192dfe953f260c2f27758e823c262a001ec034bbe3ded9a04fde9555199d51a056a0e998708c89c0289e0d50784eaf95cb36124b805214d84e7207911ab267dc78ab471f00a5e603d9f7def8ad80f06368c7123e23c3ab59552a500def400870a9ed5cb34d6f281483f57ec9652451b68f61cfd4b0e56d6db00e24a54a943d7adcae7dc10593633d97c537f21819d939c7fa84eccd46f6481486a10a7ae9fcbb7161759f4c32bd41c831294c2f64945d0a22aa2737791be4c7e204d6ec14ce7518f3f496f2f6be865429229be7ecfeabcf2aac112f4c707ecfe2d90b3eacbf646a6f211afafa1ddb7041173ff918acf274d00c9a397a8c76b89568bbefd824ea38831e27f3c820c0e017f6cff36e8a4d647bc0707af46ad3044d40d41e0f4a00538e394fdd6a4fbf9d72bda1f7367f3841e4f0d7af756e2754f5ce47d133fd460955ca95c5f48337588185e128678b96662a6aa2a05b83ee95ba318740736ee75415175184aa223790040e1ee74559f4438a4129a64a27215d9d6b38c64460cfd1c6ddce1c588d7b498f6ebf5eb3b5a450be9003d35849022928b5171adccaf9880ac525f01d9f6b911c35fe2c49c05749bc6d5e8c7454e1383fe9de2a4d6f382f289d834d18d4f75e5ed964ecb732b0de5271abeeec03776109b869a1904d291db5420a8b31d772e239a25a0d8c1454d37081833292b3284515c382329505d175d938a4a4ba5a9846a2963fddf392bf461806d687b31c9dd40c47011c57b4fbe786395e190e5ce9ea911ad14d778b6f027d262a0a9e01789c531aa972f98229e69d105e81ab6c1fe17952e80c60fca461ef387d1b985a3d26ecb969a10a40a4c464bf99c8ac7aab54143c7dad6a738da798c10b306e5a6206356927bc38e5b0952d22b1b6201a4fbf6aedd37775da3bf5f4125e202130dbfd41207971c6802e4f97dda0b9b95c22fa082152a81b4023c0aa38f8e9ab66e495f11a254e34ca7a44966faacda498d8e6b7094ef28c03fea9ff0d4e68aa8694f572f424091a220f6f4c23774f5229ab4ca90bd0838ada051392920f417189ec0993341d43fa4795b6490fcdb5ffe47b596e61e2e6d6e200041000601dc0af127a5b898244ac68aba33abf09cd364970b6f6982eee1b038426839758aa897d2cccb39c498e0cebf5de33881124287981b9b39313c22fec06f9e33749d91e1224b55a3532b0215b352770173c454c693a551dbcbcd83b47b51084e52a9e238f8ee894f85a8cf77ad70bd0d8ae65701de7e4c3e7605e2b6137a595f4c23724477f358db2bf0774cbd381c089d852a358995d833258d0fd6cf648ba4a8dfc3d97f1dd2b9f61d616f2a438e80bcd930bd306f89410016aa8290df495c005f4e4c5e67641efdf83634bd5c587cd19a6e625c024642252d7bece82ce0f5ff6cf885442c3f1c026ad4e74620fe8c8822ce0ed1b084f9160671451814213a79c321ad12cab333c9c30561f113891934d88f2b7fd7153b06639876d370e24d69de5d0adba7a7f5049cf2b341139689e228a720c6f566f1da9d59261bf765fb6cab3d740be978d35d5a8d7f151d02297ebf423b668c74b8a033652e0914d3e469eff51ea3d469c2ed9148d272f3b49e2fe38eb0d7a1ff37635d208667d4421fae33c76f8ba4b0f7d5a59e04557d4b5e4867d933438e89875bf1ff4192db2ca4da570acd07f8616fcd35321a2216b0844132a76d8ec1619a94ccc59949a3d09e33c2bed7de93c61bbcc4a5058ce2b274786260f248541541567455d9f41d9d7e5ed3ae7b2130154dda42967ed1e2a9ba009b02bbb4e5af5446831fd62450c48d1b22d83c5731c2264df95218ea627b1ce6530caf3b7d3b4822f183444b90035e00be80f97bd706577c9806b86cc83319c25f00f7bfa53764fd3c4993047b3cb77dfa4145e06029a8c51941d282808761d7cba98529a1d09602cac8ae7f571d092a5aca34630b450cddebf9f0e93cbfc4813c538c2a123eecb0ce418015db2d2928d77a607da3dbc4cf442be0e34a0dc432f0ba5f8b26dde133f7a35e74f4b0c0fcd949fc7e", &(0x7f0000001dc0)="b25e07b29409dc9f682f1d9e7259d32c3c50eaad6b2b64032d246b9f5b1810e6426344720907b05b848bc49d552ad13c219f7bb87fe541fe98eaa7d8e6a0304132cdc0131210253b0488083811f9633adbea1866e35c86519ac47481d8879ea571a7f3491ab2d080674be008ace072c23df77ce2f833bf7b7b35a06b17a09c3841592541a0a40cd5f96e20ddfbc11a2c84f884eee54cbe3286bae44524fec139cfd2248fb30308c5d94b0813f565593fae365f5ae7a4bb0125f979bb50ddd49959072bb9c1097151e1ba86490b78474c707561cd61cb8a29a3de472e34", 0x7, r6}, 0x38) (async) r7 = bpf$ITER_CREATE(0x21, &(0x7f00000000c0), 0x8) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r7, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) (async) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000500)={0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000000bc0)={&(0x7f0000000540)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000000b00)=[{&(0x7f0000000800)="3685c5225211b8dea2598200b3404ba8ae4de96d052c0ef0dfef3bf800692463e0914d2e9b6d6b969aac5736a9b1a5ed666cda2b6247275e34a6c1a06e2eb03f840860d917a1ed5ee2c4489af946e6d7d4b3332da65acdfca04feb845f1b3f743fee1dd7b5b1f344a959f408bb33aef82813bf47a3503f894d7053d793", 0x7d}, {&(0x7f0000000880)="108160a5f3939eac2826e80dc74bbf675660e6745a33ce7db0f514a18bfd8b5a3adca146bd5abcebd6af7d94e86d457c2089fa21d9b83d71362a097967e1", 0x3e}, {&(0x7f00000008c0)="ecdab0e1ac3073de4ec3622eb2ea996a4adbb084f21185eecef2aa4d64fbe284be5b1e414202193b2a42ad67289bc8b823a97e1031108b3580ced61d985cc0b78c721bcb8cfa6dc43482e6c7ade2ff6147b21126fdf58d846761b3e975d82566c4dc62351a0d1714b81452aa720b6a82cf6343bde0618d903b8f9c454f9f61874ed8bc5817d5e25f0732bb7ac2fa2fc9500ac88fc720dcdc8e0cf65a57133deac3114c524722bd974a9f", 0xaa}, {&(0x7f0000000980)="86a0f2dc8a6860a5290d4557102a1db03a027c7b13a6e20400de63f115dbd32379580515b92f1c537564d73de5f679957ba17562dfb7b78893b0e2", 0x3b}, {&(0x7f00000009c0)="7bbc97b9bbe3828b57e9238ab27eda355f03b516ca7ffbc0ed6c2ba873c1eb330eef7b79b22075d6d238af9eebe173feab8a6edf8078d50df69937855a2ac9220f4d9fcdcc0b539e26fb053bbbfc17eefb15d56187497b365eec4c03d76bf0329ef1faef5ff59ae83c20d2834c702c", 0x6f}, {&(0x7f0000000a40)="3c66d7e22723945c33e207c4", 0xc}, {&(0x7f0000000a80)="786913abde196c4b627cb91c8bb212b0716222", 0x13}, {&(0x7f0000000ac0)="93f9b9d4bcf3ad044e25a10d3e2a29fadd5220d287957e724698fa4030b48f725cda47a6c2355f8fbf36a600c28ad3301678613802", 0x35}], 0x8, &(0x7f0000000c00)=ANY=[@ANYBLOB="1400000000000080000000000700000000000000000000001400000000000000000000000700000001000000000000006234852491840a8463fe6066eed0d009b257281fd7de3d606c4f55a88f8511848433ffcdc61d8bbb31d6a7d8bb373d4a2ecce4a78795680dfbdd2a89c79e102df57919c6987f06932e8cfa13c6696a70e5d7c5d4ef3a496bf1c44066ed3041c416e77b6fcb54209aa7d9aa6e5110f8e2e6dcea3890005b6fe42674826a55ef9c5d832ee0e458135664a5dc3aa67c946d93b0d210d25bfa62a5a7b0b292ac15a6e122b0fa6f053b0f5aeed107fc5baf4d7bb7e35e391a3b4b391b45120145c409440a3cc18421e78261c4ca9d45c66a4c8d97bc18643a"], 0x30}, 0x40000) (async) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r6, 0x2405, 0xffffffffffffffff) (async) ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000480)=r4) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xc, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000081000000000000000400063018b000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 56.216667ms ago: executing program 3 (id=3244): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffff7e, 0x0, 0x0, 0x0}, 0x94) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b80)={r0, 0xe0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x1, &(0x7f0000000840)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000940)=[0x0], 0x0, 0xd2, &(0x7f0000000980)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f00000009c0), &(0x7f0000000a00), 0x8, 0x1a, 0x8, 0x8, &(0x7f0000000a40)}}, 0x10) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETSTEERINGEBPF(0xffffffffffffffff, 0x800454e0, &(0x7f0000000300)=r5) write$cgroup_devices(r4, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000066700000", @ANYRESDEC], 0xffdd) 54.678958ms ago: executing program 0 (id=3245): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x4}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2c}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0x58, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f00000000c0)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="1400"/12, @ANYRES32=r2, @ANYBLOB="e0000001ffffffff0000000038000000000000000000000007000000890b14ffffffffac1414bb940401004418f290000000000000b1920000000200000200fffffff90014000000000000000000000002", @ANYBLOB], 0xc0}, 0x20000080) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000002c0)={0xffffffffffffffff, 0x98, 0x18}, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0xa, 0x4, 0x4, 0xe}, 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xb, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000002080000850000008600000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)={0x1b, 0x0, 0x0, 0x39b, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x4}, 0x50) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000380)={0x1b, 0x0, 0x0, 0xce, 0x0, 0xffffffffffffffff, 0xffffff51, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x5, 0x3}, 0x50) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000780)={0xe}, 0x8) r8 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@o_path={&(0x7f0000000400)='./file0\x00', 0x0, 0x8}, 0x18) r9 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r9, 0x29, 0x1a, 0x0, 0x4) r10 = openat$cgroup(0xffffffffffffffff, &(0x7f00000001c0)='syz1\x00', 0x200002, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000007c0)={0x3, 0x4, 0x4, 0xa, 0x0, r1, 0xb, '\x00', r2, r5, 0x2}, 0x50) openat$cgroup_type(r10, &(0x7f0000000440), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r12}, &(0x7f00000006c0), &(0x7f0000000700)=r11}, 0x20) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={0xffffffffffffffff, 0x58, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) r14 = openat$cgroup_ro(r10, &(0x7f0000000640)='blkio.bfq.idle_time\x00', 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000680)={0x1b, 0x0, 0x0, 0x4, 0x0, r12, 0x8, '\x00', r13, r14, 0x4, 0x0, 0x2}, 0x50) r15 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x4}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_tracing={0x1a, 0xb, &(0x7f0000000100)=@raw=[@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @map_idx={0x18, 0x5, 0x5, 0x0, 0x9}], &(0x7f0000000180)='syzkaller\x00', 0x200, 0xbe, &(0x7f00000001c0)=""/190, 0x41000, 0x0, '\x00', r2, 0x1a, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000280)={0x1, 0xe, 0x3, 0xce2}, 0x10, 0xfefd, r0, 0x7, &(0x7f0000000500)=[r3, r4, r6, r7, r8, r14, r15], &(0x7f0000000540)=[{0x5, 0x4, 0x4, 0x4}, {0x4, 0x3, 0x0, 0xb}, {0x0, 0x4, 0x6}, {0x5, 0x1, 0xe, 0x3}, {0x2, 0x2, 0x7, 0xb}, {0x1, 0x4, 0x8}, {0x5, 0x4, 0x7, 0x8}], 0x10, 0x9}, 0x94) 0s ago: executing program 2 (id=3246): unlink(&(0x7f0000000000)='./file0\x00') r0 = getpid() r1 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000440)={&(0x7f0000000040)=@rc={0x1f, @none, 0x39}, 0x80, &(0x7f00000003c0)=[{&(0x7f00000000c0)="aaacc0e7ae84c04339a00ea2f060368f7c378ff5865d8f7027e9a757e74b2aaefc8e4ea10123052310f33a5a0b311af461d5bdc62fc6175cad4b00519ca8e9d8eda8f7dbc75018378904557aeed346eb917c79ed6d0f1f4991f5f1328a4e40aed2c4a8e0f1b87f48e6f086b5d122a8a16a5e3732c0ee0f8467707a97", 0x7c}, {&(0x7f0000000140)="2eb8b70f54d5b3321d6eda426488d0ddd6aea12c7cf47957a10864b2f310434639499a3a6c48ed3ae9853be320516b4a2afb2218b3f781071b1833aeb48326eedc69c1aa7661b5944005bd4f03a119101e24242c26c6e7eeec822c5b2c47156173af28bc2903201c4bfe07f01d75d501e02c4ebbd9a4564911d922ac4cd0d72b7abe", 0x82}, {&(0x7f0000000200)="457d5b5e1b919d6def10f282c472ba920f621a9567ac9f5ecf478cf35e2eef95c777177e2c9b7dd69686c97c8432837b1fa446d427bb578763cffee5e3d75593b897cc0a3813e23ed282a718a1265f87b42cb4f26bb9a259ef4c592d4ee0f97174adc7fc90e1a6b2ca7a1d1422211e1c4238ec84971f52461ea7f0ad3944a655ab14dced9c45471134864f7668073b6bbdf71cffab9ae859be8cf2689b733f6a7756be8510c519d714db01c141a77ad5c08ceaf1c8a13095abaaed8048d326", 0xbf}, {&(0x7f00000002c0)="43857006398e325f083d9207de560051fcab5a8bea1bf83cbf52f778f2ae07638bf53fab7bc2586c19a4643adb6068fad12492ec69ea2845b9f7609ed0ecdbe7728b72d1a363", 0x46}, {&(0x7f0000000340)="78b5b48f10209e34ec1ce7aeb534b310bb574b6cb46b1c16e3bf42b1c7bb08d47535a7aac3d63c427c0749498ef0a884b6aaabd1dd3c", 0x36}, {&(0x7f0000000380)}], 0x6}, 0x4040) r2 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000480)='tasks\x00', 0x2, 0x0) r3 = gettid() write$cgroup_pid(r2, &(0x7f00000004c0)=r3, 0x12) r4 = socket$kcm(0x29, 0x2, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x1, 0x0) ioctl$TUNSETSNDBUF(r5, 0x400454d4, &(0x7f0000000540)=0xab7) ioctl$TUNSETVNETBE(r5, 0x400454de, &(0x7f0000000580)=0x1) syz_clone(0x800, &(0x7f00000005c0)="60ac79979f507a01f7a426548ad485ea886c8e3fd4", 0x15, &(0x7f0000000600), &(0x7f0000000640), &(0x7f0000000680)="b8") bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000007c0)={0xffffffffffffffff, &(0x7f00000006c0)="6eb48dc0f5a25cb40a336e6b869def73ebd6136df423f4e7285f049459f19f8b059ea6623f9fa6234ea2e4575f760cbb567270b41a7852c76ee3028bbe2085278a40599f3a5f2af0c5b5df39a96cea4fce45d234df8471339c5909990f1b6ff9dd1d7c839ef2d1aee3f3884183f866be63f188b10465847633851704e9e308e7e3cbf6bb8774033fb34ac3be99c8d6366cc05bc3c47ff41e71260ad79a32d92cd945193a0554739cf6e6824b8b630ecf13c870ad4c26ece1c4861b84b8cf5add2d761e7f29d889c36de7cda99d1adb6966613600647fe7972f71c99b60a65a05228632c764de87d55a41942f3121b4c21e4468acf5a407caa57ac36bf0"}, 0x20) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000019c0)={0x11, 0x24, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xa4a, 0x0, 0x0, 0x0, 0xff}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}, @btf_id={0x18, 0x8, 0x3, 0x0, 0x4}, @generic={0x7f, 0x6, 0x0, 0x5, 0x3c330132}, @tail_call={{0x18, 0x2, 0x1, 0x0, 0x1}}, @map_idx={0x18, 0x0, 0x5, 0x0, 0xd}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @map_val={0x18, 0x7, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='GPL\x00', 0x79, 0x1000, &(0x7f0000000980)=""/4096, 0x41100, 0x22, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000001980)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x60a}, 0x94) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e0, &(0x7f0000001a80)={r4, r6}) ioctl$SIOCSIFHWADDR(r5, 0x8924, &(0x7f0000001ac0)={'ip_vti0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000001b00), 0x4) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000001b40)=r6, 0x4) write$cgroup_pid(r2, &(0x7f0000001b80)=r0, 0x12) ioctl$TUNSETVNETHDRSZ(r5, 0x400454d8, &(0x7f0000001bc0)=0xb1) openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000001c00), 0x2, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000001c40), 0x880, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8924, &(0x7f0000001c80)={'veth1\x00', @multicast}) socketpair(0x21, 0xa, 0x2, &(0x7f0000001cc0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r4, 0x40042409, 0x0) close(r8) r9 = openat$cgroup(0xffffffffffffffff, &(0x7f0000001d00)='syz0\x00', 0x200002, 0x0) mkdirat$cgroup(r9, &(0x7f0000001d40)='syz1\x00', 0x1ff) r10 = perf_event_open$cgroup(&(0x7f0000001d80)={0x2, 0x80, 0x81, 0x1, 0x85, 0x7, 0x0, 0x3, 0x50500, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x40, 0x7}, 0x106177, 0x6, 0x9, 0x0, 0x1, 0x1, 0x800, 0x0, 0x83f, 0x0, 0xd}, r9, 0xa, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r10, 0x4008240b, &(0x7f0000001e40)={0x4, 0x80, 0x8, 0x2, 0x3, 0x5, 0x0, 0x7f, 0x60000, 0xb, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0xb51, 0x2, @perf_bp={&(0x7f0000001e00), 0xc}, 0x1, 0x7, 0x1, 0x5, 0x8001, 0x3, 0x6, 0x0, 0xf44, 0x0, 0x4c3c}) kernel console output (not intermixed with test programs): .626019][T11475] syzkaller0: entered allmulticast mode [ 466.888523][T11491] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 466.895691][T11491] mac80211_hwsim hwsim9 wlan1: entered allmulticast mode [ 466.979675][T11497] netlink: 'syz.1.1560': attribute type 2 has an invalid length. [ 466.987661][T11497] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1560'. [ 467.041738][T11497] netlink: 188 bytes leftover after parsing attributes in process `syz.1.1560'. [ 467.567464][T11508] netlink: 'syz.1.1564': attribute type 15 has an invalid length. [ 467.611936][T11508] netlink: 'syz.1.1564': attribute type 7 has an invalid length. [ 467.646908][T11512] netlink: 'syz.1.1564': attribute type 15 has an invalid length. [ 467.660116][T11512] netlink: 'syz.1.1564': attribute type 7 has an invalid length. [ 468.457188][T11537] syzkaller0: entered promiscuous mode [ 468.463168][T11537] syzkaller0: entered allmulticast mode [ 469.728667][ T3439] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 470.584440][T11552] netlink: 144 bytes leftover after parsing attributes in process `syz.1.1574'. [ 470.691584][T11556] netlink: 144316 bytes leftover after parsing attributes in process `syz.1.1575'. [ 470.941028][T11561] netlink: 'syz.0.1577': attribute type 10 has an invalid length. [ 470.957273][T11561] netlink: 2 bytes leftover after parsing attributes in process `syz.0.1577'. [ 471.936086][T11592] syzkaller0: entered promiscuous mode [ 471.942275][T11592] syzkaller0: entered allmulticast mode [ 473.787464][T11607] netdevsim netdevsim0 ÿÿÿÿÿÿ: renamed from netdevsim0 [ 475.816380][T11623] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 476.240388][T11639] netlink: 'syz.3.1599': attribute type 2 has an invalid length. [ 476.278518][T11639] netlink: 'syz.3.1599': attribute type 8 has an invalid length. [ 476.299796][T11639] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1599'. [ 476.903216][T11649] syzkaller0: entered promiscuous mode [ 476.912451][T11649] syzkaller0: entered allmulticast mode [ 477.154616][T11663] netlink: 149044 bytes leftover after parsing attributes in process `syz.0.1606'. [ 478.829149][T11682] netlink: 'syz.0.1609': attribute type 3 has an invalid length. [ 478.837069][T11682] netlink: 71052 bytes leftover after parsing attributes in process `syz.0.1609'. [ 479.631465][T11701] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 480.062295][T11708] syzkaller0: entered promiscuous mode [ 480.068576][T11708] syzkaller0: entered allmulticast mode [ 480.166912][T11723] netlink: 'syz.1.1621': attribute type 29 has an invalid length. [ 481.939845][T11723] netlink: 'syz.1.1621': attribute type 29 has an invalid length. [ 481.949040][T10801] wlan1: Trigger new scan to find an IBSS to join [ 482.011649][T11740] netlink: 6 bytes leftover after parsing attributes in process `syz.1.1624'. [ 482.025012][T11740] openvswitch: netlink: Flow actions attr not present in new flow. [ 482.080990][T11743] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.1625'. [ 482.092848][T11743] netlink: 192436 bytes leftover after parsing attributes in process `syz.3.1625'. [ 482.102364][T11743] openvswitch: netlink: Key type 8692 is out of range max 32 [ 483.952402][T11757] netlink: 'syz.3.1626': attribute type 10 has an invalid length. [ 483.961296][T11757] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1626'. [ 483.972736][T11757] caif0: entered promiscuous mode [ 483.977824][T11757] caif0: entered allmulticast mode [ 483.996993][T11757] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 484.633269][T11787] netlink: 'syz.2.1634': attribute type 9 has an invalid length. [ 484.641895][T11787] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.1634'. [ 484.995837][ T49] wlan1: Trigger new scan to find an IBSS to join [ 486.641310][T11801] syzkaller0: entered promiscuous mode [ 486.646871][T11801] syzkaller0: entered allmulticast mode [ 487.948396][ T49] wlan1: Trigger new scan to find an IBSS to join [ 488.152391][T11828] delete_channel: no stack [ 488.858648][T10798] wlan1: Creating new IBSS network, BSSID 3e:3b:c9:f2:66:78 [ 488.884173][T11840] netlink: 'syz.2.1649': attribute type 10 has an invalid length. [ 488.906535][T11841] netlink: 'syz.2.1649': attribute type 21 has an invalid length. [ 488.915379][T11841] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1649'. [ 489.653313][T11867] netlink: 'syz.1.1655': attribute type 39 has an invalid length. [ 490.457532][T11872] syzkaller0: entered promiscuous mode [ 490.463502][T11872] syzkaller0: entered allmulticast mode [ 492.167765][T11884] netlink: 'syz.1.1661': attribute type 7 has an invalid length. [ 493.037642][T11927] delete_channel: no stack [ 493.046877][T11927] delete_channel: no stack [ 495.784753][T11984] netlink: 'syz.2.1687': attribute type 29 has an invalid length. [ 495.794347][T11984] netlink: 'syz.2.1687': attribute type 29 has an invalid length. [ 495.806002][T11984] netlink: 'syz.2.1687': attribute type 29 has an invalid length. [ 496.211323][T11990] syzkaller0: entered promiscuous mode [ 496.216861][T11990] syzkaller0: entered allmulticast mode [ 496.702153][T12008] netlink: 'syz.1.1694': attribute type 2 has an invalid length. [ 496.713902][T12008] netlink: 17267 bytes leftover after parsing attributes in process `syz.1.1694'. [ 497.605003][T12009] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 498.635265][T12010] netlink: 'syz.2.1695': attribute type 10 has an invalid length. [ 498.643454][T12010] mac80211_hwsim hwsim8 wlan1: left allmulticast mode [ 498.653650][T12010] team0: Port device wlan1 added [ 498.659131][T12015] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1697'. [ 498.896211][ T5778] Bluetooth: hci3: ISO packet for unknown connection handle 3849 [ 500.033338][T12046] syzkaller0: entered promiscuous mode [ 500.058452][T12046] syzkaller0: entered allmulticast mode [ 500.656569][ T49] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 501.553758][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.562663][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.486961][T12083] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1715'. [ 502.610784][T12083] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 502.621538][T12083] CPU: 0 PID: 12083 Comm: syz.3.1715 Not tainted syzkaller #0 [ 502.629084][T12083] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 502.639194][T12083] Call Trace: [ 502.642522][T12083] [ 502.645495][T12083] dump_stack_lvl+0x18c/0x250 [ 502.650503][T12083] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 502.656728][T12083] ? show_regs_print_info+0x20/0x20 [ 502.662012][T12083] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 502.668244][T12083] ? audit_tree_destroy_watch+0x20/0x20 [ 502.673867][T12083] sysfs_warn_dup+0x8e/0xa0 [ 502.678436][T12083] sysfs_do_create_link_sd+0xc0/0x110 [ 502.684216][T12083] device_add_class_symlinks+0x1cf/0x240 [ 502.689926][T12083] device_add+0x507/0xc20 [ 502.694325][T12083] wiphy_register+0x1dad/0x2ae0 [ 502.699269][T12083] ? cfg80211_event_work+0x40/0x40 [ 502.704433][T12083] ? minstrel_ht_alloc+0x88a/0x990 [ 502.709624][T12083] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 502.715768][T12083] ieee80211_register_hw+0x3464/0x4250 [ 502.721291][T12083] ? ieee80211_tasklet_handler+0x20/0x20 [ 502.726943][T12083] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 502.732892][T12083] ? __debug_object_init+0xec/0x450 [ 502.738161][T12083] ? __asan_memset+0x22/0x40 [ 502.742784][T12083] ? __hrtimer_init+0x186/0x270 [ 502.747683][T12083] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 502.753454][T12083] ? mac80211_hwsim_free+0x220/0x220 [ 502.758766][T12083] ? rcu_is_watching+0x15/0xb0 [ 502.763648][T12083] ? kstrndup+0xbd/0x140 [ 502.767935][T12083] hwsim_new_radio_nl+0xdc9/0x1a90 [ 502.773075][T12083] ? __nla_validate+0x50/0x50 [ 502.777802][T12083] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 502.784176][T12083] ? __nla_parse+0x40/0x50 [ 502.788637][T12083] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 502.794991][T12083] genl_family_rcv_msg_doit+0x211/0x310 [ 502.800565][T12083] ? end_current_label_crit_section+0x170/0x170 [ 502.806849][T12083] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 502.812781][T12083] ? bpf_lsm_capable+0x9/0x10 [ 502.817509][T12083] ? security_capable+0x89/0xb0 [ 502.822396][T12083] genl_rcv_msg+0x619/0x7a0 [ 502.826956][T12083] ? genl_bind+0x360/0x360 [ 502.831395][T12083] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 502.837851][T12083] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 502.843613][T12083] netlink_rcv_skb+0x241/0x4d0 [ 502.848416][T12083] ? genl_bind+0x360/0x360 [ 502.852850][T12083] ? netlink_ack+0x1180/0x1180 [ 502.857654][T12083] ? __lock_acquire+0x7d40/0x7d40 [ 502.862718][T12083] ? net_generic+0x1e/0x240 [ 502.867256][T12083] ? down_read+0x1ac/0x2e0 [ 502.871695][T12083] genl_rcv+0x28/0x40 [ 502.875722][T12083] netlink_unicast+0x751/0x8d0 [ 502.880539][T12083] netlink_sendmsg+0x8d0/0xbf0 [ 502.885336][T12083] ? lockdep_hardirqs_on+0x98/0x150 [ 502.890614][T12083] ? netlink_getsockopt+0x590/0x590 [ 502.895851][T12083] ? aa_sock_msg_perm+0x94/0x150 [ 502.900822][T12083] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 502.906142][T12083] ? security_socket_sendmsg+0x80/0xa0 [ 502.911630][T12083] ? netlink_getsockopt+0x590/0x590 [ 502.916866][T12083] ____sys_sendmsg+0x5ba/0x960 [ 502.921679][T12083] ? __asan_memset+0x22/0x40 [ 502.926305][T12083] ? __sys_sendmsg_sock+0x30/0x30 [ 502.931349][T12083] ? __import_iovec+0x5f2/0x850 [ 502.936241][T12083] ? import_iovec+0x73/0xa0 [ 502.940774][T12083] ___sys_sendmsg+0x2a6/0x360 [ 502.945481][T12083] ? __sys_sendmsg+0x2a0/0x2a0 [ 502.950314][T12083] ? trace_call_bpf+0xc3/0x6c0 [ 502.955141][T12083] __se_sys_sendmsg+0x1c2/0x2b0 [ 502.960027][T12083] ? __x64_sys_sendmsg+0x80/0x80 [ 502.964999][T12083] ? lockdep_hardirqs_on+0x98/0x150 [ 502.970240][T12083] do_syscall_64+0x55/0xa0 [ 502.974738][T12083] ? clear_bhb_loop+0x40/0x90 [ 502.979454][T12083] ? clear_bhb_loop+0x40/0x90 [ 502.984162][T12083] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 502.990087][T12083] RIP: 0033:0x7fcee799c819 [ 502.994526][T12083] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.014174][T12083] RSP: 002b:00007fcee879a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.022620][T12083] RAX: ffffffffffffffda RBX: 00007fcee7c15fa0 RCX: 00007fcee799c819 [ 503.030617][T12083] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000010 [ 503.038609][T12083] RBP: 00007fcee7a32c91 R08: 0000000000000000 R09: 0000000000000000 [ 503.046633][T12083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 503.054726][T12083] R13: 00007fcee7c16038 R14: 00007fcee7c15fa0 R15: 00007ffcb030d7a8 [ 503.062746][T12083] [ 504.431462][T12117] syzkaller0: entered promiscuous mode [ 504.452762][T12117] syzkaller0: entered allmulticast mode [ 506.931411][T12156] netlink: 'syz.2.1733': attribute type 46 has an invalid length. [ 506.958963][T12156] netlink: 55 bytes leftover after parsing attributes in process `syz.2.1733'. [ 507.288760][T12169] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 507.610164][T12179] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.1739'. [ 509.235747][T12189] syzkaller0: entered promiscuous mode [ 509.243477][T12189] syzkaller0: entered allmulticast mode [ 511.297319][T12211] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.1750'. [ 511.722769][T12217] raw_sendmsg: syz.0.1753 forgot to set AF_INET. Fix it! [ 512.267536][T12229] syzkaller0: entered promiscuous mode [ 512.275649][T12229] syzkaller0: entered allmulticast mode [ 514.854740][T12266] syzkaller0: entered promiscuous mode [ 514.860874][T12266] syzkaller0: entered allmulticast mode [ 514.870649][T12272] netlink: 13695 bytes leftover after parsing attributes in process `syz.2.1769'. [ 518.229330][T12296] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.1776'. [ 518.880308][T10800] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 523.076398][T12330] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1782'. [ 523.086472][T12334] mac80211_hwsim hwsim3 .3ãc¤±: renamed from wlan1 (while UP) [ 523.217140][T12340] syzkaller0: entered promiscuous mode [ 523.225048][T12340] syzkaller0: entered allmulticast mode [ 524.537518][T12366] netlink: 'syz.1.1791': attribute type 2 has an invalid length. [ 524.564390][T12366] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.1791'. [ 526.015473][T12370] sit0: entered promiscuous mode [ 526.028119][T12370] sit0: entered allmulticast mode [ 526.137671][T12368] netlink: 11231 bytes leftover after parsing attributes in process `syz.0.1800'. [ 526.506176][T12381] syzkaller0: entered promiscuous mode [ 526.521924][T12381] syzkaller0: entered allmulticast mode [ 528.526091][T12386] netlink: 'syz.2.1805': attribute type 10 has an invalid length. [ 528.535132][T12386] bridge0: port 1(bridge_slave_0) entered disabled state [ 528.549890][T12384] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1798'. [ 528.560990][T12388] sit0: entered promiscuous mode [ 528.566001][T12388] sit0: entered allmulticast mode [ 528.835440][T12411] syzkaller0: entered promiscuous mode [ 528.841608][T12411] syzkaller0: entered allmulticast mode [ 528.854877][T12413] netlink: 'syz.3.1801': attribute type 2 has an invalid length. [ 528.863397][T12413] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.1801'. [ 531.690622][T10801] .3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 532.912026][T12438] netlink: 'syz.2.1811': attribute type 10 has an invalid length. [ 532.922189][T12438] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1811'. [ 532.932602][T12438] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 533.166765][T12457] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 533.197946][T12457] syzkaller0: entered promiscuous mode [ 533.216455][T12457] syzkaller0: entered allmulticast mode [ 536.880706][T12487] syzkaller0: entered promiscuous mode [ 536.886237][T12487] syzkaller0: entered allmulticast mode [ 537.136737][T12498] netlink: 'syz.1.1827': attribute type 29 has an invalid length. [ 537.359947][T12498] netlink: 'syz.1.1827': attribute type 29 has an invalid length. [ 537.368417][T12501] netlink: 'syz.1.1827': attribute type 4 has an invalid length. [ 537.381448][T12493] netlink: 'syz.3.1826': attribute type 10 has an invalid length. [ 537.392066][T12493] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1826'. [ 537.427186][T12493] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 537.673003][T12508] netlink: 'syz.3.1829': attribute type 10 has an invalid length. [ 537.699253][T12508] netlink: 210880 bytes leftover after parsing attributes in process `syz.3.1829'. [ 539.571084][T12520] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1833'. [ 541.082406][T12520] debugfs: Directory 'ô!ô' with parent 'ieee80211' already present! [ 543.179551][T12534] netlink: 'syz.1.1836': attribute type 21 has an invalid length. [ 543.191692][T12540] netlink: 'syz.1.1836': attribute type 6 has an invalid length. [ 543.200607][T12540] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1836'. [ 543.210726][T12547] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 543.216715][T12547] syzkaller1: linktype set to 786 [ 543.391006][T12563] netlink: 'syz.0.1842': attribute type 29 has an invalid length. [ 543.415639][T12563] netlink: 'syz.0.1842': attribute type 29 has an invalid length. [ 543.694638][T12568] netlink: 'syz.2.1845': attribute type 2 has an invalid length. [ 543.695288][T12577] netlink: 'syz.1.1848': attribute type 3 has an invalid length. [ 543.707777][T12568] netlink: 'syz.2.1845': attribute type 8 has an invalid length. [ 543.734450][T12577] netlink: 'syz.1.1848': attribute type 1 has an invalid length. [ 543.738985][T12568] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1845'. [ 543.755558][T12577] netlink: 181400 bytes leftover after parsing attributes in process `syz.1.1848'. [ 543.834352][T12568] netlink: 'syz.2.1845': attribute type 11 has an invalid length. [ 544.337474][T12596] netlink: 'syz.2.1854': attribute type 8 has an invalid length. [ 544.347025][T12596] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1854'. [ 545.757734][T12587] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1852'. [ 545.778183][T12602] netlink: 65015 bytes leftover after parsing attributes in process `syz.1.1855'. [ 545.910394][T12605] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1856'. [ 546.429135][T12629] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1862'. [ 547.341365][T12654] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1869'. [ 548.146493][T12669] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1874'. [ 549.606032][T12657] netlink: 156 bytes leftover after parsing attributes in process `syz.0.1871'. [ 549.606709][T12651] delete_channel: no stack [ 549.621851][T12660] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1872'. [ 549.631670][T12670] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1874'. [ 549.781360][T12676] netlink: zone id is out of range [ 549.790016][T12676] netlink: set zone limit has 8 unknown bytes [ 549.897636][T12685] validate_nla: 9 callbacks suppressed [ 549.897652][T12685] netlink: 'syz.3.1879': attribute type 10 has an invalid length. [ 549.918472][T12685] netlink: 156 bytes leftover after parsing attributes in process `syz.3.1879'. [ 550.249201][T12701] netlink: 'syz.2.1884': attribute type 2 has an invalid length. [ 550.273084][T12701] netlink: 'syz.2.1884': attribute type 8 has an invalid length. [ 550.297220][T12701] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1884'. [ 550.464652][T12711] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1886'. [ 553.618912][T12715] netlink: 'syz.1.1888': attribute type 10 has an invalid length. [ 553.626765][T12715] netlink: 55 bytes leftover after parsing attributes in process `syz.1.1888'. [ 553.941080][T12717] netlink: 'syz.0.1889': attribute type 21 has an invalid length. [ 553.949788][T12738] netlink: 14601 bytes leftover after parsing attributes in process `syz.3.1894'. [ 555.199568][T12779] netlink: 'syz.3.1907': attribute type 1 has an invalid length. [ 555.207846][T12779] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.1907'. [ 556.277998][T12776] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1906'. [ 556.392881][T12786] netlink: 'syz.0.1908': attribute type 3 has an invalid length. [ 556.429677][T12786] netlink: 'syz.0.1908': attribute type 8 has an invalid length. [ 556.458154][T12786] netlink: 197324 bytes leftover after parsing attributes in process `syz.0.1908'. [ 556.699699][T12800] netlink: 9275 bytes leftover after parsing attributes in process `syz.3.1915'. [ 556.874334][T12807] syzkaller0: entered promiscuous mode [ 556.889543][T12807] syzkaller0: entered allmulticast mode [ 562.077492][T12825] netlink: 'syz.3.1920': attribute type 17 has an invalid length. [ 562.592252][T12878] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1939'. [ 562.605033][T12881] netlink: 'syz.3.1938': attribute type 10 has an invalid length. [ 562.656439][T12881] team0: Port device bond0 removed [ 562.707089][ T49] .3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 562.757787][T12880] syzkaller0: entered promiscuous mode [ 562.774772][T12880] syzkaller0: entered allmulticast mode [ 562.802372][T12881] netlink: 'syz.3.1938': attribute type 21 has an invalid length. [ 562.828193][T12881] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1938'. [ 562.849991][T12881] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1938'. [ 562.883759][T12895] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1938'. [ 562.993026][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.008224][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 566.027084][T12934] netlink: 'syz.2.1947': attribute type 13 has an invalid length. [ 566.043673][T12934] netlink: 24643 bytes leftover after parsing attributes in process `syz.2.1947'. [ 566.079616][T12933] netlink: 'syz.3.1948': attribute type 10 has an invalid length. [ 566.503780][T12958] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.1955'. [ 566.567441][T12953] syzkaller0: entered promiscuous mode [ 566.573056][T12953] syzkaller0: entered allmulticast mode [ 566.816758][T12964] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 566.824385][T12964] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 568.671438][T12990] netlink: 'syz.3.1964': attribute type 10 has an invalid length. [ 568.679850][T12990] netlink: 'syz.3.1964': attribute type 19 has an invalid length. [ 568.687729][T12990] netlink: 14536 bytes leftover after parsing attributes in process `syz.3.1964'. [ 568.826563][T13000] netlink: 'syz.0.1968': attribute type 10 has an invalid length. [ 568.856114][T13000] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1968'. [ 568.867266][T13000] caif0: entered promiscuous mode [ 568.872478][T13000] caif0: entered allmulticast mode [ 568.877758][T13000] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 568.988562][T13007] netlink: 'syz.2.1971': attribute type 5 has an invalid length. [ 569.057620][T13009] IPv6: Can't replace route, no match found [ 569.535696][T13027] netlink: 'syz.2.1977': attribute type 16 has an invalid length. [ 569.556258][T13027] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1977'. [ 569.657902][T13034] syzkaller0: entered promiscuous mode [ 569.663488][T13027] netlink: 'syz.2.1977': attribute type 3 has an invalid length. [ 569.663514][T13027] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1977'. [ 569.696584][T13034] syzkaller0: entered allmulticast mode [ 572.165114][T13097] netlink: 3 bytes leftover after parsing attributes in process `syz.2.1996'. [ 572.671907][T13114] netlink: 'syz.2.2002': attribute type 21 has an invalid length. [ 572.680500][T13114] netlink: 'syz.2.2002': attribute type 1 has an invalid length. [ 572.688862][T13114] netlink: 15998 bytes leftover after parsing attributes in process `syz.2.2002'. [ 572.916182][T13120] syzkaller0: entered promiscuous mode [ 572.923230][T13120] syzkaller0: entered allmulticast mode [ 574.861060][T13127] netlink: 'syz.2.2006': attribute type 21 has an invalid length. [ 574.869113][T13127] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2006'. [ 574.878352][T13127] netlink: 'syz.2.2006': attribute type 5 has an invalid length. [ 574.886200][T13127] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2006'. [ 575.056384][T13142] netlink: 'syz.2.2011': attribute type 1 has an invalid length. [ 575.065638][T13142] netlink: 112860 bytes leftover after parsing attributes in process `syz.2.2011'. [ 575.076425][T13142] netlink: 9 bytes leftover after parsing attributes in process `syz.2.2011'. [ 575.390296][T13160] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2017'. [ 576.114865][T13181] syzkaller0: entered promiscuous mode [ 576.127495][T13181] syzkaller0: entered allmulticast mode [ 577.452329][T13197] netlink: 'syz.2.2026': attribute type 9 has an invalid length. [ 577.460499][T13197] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.2026'. [ 579.140538][T13206] netlink: 201392 bytes leftover after parsing attributes in process `syz.2.2029'. [ 579.213590][T13211] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.2027'. [ 579.260758][T13213] netlink: 1057 bytes leftover after parsing attributes in process `syz.1.2031'. [ 579.405402][T13220] netlink: 'syz.1.2033': attribute type 21 has an invalid length. [ 579.815385][T13223] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2034'. [ 580.651474][T13218] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2032'. [ 580.776374][T13231] syzkaller0: entered promiscuous mode [ 580.799879][T13231] syzkaller0: entered allmulticast mode [ 580.818542][T13218] debugfs: Directory '!!ô' with parent 'ieee80211' already present! [ 586.268782][T13313] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 586.485444][T13320] netlink: 180 bytes leftover after parsing attributes in process `syz.1.2057'. [ 587.194452][T13343] netlink: 'syz.3.2061': attribute type 8 has an invalid length. [ 587.208199][T13343] netlink: 161700 bytes leftover after parsing attributes in process `syz.3.2061'. [ 590.735251][T13363] netlink: 'syz.3.2068': attribute type 10 has an invalid length. [ 590.902713][T13372] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2070'. [ 590.924091][T13372] batadv_slave_1: entered promiscuous mode [ 591.204589][T13385] syzkaller0: entered promiscuous mode [ 591.230565][T13385] syzkaller0: entered allmulticast mode [ 593.594393][T13412] netlink: 'syz.3.2083': attribute type 41 has an invalid length. [ 594.246206][T10801] .3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 595.109873][T13412] netlink: 'syz.3.2083': attribute type 41 has an invalid length. [ 595.340647][T13417] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2084'. [ 595.723184][T13430] netlink: 'syz.1.2090': attribute type 21 has an invalid length. [ 596.336905][T13435] netlink: 'syz.2.2091': attribute type 10 has an invalid length. [ 597.088642][T13442] netlink: 201392 bytes leftover after parsing attributes in process `syz.3.2092'. [ 597.114998][T13442] netlink: zone id is out of range [ 597.149038][T13442] netlink: zone id is out of range [ 597.154637][T13442] netlink: zone id is out of range [ 597.215863][T13442] netlink: zone id is out of range [ 597.232087][T13442] netlink: zone id is out of range [ 597.233169][T13451] netlink: 121460 bytes leftover after parsing attributes in process `syz.1.2095'. [ 597.264154][T13451] netlink: 21096 bytes leftover after parsing attributes in process `syz.1.2095'. [ 597.269047][T13442] netlink: zone id is out of range [ 597.286004][T13451] tipc: Started in network mode [ 597.299389][T13451] tipc: Node identity 1a, cluster identity 4711 [ 597.316117][T13451] tipc: Node number set to 26 [ 597.321622][T13442] netlink: zone id is out of range [ 597.321723][T13442] netlink: zone id is out of range [ 597.347620][T13442] netlink: zone id is out of range [ 599.906289][T13488] netlink: 'syz.0.2106': attribute type 3 has an invalid length. [ 599.928857][T13488] netlink: 130984 bytes leftover after parsing attributes in process `syz.0.2106'. [ 601.929012][T13495] netlink: 'syz.3.2107': attribute type 21 has an invalid length. [ 601.936935][T13495] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2107'. [ 602.605408][T13521] netlink: 'syz.1.2115': attribute type 1 has an invalid length. [ 602.613641][T13521] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.2115'. [ 602.638453][T13521] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2115'. [ 605.081179][T13554] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.2123'. [ 605.130052][T13556] netlink: 'syz.3.2124': attribute type 13 has an invalid length. [ 605.146900][T13556] netlink: 160 bytes leftover after parsing attributes in process `syz.3.2124'. [ 605.222791][T13556] erspan0: refused to change device tx_queue_len [ 605.268163][T13556] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 605.447878][T13563] netlink: 'syz.1.2127': attribute type 10 has an invalid length. [ 607.466336][T13601] netlink: 64859 bytes leftover after parsing attributes in process `syz.0.2136'. [ 608.582773][T13601] netlink: 'syz.0.2136': attribute type 1 has an invalid length. [ 608.590781][T13601] netlink: 15998 bytes leftover after parsing attributes in process `syz.0.2136'. [ 610.368115][T13609] netlink: 'syz.1.2137': attribute type 10 has an invalid length. [ 610.376015][T13609] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2137'. [ 610.554229][T13618] netlink: 105120 bytes leftover after parsing attributes in process `syz.0.2143'. [ 610.577141][T13618] netlink: 'syz.0.2143': attribute type 2 has an invalid length. [ 610.927688][T13635] netlink: 'syz.0.2146': attribute type 3 has an invalid length. [ 610.945846][T13635] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2146'. [ 610.970590][T13635] netlink: 'syz.0.2146': attribute type 1 has an invalid length. [ 610.988071][T13635] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.2146'. [ 613.591200][T13675] delete_channel: no stack [ 615.716627][T13705] netlink: 'syz.1.2165': attribute type 3 has an invalid length. [ 615.736232][T13705] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2165'. [ 617.665698][T13711] netlink: 'syz.1.2167': attribute type 21 has an invalid length. [ 617.931034][T13718] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.2170'. [ 618.241632][T13729] syzkaller0: entered promiscuous mode [ 618.247183][T13729] syzkaller0: entered allmulticast mode [ 623.179579][T13776] netlink: 'syz.1.2187': attribute type 49 has an invalid length. [ 623.198316][T13776] netlink: 'syz.1.2187': attribute type 49 has an invalid length. [ 623.527069][T13789] netlink: 'syz.3.2191': attribute type 10 has an invalid length. [ 623.571457][T13789] netlink: 'syz.3.2191': attribute type 153 has an invalid length. [ 623.580104][T13789] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.2191'. [ 623.753281][T13800] netlink: 'syz.2.2195': attribute type 12 has an invalid length. [ 623.762250][T13800] netlink: 14585 bytes leftover after parsing attributes in process `syz.2.2195'. [ 624.461323][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.468236][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.280686][ T7611] .3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 625.912299][T13810] netlink: 'syz.1.2199': attribute type 12 has an invalid length. [ 625.921011][T13810] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2199'. [ 625.931829][T13809] netlink: 'syz.1.2199': attribute type 12 has an invalid length. [ 625.940880][T13809] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2199'. [ 625.951058][T13813] netlink: 'syz.0.2200': attribute type 21 has an invalid length. [ 625.960789][T13813] IPv6: NLM_F_CREATE should be specified when creating new route [ 625.981315][T13813] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 625.988702][T13813] IPv6: NLM_F_CREATE should be set when creating new route [ 625.996236][T13813] IPv6: NLM_F_CREATE should be set when creating new route [ 626.003605][T13813] IPv6: NLM_F_CREATE should be set when creating new route [ 628.720635][T13865] netlink: 'syz.3.2214': attribute type 10 has an invalid length. [ 628.799265][T13867] syzkaller0: entered promiscuous mode [ 628.811326][T13867] syzkaller0: entered allmulticast mode [ 630.714180][T13876] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 630.910641][T13879] netlink: 'syz.0.2216': attribute type 10 has an invalid length. [ 630.918838][T13879] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2216'. [ 630.929799][T13879] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 631.146912][ T7617] tipc: Subscription rejected, illegal request [ 632.222618][T13917] syzkaller0: entered promiscuous mode [ 632.228300][T13917] syzkaller0: entered allmulticast mode [ 634.971953][T13953] netlink: 'syz.0.2235': attribute type 10 has an invalid length. [ 634.998811][T13953] netlink: 65015 bytes leftover after parsing attributes in process `syz.0.2235'. [ 635.723410][T13976] syz.1.2242: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 635.777226][T13976] CPU: 0 PID: 13976 Comm: syz.1.2242 Not tainted syzkaller #0 [ 635.784782][T13976] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 635.794895][T13976] Call Trace: [ 635.798222][T13976] [ 635.801201][T13976] dump_stack_lvl+0x18c/0x250 [ 635.805954][T13976] ? show_regs_print_info+0x20/0x20 [ 635.811210][T13976] ? load_image+0x420/0x420 [ 635.815785][T13976] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 635.822284][T13976] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 635.828842][T13976] warn_alloc+0x246/0x340 [ 635.833243][T13976] ? stack_trace_save+0xaa/0x100 [ 635.838676][T13976] ? zone_watermark_ok_safe+0x230/0x230 [ 635.844304][T13976] ? kasan_set_track+0x5f/0x70 [ 635.849121][T13976] ? kasan_set_track+0x4e/0x70 [ 635.853932][T13976] ? __kasan_kmalloc+0x8f/0xa0 [ 635.858745][T13976] ? xsk_init_queue+0xad/0x100 [ 635.863539][T13976] ? xsk_setsockopt+0x4e5/0x760 [ 635.868447][T13976] ? do_sock_setsockopt+0x175/0x1a0 [ 635.873690][T13976] ? __x64_sys_setsockopt+0x182/0x200 [ 635.879103][T13976] __vmalloc_node_range+0x126/0x1330 [ 635.884496][T13976] ? free_vm_area+0x50/0x50 [ 635.889076][T13976] vmalloc_user+0x74/0x80 [ 635.893450][T13976] ? xskq_create+0xbf/0x170 [ 635.898009][T13976] xskq_create+0xbf/0x170 [ 635.902571][T13976] xsk_init_queue+0xad/0x100 [ 635.907214][T13976] xsk_setsockopt+0x4e5/0x760 [ 635.911925][T13976] ? xsk_poll+0x680/0x680 [ 635.916291][T13976] ? __fget_files+0x28/0x4b0 [ 635.920943][T13976] ? __fget_files+0x28/0x4b0 [ 635.925583][T13976] ? aa_sock_opt_perm+0x74/0x100 [ 635.930567][T13976] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 635.936144][T13976] ? security_socket_setsockopt+0x7e/0xa0 [ 635.942064][T13976] ? xsk_poll+0x680/0x680 [ 635.946449][T13976] do_sock_setsockopt+0x175/0x1a0 [ 635.951477][T13976] ? __fdget+0x180/0x210 [ 635.955787][T13976] __x64_sys_setsockopt+0x182/0x200 [ 635.961012][T13976] do_syscall_64+0x55/0xa0 [ 635.965441][T13976] ? clear_bhb_loop+0x40/0x90 [ 635.970305][T13976] ? clear_bhb_loop+0x40/0x90 [ 635.975033][T13976] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 635.980989][T13976] RIP: 0033:0x7fe12399c819 [ 635.985441][T13976] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 636.005210][T13976] RSP: 002b:00007fe1248cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 636.013673][T13976] RAX: ffffffffffffffda RBX: 00007fe123c15fa0 RCX: 00007fe12399c819 [ 636.021700][T13976] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000007 [ 636.029728][T13976] RBP: 00007fe123a32c91 R08: 0000000000000004 R09: 0000000000000000 [ 636.037734][T13976] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 636.045752][T13976] R13: 00007fe123c16038 R14: 00007fe123c15fa0 R15: 00007ffcc3afd018 [ 636.053796][T13976] [ 636.074244][T13976] Mem-Info: [ 636.079216][T13976] active_anon:7651 inactive_anon:0 isolated_anon:0 [ 636.079216][T13976] active_file:18275 inactive_file:40136 isolated_file:0 [ 636.079216][T13976] unevictable:768 dirty:196 writeback:0 [ 636.079216][T13976] slab_reclaimable:10547 slab_unreclaimable:95083 [ 636.079216][T13976] mapped:24275 shmem:1361 pagetables:554 [ 636.079216][T13976] sec_pagetables:0 bounce:0 [ 636.079216][T13976] kernel_misc_reclaimable:0 [ 636.079216][T13976] free:1341188 free_pcp:8862 free_cma:0 [ 636.135055][T13976] Node 0 active_anon:30604kB inactive_anon:0kB active_file:73100kB inactive_file:160340kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:97100kB dirty:784kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10840kB pagetables:2216kB sec_pagetables:0kB all_unreclaimable? no [ 636.172401][T13976] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 636.209022][T13981] netlink: 'syz.0.2244': attribute type 5 has an invalid length. [ 636.218543][T13983] netlink: 'syz.0.2244': attribute type 5 has an invalid length. [ 636.227556][T13976] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 636.259531][T13976] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 636.266063][T13976] Node 0 DMA32 free:1449568kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:30468kB inactive_anon:0kB active_file:73100kB inactive_file:159512kB unevictable:1536kB writepending:784kB present:3129332kB managed:2586952kB mlocked:0kB bounce:0kB free_pcp:20280kB local_pcp:4588kB free_cma:0kB [ 636.315610][T13976] lowmem_reserve[]: 0 0 0 0 0 [ 636.322905][T13976] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:828kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 636.355533][T13976] lowmem_reserve[]: 0 0 0 0 0 [ 636.361361][T13976] Node 1 Normal free:3899824kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:15584kB local_pcp:11936kB free_cma:0kB [ 636.397306][T13976] lowmem_reserve[]: 0 0 0 0 0 [ 636.404740][T13976] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 636.426803][T13989] netlink: 192436 bytes leftover after parsing attributes in process `syz.2.2246'. [ 636.438589][T13989] openvswitch: netlink: Message has 20476 unknown bytes. [ 636.446991][T13976] Node 0 DMA32: 920*4kB (UME) 1060*8kB (UME) 1412*16kB (UME) 757*32kB (UME) 904*64kB (UME) 430*128kB (UME) 180*256kB (UME) 171*512kB (UM) 133*1024kB (UME) 8*2048kB (UM) 242*4096kB (M) = 1449312kB [ 636.471988][T13976] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 636.485239][T13976] Node 1 Normal: 226*4kB (UME) 43*8kB (UME) 47*16kB (UME) 141*32kB (UME) 33*64kB (UE) 8*128kB (UME) 2*256kB (U) 1*512kB (M) 2*1024kB (UE) 2*2048kB (UE) 948*4096kB (M) = 3899824kB [ 636.505633][T13976] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 636.538292][T13976] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 636.559889][T13976] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 636.571678][T13976] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 636.582413][T13976] 59772 total pagecache pages [ 636.587441][T13976] 0 pages in swap cache [ 636.593070][T13976] Free swap = 124996kB [ 636.597584][T13976] Total swap = 124996kB [ 636.603326][T13976] 2097051 pages RAM [ 636.608545][T13976] 0 pages HighMem/MovableOnly [ 636.613856][T13976] 416927 pages reserved [ 636.619998][T13976] 0 pages cma reserved [ 636.752369][T13997] netlink: 63503 bytes leftover after parsing attributes in process `syz.0.2248'. [ 636.921516][T14006] netlink: 'syz.0.2251': attribute type 9 has an invalid length. [ 637.377236][T14017] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 638.399393][T14037] netlink: 'syz.1.2260': attribute type 10 has an invalid length. [ 638.762117][T14045] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2264'. [ 638.772284][T14046] netlink: 2 bytes leftover after parsing attributes in process `syz.2.2264'. [ 638.879956][T14048] netlink: 'syz.2.2265': attribute type 22 has an invalid length. [ 638.888184][T14048] netlink: 148 bytes leftover after parsing attributes in process `syz.2.2265'. [ 639.383614][T14063] netlink: 'syz.3.2271': attribute type 19 has an invalid length. [ 639.401958][T14063] netlink: 14552 bytes leftover after parsing attributes in process `syz.3.2271'. [ 639.698697][T14074] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2274'. [ 641.075177][ T5778] Bluetooth: hci0: unexpected event 0x31 length: 15 > 6 [ 641.463346][T14119] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2286'. [ 641.508962][T14119] openvswitch: netlink: IP tunnel attribute has 3052 unknown bytes. [ 641.604114][T14120] : port 1(ip6gretap0) entered blocking state [ 641.629146][T14120] : port 1(ip6gretap0) entered disabled state [ 641.647752][T14120] ip6gretap0: entered allmulticast mode [ 641.669600][T14120] ip6gretap0: entered promiscuous mode [ 641.702012][T14119] netlink: 'syz.1.2286': attribute type 10 has an invalid length. [ 641.718243][T14119] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2286'. [ 641.742221][T14119] caif0: entered promiscuous mode [ 641.747462][T14119] caif0: entered allmulticast mode [ 641.755637][T14119] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 641.775312][T14117] ip6gretap0: left allmulticast mode [ 641.782361][T14117] ip6gretap0: left promiscuous mode [ 641.790366][T14117] : port 1(ip6gretap0) entered disabled state [ 641.873719][T14139] netlink: 'syz.0.2292': attribute type 3 has an invalid length. [ 641.899379][T14139] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2292'. [ 642.301052][T14162] netlink: 197664 bytes leftover after parsing attributes in process `syz.0.2298'. [ 643.167640][T14187] tap0: tun_chr_ioctl cmd 1074025675 [ 643.180415][T14187] tap0: persist enabled [ 643.189677][T14187] tap0: tun_chr_ioctl cmd 21731 [ 643.201953][T14187] tap0: tun_chr_ioctl cmd 1074025675 [ 643.207630][T14187] tap0: persist enabled [ 643.399932][T14189] netlink: 'syz.3.2306': attribute type 9 has an invalid length. [ 643.410831][T14189] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.2306'. [ 643.458903][T14194] netlink: 'syz.2.2307': attribute type 1 has an invalid length. [ 643.468560][T14194] netlink: 209592 bytes leftover after parsing attributes in process `syz.2.2307'. [ 643.481974][T14197] netlink: 'syz.3.2306': attribute type 9 has an invalid length. [ 643.487805][T14196] ref_ctr_offset mismatch. inode: 0x7a offset: 0x0 ref_ctr_offset(old): 0x0 ref_ctr_offset(new): 0xfe [ 643.494850][T14197] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.2306'. [ 643.569151][T14200] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2310'. [ 643.578705][T14200] openvswitch: netlink: Tunnel attr 2548 out of range max 16 [ 643.910913][T14218] syz.0.2314[14218] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 643.911174][T14218] syz.0.2314[14218] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 644.045986][T14220] netlink: 'syz.1.2315': attribute type 39 has an invalid length. [ 644.773509][T14217] delete_channel: no stack [ 645.302364][T14225] delete_channel: no stack [ 645.506260][T14250] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 645.560793][T14252] delete_channel: no stack [ 645.627553][T14252] delete_channel: no stack [ 645.692414][T14261] syzkaller0: entered promiscuous mode [ 645.699544][T14261] syzkaller0: entered allmulticast mode [ 648.073785][T14284] netlink: 'syz.1.2331': attribute type 8 has an invalid length. [ 648.703320][T14312] netlink: 'syz.3.2340': attribute type 9 has an invalid length. [ 648.723132][T14312] netlink: 49779 bytes leftover after parsing attributes in process `syz.3.2340'. [ 649.060176][T14318] syzkaller0: entered promiscuous mode [ 649.065830][T14318] syzkaller0: entered allmulticast mode [ 649.130346][T14328] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 649.168751][T14328] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 649.189829][T14328] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 649.211353][T14328] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 649.230467][T14328] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 649.237768][T14328] Bluetooth: hci3: unexpected subevent 0x0c length: 150 > 5 [ 649.246239][T14328] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 649.296958][T14336] netlink: 15487 bytes leftover after parsing attributes in process `syz.2.2344'. [ 650.410653][T14352] netlink: 17279 bytes leftover after parsing attributes in process `syz.2.2349'. [ 651.223522][T14357] netlink: 1039 bytes leftover after parsing attributes in process `syz.2.2350'. [ 651.310979][ T5778] Bluetooth: hci4: command tx timeout [ 651.494850][ T7611] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.607747][ T7611] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.757715][ T7611] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.796032][T14326] chnl_net:caif_netlink_parms(): no params data found [ 651.852965][ T7611] bond0: (slave netdevsim0): Releasing backup interface [ 651.972977][T14326] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.980707][T14326] bridge0: port 1(bridge_slave_0) entered disabled state [ 651.993996][T14326] bridge_slave_0: entered allmulticast mode [ 652.005997][T14326] bridge_slave_0: entered promiscuous mode [ 652.015628][T14326] bridge0: port 2(bridge_slave_1) entered blocking state [ 652.023210][T14326] bridge0: port 2(bridge_slave_1) entered disabled state [ 652.030888][T14326] bridge_slave_1: entered allmulticast mode [ 652.038957][T14326] bridge_slave_1: entered promiscuous mode [ 652.123216][T14326] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 652.138961][T14326] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 652.202702][T14326] team0: Port device team_slave_0 added [ 652.214915][T14326] team0: Port device team_slave_1 added [ 652.374651][T14326] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 652.383756][T14326] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 652.412025][T14326] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 652.424168][ T7611] tipc: Left network mode [ 652.431000][T14326] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 652.438450][T14326] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 652.464770][T14326] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 652.589958][ T7611] ip6gretap0 (unregistering): left allmulticast mode [ 652.597092][ T7611] ip6gretap0 (unregistering): left promiscuous mode [ 652.605317][T14395] netlink: 125040 bytes leftover after parsing attributes in process `syz.0.2359'. [ 652.607552][ T7611] : port 1(ip6gretap0) entered disabled state [ 652.646623][T14326] hsr_slave_0: entered promiscuous mode [ 652.653520][T14326] hsr_slave_1: entered promiscuous mode [ 652.661231][T14326] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 652.670997][T14326] Cannot create hsr debugfs directory [ 652.942382][T14397] syzkaller0: entered promiscuous mode [ 652.961593][T14397] syzkaller0: entered allmulticast mode [ 653.388256][ T5778] Bluetooth: hci4: command tx timeout [ 655.482380][ T5778] Bluetooth: hci4: command tx timeout [ 655.770163][T14421] netlink: 'syz.0.2360': attribute type 10 has an invalid length. [ 655.810744][T14421] team0 (unregistering): Port device team_slave_0 removed [ 655.836642][T14421] team0 (unregistering): Port device team_slave_1 removed [ 655.977832][T14442] netlink: 'syz.2.2365': attribute type 10 has an invalid length. [ 655.987021][T14442] netlink: 152 bytes leftover after parsing attributes in process `syz.2.2365'. [ 656.007339][T14442] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 656.121045][T14454] netlink: 'syz.0.2368': attribute type 33 has an invalid length. [ 656.300849][ T3439] .3ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 656.335443][T14462] netlink: 'syz.3.2370': attribute type 21 has an invalid length. [ 656.344451][T14460] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2371'. [ 656.396381][T14460] smc: net device  applied user defined pnetid CONFIG [ 656.789383][T14470] syzkaller0: entered promiscuous mode [ 656.798167][T14470] syzkaller0: entered allmulticast mode [ 657.551834][ T5778] Bluetooth: hci4: command tx timeout [ 658.948338][T14326] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 658.977862][T14326] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 659.078059][T14326] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 659.093781][T14326] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 659.221154][ T7611] hsr_slave_0: left promiscuous mode [ 659.235056][ T7611] hsr_slave_1: left promiscuous mode [ 659.281044][ T7611] veth1_macvtap: left promiscuous mode [ 659.297404][ T7611] veth0_macvtap: left promiscuous mode [ 659.621159][ T7611] team0 (unregistering): Port device geneve1 removed [ 659.952309][ T7611] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 660.001971][ T7611] team0 (unregistering): Port device team_slave_1 removed [ 660.046695][ T7611] team0 (unregistering): Port device team_slave_0 removed [ 660.099953][ T7611] bond0 (unregistering): (slave cÙ): Releasing backup interface [ 660.141351][ T7611] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 660.366551][ T7611] bond0 (unregistering): Released all slaves [ 660.413586][T14499] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 660.438646][T14499] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 660.447206][T14492] netlink: 'syz.3.2375': attribute type 10 has an invalid length. [ 660.527656][T14492] team0 (unregistering): Port device team_slave_1 removed [ 660.552398][T14492] team0 (unregistering): Port device wlan1 removed [ 660.897748][T14326] 8021q: adding VLAN 0 to HW filter on device bond0 [ 660.987101][T14326] 8021q: adding VLAN 0 to HW filter on device team0 [ 661.044630][T14516] netlink: 12518 bytes leftover after parsing attributes in process `syz.3.2380'. [ 661.078383][T14526] netlink: 12518 bytes leftover after parsing attributes in process `syz.3.2380'. [ 661.177631][T14515] mac80211_hwsim hwsim6 wlan0: left promiscuous mode [ 661.185476][T14515] mac80211_hwsim hwsim6 wlan0: left allmulticast mode [ 661.271107][ T3439] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.278380][ T3439] bridge0: port 1(bridge_slave_0) entered forwarding state [ 661.327049][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.334281][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 661.543079][T14532] syzkaller0: entered promiscuous mode [ 661.559242][T14532] syzkaller0: entered allmulticast mode [ 664.001898][T14548] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2387'. [ 664.011920][T14551] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2387'. [ 664.319824][T14574] syzkaller0: entered promiscuous mode [ 664.332465][T14574] syzkaller0: entered allmulticast mode [ 666.347501][T14583] netlink: 'syz.2.2388': attribute type 10 has an invalid length. [ 666.492182][T14583] team0 (unregistering): Port device team_slave_0 removed [ 666.550020][T14583] team0 (unregistering): Port device team_slave_1 removed [ 666.581273][T14583] team0 (unregistering): Port device geneve1 removed [ 666.653742][T14583] team0 (unregistering): Port device wlan1 removed [ 666.713114][T14326] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 666.883523][T14326] veth0_vlan: entered promiscuous mode [ 666.901926][T14326] veth1_vlan: entered promiscuous mode [ 666.996328][T14326] veth0_macvtap: entered promiscuous mode [ 667.029376][T14326] veth1_macvtap: entered promiscuous mode [ 667.114277][T14326] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 667.136336][T14628] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.2396'. [ 667.248464][T14628] bridge_slave_1: default FDB implementation only supports local addresses [ 667.271883][T14326] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 667.308110][T14616] netlink: 'syz.0.2394': attribute type 4 has an invalid length. [ 667.357859][T14616] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2394'. [ 667.517257][T14616] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 667.629113][T14326] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.658033][T14326] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.679541][T14326] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.693109][T14326] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 667.835874][T14646] syzkaller0: entered promiscuous mode [ 667.846827][T14646] syzkaller0: entered allmulticast mode [ 668.534422][T14666] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2403'. [ 670.223184][ T3439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 670.242557][ T3439] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 670.370875][T10804] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 670.384578][T10804] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 670.544891][T14683] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2336'. [ 670.566468][T14683] debugfs: Directory '!!ô!' with parent 'ieee80211' already present! [ 671.685124][T14694] syzkaller0: entered promiscuous mode [ 671.692028][T14694] syzkaller0: entered allmulticast mode [ 671.746882][T14328] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 671.769694][T14328] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 671.782154][T14328] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 671.808495][T14328] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 671.819828][T14328] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 671.828320][T14328] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 673.872426][T14328] Bluetooth: hci0: command tx timeout [ 673.967344][ T7611] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 673.999457][T14715] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 674.100799][ T7611] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.216787][ T7611] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.218682][T14723] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 674.247594][T14720] netlink: 'syz.1.2417': attribute type 8 has an invalid length. [ 674.283850][T14720] netlink: 199848 bytes leftover after parsing attributes in process `syz.1.2417'. [ 674.342165][ T7611] netdevsim netdevsim0 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.657857][T14697] chnl_net:caif_netlink_parms(): no params data found [ 675.083796][T14741] syzkaller0: entered promiscuous mode [ 675.100469][T14741] syzkaller0: entered allmulticast mode [ 675.200530][T14697] bridge0: port 1(bridge_slave_0) entered blocking state [ 675.214190][T14697] bridge0: port 1(bridge_slave_0) entered disabled state [ 675.222291][T14697] bridge_slave_0: entered allmulticast mode [ 675.230174][T14697] bridge_slave_0: entered promiscuous mode [ 675.241501][T14697] bridge0: port 2(bridge_slave_1) entered blocking state [ 675.265288][T14697] bridge0: port 2(bridge_slave_1) entered disabled state [ 675.278244][T14697] bridge_slave_1: entered allmulticast mode [ 675.285300][T14697] bridge_slave_1: entered promiscuous mode [ 675.526779][ T7611] smc: removing net device  with user defined pnetid CONFIG [ 675.958907][T14328] Bluetooth: hci0: command tx timeout [ 676.234770][T14328] Bluetooth: hci1: ISO packet for unknown connection handle 2622 [ 676.459524][T14783] netlink: 'syz.3.2431': attribute type 9 has an invalid length. [ 676.474403][T14783] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.2431'. [ 677.163245][T14798] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2436'. [ 678.068119][T14328] Bluetooth: hci0: command tx timeout [ 680.111597][T14328] Bluetooth: hci0: command tx timeout [ 680.241625][T14798] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2436'. [ 680.370850][T14697] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 680.393201][T14807] netlink: 'syz.1.2437': attribute type 21 has an invalid length. [ 680.408650][T14807] netlink: 156 bytes leftover after parsing attributes in process `syz.1.2437'. [ 680.424145][T14807] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2437'. [ 680.468315][T14697] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 680.518099][T14807] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2437'. [ 680.774776][T14811] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2437'. [ 680.853596][T14697] team0: Port device team_slave_0 added [ 680.872861][T14697] team0: Port device team_slave_1 added [ 681.014665][T14697] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 681.023359][T14697] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 681.055408][T14697] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 681.130553][T14697] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 681.137625][T14697] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 681.171484][T14697] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 682.295959][T14851] netlink: 121460 bytes leftover after parsing attributes in process `syz.3.2444'. [ 683.623867][T14851] netlink: 21068 bytes leftover after parsing attributes in process `syz.3.2444'. [ 683.648700][T14841] À: port 1(vlan0) entered blocking state [ 683.654613][T14841] À: port 1(vlan0) entered disabled state [ 683.676370][T14841] vlan0: entered allmulticast mode [ 683.698135][T14841] veth0_vlan: entered allmulticast mode [ 683.705367][T14841] vlan0: entered promiscuous mode [ 683.841892][T14697] hsr_slave_0: entered promiscuous mode [ 683.855727][T14697] hsr_slave_1: entered promiscuous mode [ 683.965120][T14857] syzkaller0: entered promiscuous mode [ 683.971613][T14857] syzkaller0: entered allmulticast mode [ 685.882449][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.889060][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.863131][ T7611] veth1_macvtap: left promiscuous mode [ 686.879832][ T7611] veth0_macvtap: left promiscuous mode [ 686.897523][ T7611] veth1_vlan: left promiscuous mode [ 686.927528][ T7611] veth0_vlan: left promiscuous mode [ 689.002720][T14927] syzkaller0: entered promiscuous mode [ 689.008545][T14927] syzkaller0: entered allmulticast mode [ 691.183510][T14697] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 691.248812][T14697] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 691.312181][T14697] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 691.368732][T14697] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 691.627025][T14697] 8021q: adding VLAN 0 to HW filter on device bond0 [ 691.696151][T14697] 8021q: adding VLAN 0 to HW filter on device team0 [ 691.747791][T14972] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2471'. [ 691.752726][T10797] bridge0: port 1(bridge_slave_0) entered blocking state [ 691.764450][T10797] bridge0: port 1(bridge_slave_0) entered forwarding state [ 691.802014][T14972] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 691.822858][T10797] bridge0: port 2(bridge_slave_1) entered blocking state [ 691.830088][T10797] bridge0: port 2(bridge_slave_1) entered forwarding state [ 691.846487][T14972] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 691.998740][T14697] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 692.037912][T14697] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 692.194968][T14991] netlink: 121460 bytes leftover after parsing attributes in process `syz.2.2475'. [ 692.238792][T14991] netlink: 20720 bytes leftover after parsing attributes in process `syz.2.2475'. [ 692.516029][T15006] C: renamed from team_slave_0 (while UP) [ 692.597803][T15006] netlink: 'syz.1.2478': attribute type 3 has an invalid length. [ 692.621890][T15006] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 692.724729][T14697] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 692.883362][T14697] veth0_vlan: entered promiscuous mode [ 692.965750][T14697] veth1_vlan: entered promiscuous mode [ 693.084186][T14697] veth0_macvtap: entered promiscuous mode [ 693.112908][T14697] veth1_macvtap: entered promiscuous mode [ 693.143933][T14697] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 693.170216][T14697] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 693.212323][T14697] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 693.267826][T14697] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 693.291996][T14697] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 693.316700][T14697] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 693.380694][T14697] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.417709][T14697] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.446450][T14697] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.495238][T14697] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 693.689948][T15040] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2483'. [ 693.828238][ T7619] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 693.863912][ T7619] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 693.992468][ T7619] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 694.013918][ T7619] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 694.114578][T15048] netlink: 'syz.1.2485': attribute type 21 has an invalid length. [ 694.178506][T15048] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2485'. [ 694.187653][T15048] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2485'. [ 694.301651][T15049] netlink: 'syz.2.2487': attribute type 39 has an invalid length. [ 694.963168][T15082] netlink: 'syz.1.2491': attribute type 11 has an invalid length. [ 694.982945][T15082] netlink: 'syz.1.2491': attribute type 1 has an invalid length. [ 695.018072][T15082] netlink: 199820 bytes leftover after parsing attributes in process `syz.1.2491'. [ 695.099949][T15082] netlink: 'syz.1.2491': attribute type 11 has an invalid length. [ 695.174099][T15082] netlink: 'syz.1.2491': attribute type 1 has an invalid length. [ 695.236855][T15082] netlink: 199820 bytes leftover after parsing attributes in process `syz.1.2491'. [ 695.276379][T15082] netlink: 'syz.1.2491': attribute type 11 has an invalid length. [ 695.310474][T15082] netlink: 'syz.1.2491': attribute type 1 has an invalid length. [ 695.348642][T15082] netlink: 199820 bytes leftover after parsing attributes in process `syz.1.2491'. [ 695.516270][T15082] netlink: 'syz.1.2491': attribute type 11 has an invalid length. [ 695.550269][T15082] netlink: 199820 bytes leftover after parsing attributes in process `syz.1.2491'. [ 695.701693][ T5778] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 695.713608][ T5778] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 695.722494][ T5778] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 695.736770][ T5778] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 695.748413][ T5778] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 695.776090][ T5778] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 696.304496][ T3439] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.364468][T15125] bridge_slave_1: left allmulticast mode [ 696.386480][T15125] bridge_slave_1: left promiscuous mode [ 696.458232][T15125] bridge0: port 2(bridge_slave_1) entered disabled state [ 696.481055][T15125] bridge_slave_0: left allmulticast mode [ 696.486782][T15125] bridge_slave_0: left promiscuous mode [ 696.519688][T15125] bridge0: port 1(bridge_slave_0) entered disabled state [ 696.845741][ T3439] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.873393][T15136] __nla_validate_parse: 4 callbacks suppressed [ 696.873411][T15136] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2498'. [ 696.891513][T15136] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 696.902871][T15136] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 696.914496][T15136] batadv_slave_1: entered promiscuous mode [ 697.107157][ T3439] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.186443][T15101] chnl_net:caif_netlink_parms(): no params data found [ 697.268539][ T3439] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.802488][T15101] bridge0: port 1(bridge_slave_0) entered blocking state [ 697.830232][T15101] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.837795][T15101] bridge_slave_0: entered allmulticast mode [ 697.868278][T14328] Bluetooth: hci3: command tx timeout [ 697.873802][T15101] bridge_slave_0: entered promiscuous mode [ 697.950252][T15101] bridge0: port 2(bridge_slave_1) entered blocking state [ 697.957505][T15101] bridge0: port 2(bridge_slave_1) entered disabled state [ 698.044063][T15101] bridge_slave_1: entered allmulticast mode [ 698.080141][T15101] bridge_slave_1: entered promiscuous mode [ 698.412028][T15101] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 698.507899][T15101] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 698.626820][T15101] team0: Port device team_slave_0 added [ 698.730515][T15101] team0: Port device team_slave_1 added [ 698.781263][ T3439] tipc: Left network mode [ 698.880377][T15190] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.2505'. [ 698.948745][T15190] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.2505'. [ 699.135814][T15101] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 699.151173][T15101] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 699.207209][T15101] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 699.465711][T15101] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 699.492761][T15101] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 699.567046][T15101] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 699.790567][T15101] hsr_slave_0: entered promiscuous mode [ 699.802052][T15101] hsr_slave_1: entered promiscuous mode [ 699.829312][T15101] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 699.836940][T15101] Cannot create hsr debugfs directory [ 699.958309][T14328] Bluetooth: hci3: command tx timeout [ 700.592780][ T3439] gretap0 (unregistering): left allmulticast mode [ 700.618176][ T3439] gretap0 (unregistering): left promiscuous mode [ 700.624846][ T3439] Ÿë: port 1(gretap0) entered disabled state [ 701.393823][T15247] netlink: 196 bytes leftover after parsing attributes in process `syz.1.2515'. [ 701.513215][T15248] validate_nla: 10 callbacks suppressed [ 701.513236][T15248] netlink: 'syz.1.2515': attribute type 29 has an invalid length. [ 702.028356][T14328] Bluetooth: hci3: command tx timeout [ 703.980099][T15248] netlink: 'syz.1.2515': attribute type 29 has an invalid length. [ 704.118132][T14328] Bluetooth: hci3: command tx timeout [ 704.288264][T15271] netlink: 12611 bytes leftover after parsing attributes in process `syz.1.2518'. [ 704.436303][T15277] netlink: 'syz.0.2519': attribute type 15 has an invalid length. [ 704.457307][T15277] netlink: 11254 bytes leftover after parsing attributes in process `syz.0.2519'. [ 704.543630][T15278] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2520'. [ 704.565921][T15281] netlink: 'syz.0.2519': attribute type 6 has an invalid length. [ 704.574295][T15281] netlink: 'syz.0.2519': attribute type 7 has an invalid length. [ 704.596830][T15281] netlink: 'syz.0.2519': attribute type 11 has an invalid length. [ 704.605188][T15281] netlink: 'syz.0.2519': attribute type 15 has an invalid length. [ 704.613220][T15281] netlink: 'syz.0.2519': attribute type 16 has an invalid length. [ 704.621670][T15281] netlink: 'syz.0.2519': attribute type 21 has an invalid length. [ 704.630627][T15281] netlink: 'syz.0.2519': attribute type 25 has an invalid length. [ 706.886626][T15101] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 707.128197][T15101] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 707.174311][ T3439] veth0_to_team: left allmulticast mode [ 707.188780][ T3439] veth0_to_team: left promiscuous mode [ 707.194772][ T3439] Ÿë: port 2(veth0_to_team) entered disabled state [ 707.229347][ T3439] hsr_slave_0: left promiscuous mode [ 707.241567][ T3439] hsr_slave_1: left promiscuous mode [ 707.265637][ T3439] veth1_macvtap: left promiscuous mode [ 707.271978][ T3439] veth0_macvtap: left promiscuous mode [ 707.277621][ T3439] veth1_vlan: left promiscuous mode [ 709.998153][ T3439] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 710.050403][ T3439] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 710.325320][ T3439] bond0 (unregistering): Released all slaves [ 710.366547][T15101] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 710.383808][T15101] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 710.600731][T15101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 710.651585][T15101] 8021q: adding VLAN 0 to HW filter on device team0 [ 710.742372][ T7615] bridge0: port 1(bridge_slave_0) entered blocking state [ 710.749584][ T7615] bridge0: port 1(bridge_slave_0) entered forwarding state [ 710.793106][ T7615] bridge0: port 2(bridge_slave_1) entered blocking state [ 710.800781][ T7615] bridge0: port 2(bridge_slave_1) entered forwarding state [ 711.432255][T15364] netpci0: tun_chr_ioctl cmd 2147767519 [ 711.496225][T15101] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 711.748930][T15101] veth0_vlan: entered promiscuous mode [ 711.765800][T15101] veth1_vlan: entered promiscuous mode [ 711.835342][T15101] veth0_macvtap: entered promiscuous mode [ 711.869999][T15101] veth1_macvtap: entered promiscuous mode [ 711.919706][T15101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 711.940474][T15101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 711.990420][T15101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 712.028044][T15101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 712.040905][T15101] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 712.058203][T15101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 712.072214][T15101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 712.104692][T15101] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 712.148090][T15101] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 712.185088][T15101] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 712.337639][T15101] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.360868][T15101] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.380041][T15101] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.393636][T15101] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 712.545986][T10797] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 712.566278][T10797] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 712.616799][T10797] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 712.641523][T10797] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 712.995905][ T7619] wlan1: Trigger new scan to find an IBSS to join [ 713.194536][T15403] syzkaller0: entered promiscuous mode [ 713.201436][T15403] syzkaller0: entered allmulticast mode [ 713.603908][T15415] validate_nla: 4 callbacks suppressed [ 713.603925][T15415] netlink: 'syz.1.2550': attribute type 10 has an invalid length. [ 713.637919][T15419] netlink: 10 bytes leftover after parsing attributes in process `syz.0.2553'. [ 713.681602][T15415] team0: Device ipvlan1 failed to register rx_handler [ 713.904365][T15419] C: renamed from team_slave_0 (while UP) [ 713.990696][T15419] netlink: 'syz.0.2553': attribute type 1 has an invalid length. [ 714.039178][T15419] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2553'. [ 714.161984][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 714.175664][ T5778] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 714.197477][ T5778] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 714.231922][ T5778] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 714.255338][ T5778] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 714.264095][ T5778] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 714.301782][ T993] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.477790][ T993] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.589606][ T993] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.105197][T15447] syzkaller0: entered promiscuous mode [ 715.115790][T15447] syzkaller0: entered allmulticast mode [ 716.352312][T14328] Bluetooth: hci1: command tx timeout [ 717.913963][T15426] chnl_net:caif_netlink_parms(): no params data found [ 717.959969][ T7611] wlan1: Trigger new scan to find an IBSS to join [ 718.429668][T14328] Bluetooth: hci1: command tx timeout [ 718.585816][T15501] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2571'. [ 718.939652][T15501] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2571'. [ 718.981419][ T7615] wlan1: Creating new IBSS network, BSSID a2:ff:d4:88:62:d9 [ 719.134826][T15426] bridge0: port 1(bridge_slave_0) entered blocking state [ 719.172167][T15426] bridge0: port 1(bridge_slave_0) entered disabled state [ 719.203454][T15426] bridge_slave_0: entered allmulticast mode [ 719.245091][T15426] bridge_slave_0: entered promiscuous mode [ 719.264700][T15503] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2571'. [ 719.274871][T15504] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.2571'. [ 719.360705][T15426] bridge0: port 2(bridge_slave_1) entered blocking state [ 719.368163][T15426] bridge0: port 2(bridge_slave_1) entered disabled state [ 719.381511][T15426] bridge_slave_1: entered allmulticast mode [ 719.416749][T15426] bridge_slave_1: entered promiscuous mode [ 719.637493][T15426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 719.662733][T15426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 719.802168][T15426] team0: Port device team_slave_0 added [ 719.829238][T15518] : port 1(ip6gretap0) entered blocking state [ 719.843289][T15518] : port 1(ip6gretap0) entered disabled state [ 719.850498][T15518] ip6gretap0: entered allmulticast mode [ 719.872199][T15518] ip6gretap0: entered promiscuous mode [ 719.893522][T15521] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.2575'. [ 719.926354][T15426] team0: Port device team_slave_1 added [ 720.298755][T15426] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 720.306441][T15426] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 720.358262][T15426] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 720.371469][T15426] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 720.378787][T15426] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 720.406775][T15426] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 720.508445][T14328] Bluetooth: hci1: command tx timeout [ 720.639565][T15426] hsr_slave_0: entered promiscuous mode [ 720.659147][T15426] hsr_slave_1: entered promiscuous mode [ 720.668933][T15426] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 720.676548][T15426] Cannot create hsr debugfs directory [ 720.795928][T15545] syz.1.2579[15545] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 720.796193][T15545] syz.1.2579[15545] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 720.838365][T15544] netlink: 'syz.0.2578': attribute type 10 has an invalid length. [ 720.875012][T15545] netlink: 'syz.1.2579': attribute type 3 has an invalid length. [ 720.904352][T15545] netlink: 130984 bytes leftover after parsing attributes in process `syz.1.2579'. [ 720.940772][T15544] team0: Port device wlan1 added [ 721.448661][T15539] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 721.486117][T15569] netlink: 'syz.1.2584': attribute type 27 has an invalid length. [ 721.521492][T15569] netlink: 'syz.1.2584': attribute type 3 has an invalid length. [ 721.565753][T15574] netlink: zone id is out of range [ 721.575009][T15574] netlink: set zone limit has 8 unknown bytes [ 722.588474][T14328] Bluetooth: hci1: command tx timeout [ 722.914601][T15607] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.2588'. [ 722.928444][ T993] hsr_slave_0: left promiscuous mode [ 722.955354][ T993] hsr_slave_1: left promiscuous mode [ 722.976413][ T993] bridge_slave_0: left allmulticast mode [ 722.985865][ T993] bridge_slave_0: left promiscuous mode [ 722.997868][ T7619] wlan1: Trigger new scan to find an IBSS to join [ 723.009596][ T993] bridge0: port 1(bridge_slave_0) entered disabled state [ 723.016776][T15609] netlink: 'syz.1.2589': attribute type 2 has an invalid length. [ 723.024877][T15609] netlink: 17267 bytes leftover after parsing attributes in process `syz.1.2589'. [ 723.060509][ T993] veth1_macvtap: left promiscuous mode [ 723.066980][ T993] veth1_vlan: left promiscuous mode [ 724.311637][ T993] bond0 (unregistering): (slave 4@0Ù): Releasing backup interface [ 724.361326][ T993] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 724.411662][ T993] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 724.688827][ T993] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 724.705234][ T993] bond0 (unregistering): Released all slaves [ 724.930113][T15615] netlink: 'syz.1.2591': attribute type 10 has an invalid length. [ 724.955286][T15615] team0: Port device geneve1 added [ 724.979792][T15619] netlink: 'syz.3.2592': attribute type 2 has an invalid length. [ 724.998416][T15619] netlink: 'syz.3.2592': attribute type 9 has an invalid length. [ 725.006222][T15619] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2592'. [ 726.013579][T15634] netlink: 'syz.3.2597': attribute type 2 has an invalid length. [ 726.039716][T15634] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2597'. [ 726.102241][T15426] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 726.112671][T15426] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 726.135083][T15426] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 726.163260][T15426] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 726.432161][T15426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 726.498997][T15426] 8021q: adding VLAN 0 to HW filter on device team0 [ 726.564187][T10801] bridge0: port 1(bridge_slave_0) entered blocking state [ 726.571439][T10801] bridge0: port 1(bridge_slave_0) entered forwarding state [ 726.773265][T15653] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.2600'. [ 727.002391][ T7619] bridge0: port 2(bridge_slave_1) entered blocking state [ 727.009755][ T7619] bridge0: port 2(bridge_slave_1) entered forwarding state [ 727.960454][ T7615] wlan1: Trigger new scan to find an IBSS to join [ 728.022204][T15426] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 728.361545][T15426] veth0_vlan: entered promiscuous mode [ 728.421911][T15426] veth1_vlan: entered promiscuous mode [ 728.499765][T15695] netlink: zone id is out of range [ 728.505275][T15695] netlink: set zone limit has 8 unknown bytes [ 728.643899][T15426] veth0_macvtap: entered promiscuous mode [ 728.856804][T15426] veth1_macvtap: entered promiscuous mode [ 730.944210][T15426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 730.967028][T15426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 730.979652][T15426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 730.995862][T15426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.018167][T15426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 731.046626][T15426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.092846][T15426] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 731.139769][T15426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 731.159624][T15426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.177034][T15426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 731.206383][T15426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.232808][T15426] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 731.268191][T15426] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 731.302462][T10797] wlan1: Creating new IBSS network, BSSID d2:c6:22:f4:72:15 [ 731.403802][T15426] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 731.483299][T15426] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.503251][T15426] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.523599][T15426] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.548048][T15426] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 731.764171][T10797] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.808290][T10797] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 731.866355][ T7611] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 731.892684][ T7611] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 732.108257][T15739] netlink: 'syz.0.2612': attribute type 10 has an invalid length. [ 732.137052][T15739] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2612'. [ 732.148497][T15739] team0: entered promiscuous mode [ 732.156355][T15739] C: entered promiscuous mode [ 732.190124][T15739] team_slave_1: entered promiscuous mode [ 732.196027][T15739] mac80211_hwsim hwsim35 wlan1: entered promiscuous mode [ 732.229230][T15739] team0: entered allmulticast mode [ 732.234424][T15739] C: entered allmulticast mode [ 732.244001][T15739] team_slave_1: entered allmulticast mode [ 732.250182][T15739] mac80211_hwsim hwsim35 wlan1: entered allmulticast mode [ 732.258568][T15739] bridge0: port 3(team0) entered blocking state [ 732.265042][T15739] bridge0: port 3(team0) entered disabled state [ 732.298060][T15739] bridge0: port 3(team0) entered blocking state [ 732.304481][T15739] bridge0: port 3(team0) entered forwarding state [ 732.349680][T15742] netlink: 'syz.0.2612': attribute type 10 has an invalid length. [ 732.368419][T15742] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2612'. [ 733.711328][T15783] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 733.758525][T15783] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 733.783672][T15783] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 733.815813][T15783] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 734.170817][T15786] mac80211_hwsim hwsim35 ..ãc¤±: renamed from wlan1 (while UP) [ 734.631826][T15803] netlink: 15998 bytes leftover after parsing attributes in process `syz.0.2624'. [ 734.725644][T15804] netlink: 10 bytes leftover after parsing attributes in process `syz.3.2625'. [ 734.926302][T15809] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2627'. [ 735.021272][T15813] netlink: 'syz.2.2629': attribute type 2 has an invalid length. [ 735.098235][T15813] netlink: 17267 bytes leftover after parsing attributes in process `syz.2.2629'. [ 735.357071][T15816] netlink: 149044 bytes leftover after parsing attributes in process `syz.0.2630'. [ 736.841197][T15847] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2640'. [ 737.097137][T15862] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2642'. [ 737.485925][T15864] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2643'. [ 739.025620][ T7611] tipc: Subscription rejected, illegal request [ 739.830036][T15909] syzkaller0: entered promiscuous mode [ 739.835618][T15909] syzkaller0: entered allmulticast mode [ 739.873247][T15914] FAULT_INJECTION: forcing a failure. [ 739.873247][T15914] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 739.928380][T15914] CPU: 0 PID: 15914 Comm: syz.0.2655 Not tainted syzkaller #0 [ 739.934514][T15913] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2656'. [ 739.935926][T15914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 739.935976][T15914] Call Trace: [ 739.935990][T15914] [ 739.936012][T15914] dump_stack_lvl+0x18c/0x250 [ 739.936070][T15914] ? show_regs_print_info+0x20/0x20 [ 739.936113][T15914] ? load_image+0x420/0x420 [ 739.936161][T15914] ? __lock_acquire+0x7d40/0x7d40 [ 739.981325][T15914] ? snprintf+0xe9/0x140 [ 739.985676][T15914] should_fail_ex+0x39d/0x4d0 [ 739.990457][T15914] _copy_to_user+0x2f/0xa0 [ 739.994956][T15914] simple_read_from_buffer+0xe7/0x150 [ 739.995926][T15911] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2656'. [ 740.000425][T15914] proc_fail_nth_read+0x1e8/0x260 [ 740.000482][T15914] ? proc_fault_inject_write+0x360/0x360 [ 740.000537][T15914] ? fsnotify_perm+0x271/0x5e0 [ 740.025024][T15914] ? proc_fault_inject_write+0x360/0x360 [ 740.030720][T15914] vfs_read+0x28b/0x970 [ 740.034952][T15914] ? kernel_read+0x1e0/0x1e0 [ 740.039602][T15914] ? __fget_files+0x28/0x4b0 [ 740.044252][T15914] ? __fget_files+0x28/0x4b0 [ 740.048903][T15914] ? __fget_files+0x43d/0x4b0 [ 740.053663][T15914] ? __fdget_pos+0x2a3/0x330 [ 740.058303][T15914] ? ksys_read+0x75/0x260 [ 740.062700][T15914] ksys_read+0x150/0x260 [ 740.067011][T15914] ? vfs_write+0x990/0x990 [ 740.071510][T15914] ? lockdep_hardirqs_on+0x98/0x150 [ 740.076781][T15914] do_syscall_64+0x55/0xa0 [ 740.081244][T15914] ? clear_bhb_loop+0x40/0x90 [ 740.085968][T15914] ? clear_bhb_loop+0x40/0x90 [ 740.090722][T15914] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 740.096662][T15914] RIP: 0033:0x7f5bfe95d04e [ 740.101123][T15914] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 740.120774][T15914] RSP: 002b:00007f5bff809fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 740.129248][T15914] RAX: ffffffffffffffda RBX: 00007f5bff80a6c0 RCX: 00007f5bfe95d04e [ 740.137268][T15914] RDX: 000000000000000f RSI: 00007f5bff80a0a0 RDI: 0000000000000009 [ 740.145283][T15914] RBP: 00007f5bff80a090 R08: 0000000000000000 R09: 0000000000000000 [ 740.153306][T15914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 740.161325][T15914] R13: 00007f5bfec16218 R14: 00007f5bfec16180 R15: 00007ffcdf9d8438 [ 740.169386][T15914] [ 740.871507][T15936] netlink: 'syz.1.2661': attribute type 29 has an invalid length. [ 743.896181][T15928] mac80211_hwsim hwsim32 .3ãc¤±: renamed from wlan1 (while UP) [ 743.917225][T15936] netlink: 'syz.1.2661': attribute type 29 has an invalid length. [ 744.344458][T15961] netlink: 'syz.2.2667': attribute type 6 has an invalid length. [ 744.381957][T15961] netlink: 'syz.2.2667': attribute type 1 has an invalid length. [ 744.398155][T15961] netlink: 199820 bytes leftover after parsing attributes in process `syz.2.2667'. [ 744.454535][T15962] netlink: 'syz.2.2667': attribute type 6 has an invalid length. [ 744.491737][T15962] netlink: 'syz.2.2667': attribute type 1 has an invalid length. [ 744.509553][T15962] netlink: 199820 bytes leftover after parsing attributes in process `syz.2.2667'. [ 744.956328][T15976] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 745.227708][T15995] wlan0: mtu greater than device maximum [ 745.413701][T15999] netlink: 'syz.0.2680': attribute type 10 has an invalid length. [ 745.427888][T15999] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2680'. [ 745.441852][T15999] hsr0: entered promiscuous mode [ 745.466700][T15999] bridge0: port 4(hsr0) entered blocking state [ 745.474926][T15999] bridge0: port 4(hsr0) entered disabled state [ 745.488868][T15999] hsr0: entered allmulticast mode [ 745.506788][T15999] hsr_slave_0: entered allmulticast mode [ 745.518794][T15999] hsr_slave_1: entered allmulticast mode [ 745.579500][T15999] bridge0: port 4(hsr0) entered blocking state [ 745.586502][T15999] bridge0: port 4(hsr0) entered forwarding state [ 745.608663][T16007] netlink: 'syz.2.2683': attribute type 1 has an invalid length. [ 745.617181][T16007] netlink: 'syz.2.2683': attribute type 4 has an invalid length. [ 745.626612][T16007] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.2683'. [ 745.990427][T16022] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2686'. [ 746.027110][T16021] syzkaller0: entered promiscuous mode [ 746.040513][T16021] syzkaller0: entered allmulticast mode [ 746.047782][T16022] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2686'. [ 746.079468][T16015] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2686'. [ 747.313738][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.320973][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 751.103427][T16030] netlink: 'syz.1.2689': attribute type 10 has an invalid length. [ 751.111408][T16030] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2689'. [ 751.121033][T16030] ipvlan1: entered promiscuous mode [ 751.127015][T16030] ipvlan1: entered allmulticast mode [ 751.135443][T16030] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 751.727774][T16067] netlink: 2 bytes leftover after parsing attributes in process `syz.1.2697'. [ 751.743404][T16067] batadv_slave_1: entered promiscuous mode [ 751.992857][T16070] netlink: 'syz.0.2700': attribute type 2 has an invalid length. [ 752.027120][T16070] netlink: 'syz.0.2700': attribute type 8 has an invalid length. [ 752.037046][T16070] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2700'. [ 752.535502][T16084] netlink: 135856 bytes leftover after parsing attributes in process `syz.1.2702'. [ 752.545743][T16084] netlink: 8442 bytes leftover after parsing attributes in process `syz.1.2702'. [ 752.959199][T16104] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2710'. [ 752.993913][T16104] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 753.032398][T16104] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 753.091402][T16104] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 753.111354][T16104] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.172503][T16119] netlink: 703 bytes leftover after parsing attributes in process `syz.0.2712'. [ 754.285884][T16123] netlink: 16098 bytes leftover after parsing attributes in process `syz.3.2713'. [ 754.559852][T16127] syzkaller0: entered promiscuous mode [ 754.571320][T16127] syzkaller0: entered allmulticast mode [ 754.626248][T16131] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 754.643280][T16131] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 754.655923][T16131] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 754.678108][T16131] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 754.969665][T16141] warn_alloc: 2 callbacks suppressed [ 754.969685][T16141] syz.3.2719: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 755.002216][T16141] CPU: 0 PID: 16141 Comm: syz.3.2719 Not tainted syzkaller #0 [ 755.009764][T16141] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 755.019870][T16141] Call Trace: [ 755.023302][T16141] [ 755.026271][T16141] dump_stack_lvl+0x18c/0x250 [ 755.031043][T16141] ? show_regs_print_info+0x20/0x20 [ 755.036421][T16141] ? load_image+0x420/0x420 [ 755.040993][T16141] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 755.047468][T16141] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 755.054043][T16141] warn_alloc+0x246/0x340 [ 755.058433][T16141] ? stack_trace_save+0xaa/0x100 [ 755.063467][T16141] ? zone_watermark_ok_safe+0x230/0x230 [ 755.069107][T16141] ? kasan_set_track+0x5f/0x70 [ 755.073934][T16141] ? kasan_set_track+0x4e/0x70 [ 755.078750][T16141] ? __kasan_kmalloc+0x8f/0xa0 [ 755.083585][T16141] ? xsk_init_queue+0xad/0x100 [ 755.088490][T16141] ? xsk_setsockopt+0x4e5/0x760 [ 755.093398][T16141] ? do_sock_setsockopt+0x175/0x1a0 [ 755.098675][T16141] ? __x64_sys_setsockopt+0x182/0x200 [ 755.104111][T16141] __vmalloc_node_range+0x126/0x1330 [ 755.109491][T16141] ? free_vm_area+0x50/0x50 [ 755.114100][T16141] vmalloc_user+0x74/0x80 [ 755.118481][T16141] ? xskq_create+0xbf/0x170 [ 755.123063][T16141] xskq_create+0xbf/0x170 [ 755.127457][T16141] xsk_init_queue+0xad/0x100 [ 755.132094][T16141] xsk_setsockopt+0x4e5/0x760 [ 755.136805][T16141] ? xsk_poll+0x680/0x680 [ 755.141287][T16141] ? __fget_files+0x28/0x4b0 [ 755.145917][T16141] ? __fget_files+0x28/0x4b0 [ 755.150548][T16141] ? aa_sock_opt_perm+0x74/0x100 [ 755.155542][T16141] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 755.161127][T16141] ? security_socket_setsockopt+0x7e/0xa0 [ 755.166966][T16141] ? xsk_poll+0x680/0x680 [ 755.171358][T16141] do_sock_setsockopt+0x175/0x1a0 [ 755.176416][T16141] ? __fdget+0x180/0x210 [ 755.180710][T16141] __x64_sys_setsockopt+0x182/0x200 [ 755.185952][T16141] do_syscall_64+0x55/0xa0 [ 755.190398][T16141] ? clear_bhb_loop+0x40/0x90 [ 755.195108][T16141] ? clear_bhb_loop+0x40/0x90 [ 755.199831][T16141] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 755.205752][T16141] RIP: 0033:0x7fb03279c819 [ 755.210194][T16141] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 755.229860][T16141] RSP: 002b:00007fb033658028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 755.238304][T16141] RAX: ffffffffffffffda RBX: 00007fb032a16090 RCX: 00007fb03279c819 [ 755.246311][T16141] RDX: 0000000000000002 RSI: 000000000000011b RDI: 0000000000000006 [ 755.254313][T16141] RBP: 00007fb032832c91 R08: 0000000000000004 R09: 0000000000000000 [ 755.262313][T16141] R10: 0000200000000900 R11: 0000000000000246 R12: 0000000000000000 [ 755.270332][T16141] R13: 00007fb032a16128 R14: 00007fb032a16090 R15: 00007ffcf2de9d78 [ 755.278372][T16141] [ 755.306971][T16141] Mem-Info: [ 755.310310][T16141] active_anon:8510 inactive_anon:0 isolated_anon:0 [ 755.310310][T16141] active_file:18373 inactive_file:40189 isolated_file:0 [ 755.310310][T16141] unevictable:768 dirty:235 writeback:0 [ 755.310310][T16141] slab_reclaimable:10458 slab_unreclaimable:99904 [ 755.310310][T16141] mapped:24432 shmem:1361 pagetables:566 [ 755.310310][T16141] sec_pagetables:0 bounce:0 [ 755.310310][T16141] kernel_misc_reclaimable:0 [ 755.310310][T16141] free:1335615 free_pcp:7539 free_cma:0 [ 755.356707][T16141] Node 0 active_anon:34040kB inactive_anon:0kB active_file:73492kB inactive_file:160552kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:97728kB dirty:940kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10828kB pagetables:2264kB sec_pagetables:0kB all_unreclaimable? no [ 755.392970][T16141] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 755.426141][T16141] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 755.472225][T16141] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 755.481801][T16141] Node 0 DMA32 free:1425476kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:34104kB inactive_anon:0kB active_file:73492kB inactive_file:159724kB unevictable:1536kB writepending:940kB present:3129332kB managed:2586952kB mlocked:0kB bounce:0kB free_pcp:16708kB local_pcp:6920kB free_cma:0kB [ 755.517873][T16141] lowmem_reserve[]: 0 0 0 0 0 [ 755.522895][T16141] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:828kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:8kB free_cma:0kB [ 755.552594][T16141] lowmem_reserve[]: 0 0 0 0 0 [ 755.557557][T16141] Node 1 Normal free:3901624kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:13792kB local_pcp:11680kB free_cma:0kB [ 755.596597][T16141] lowmem_reserve[]: 0 0 0 0 0 [ 755.601672][T16141] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 755.615654][T16141] Node 0 DMA32: 169*4kB (UME) 450*8kB (UME) 843*16kB (UME) 685*32kB (ME) 247*64kB (UME) 653*128kB (UME) 237*256kB (UM) 202*512kB (UME) 136*1024kB (UM) 4*2048kB (M) 238*4096kB (M) = 1425476kB [ 755.641207][T16141] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 755.655470][T16141] Node 1 Normal: 228*4kB (UME) 43*8kB (UME) 47*16kB (UME) 169*32kB (UME) 41*64kB (UE) 9*128kB (UME) 1*256kB (U) 2*512kB (UM) 2*1024kB (UE) 2*2048kB (UE) 948*4096kB (M) = 3901624kB [ 755.674114][T16141] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 755.683808][T16141] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 755.693322][T16141] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 755.704122][T16141] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 755.713831][T16141] 59923 total pagecache pages [ 755.718772][T16141] 0 pages in swap cache [ 755.723339][T16141] Free swap = 124996kB [ 755.727668][T16141] Total swap = 124996kB [ 755.733111][T16141] 2097051 pages RAM [ 755.737111][T16141] 0 pages HighMem/MovableOnly [ 755.753951][T16141] 416927 pages reserved [ 755.759548][T16141] 0 pages cma reserved [ 757.378271][T16140] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 757.604897][T16152] netlink: 'syz.1.2729': attribute type 10 has an invalid length. [ 757.629407][T16152] netlink: 210880 bytes leftover after parsing attributes in process `syz.1.2729'. [ 757.652271][T16157] netlink: 668 bytes leftover after parsing attributes in process `syz.2.2722'. [ 757.671517][T16157] openvswitch: netlink: ufid size 3064 bytes exceeds the range (1, 16) [ 757.705489][T16161] netlink: 2 bytes leftover after parsing attributes in process `syz.3.2721'. [ 757.716207][T16157] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 757.727389][T16161] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 757.744078][T16161] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 757.755523][T16161] batadv_slave_1: entered promiscuous mode [ 757.886100][T16164] netlink: 'syz.0.2723': attribute type 10 has an invalid length. [ 757.935290][T16164] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 757.981502][T16162] netlink: 'syz.0.2723': attribute type 10 has an invalid length. [ 758.402375][T16182] netlink: 65051 bytes leftover after parsing attributes in process `syz.0.2727'. [ 758.693336][T16188] netlink: 135856 bytes leftover after parsing attributes in process `syz.3.2728'. [ 758.713162][T16188] netlink: 8442 bytes leftover after parsing attributes in process `syz.3.2728'. [ 761.363648][ T7619] ..ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 761.544527][T16191] syzkaller0: entered promiscuous mode [ 761.551814][T16191] syzkaller0: entered allmulticast mode [ 761.747493][T16211] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2733'. [ 761.758363][T16211] openvswitch: netlink: Geneve opt len 5 is not a multiple of 4. [ 764.142826][T16211] netlink: 'syz.1.2733': attribute type 21 has an invalid length. [ 764.151698][T16211] netlink: 128 bytes leftover after parsing attributes in process `syz.1.2733'. [ 764.160953][T16211] netlink: 'syz.1.2733': attribute type 4 has an invalid length. [ 764.168981][T16211] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2733'. [ 764.284754][T16219] syzkaller0: entered promiscuous mode [ 764.294949][T16219] syzkaller0: entered allmulticast mode [ 764.859706][T16230] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.2739'. [ 766.504719][T16225] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 766.512206][T16225] IPv6: NLM_F_CREATE should be set when creating new route [ 766.519573][T16225] IPv6: NLM_F_CREATE should be set when creating new route [ 766.526939][T16225] IPv6: NLM_F_CREATE should be set when creating new route [ 766.543176][T16230] netlink: 6324 bytes leftover after parsing attributes in process `syz.1.2739'. [ 767.387261][T16255] syzkaller0: entered promiscuous mode [ 767.419227][T16255] syzkaller0: entered allmulticast mode [ 767.683128][T16272] netlink: 'syz.1.2751': attribute type 9 has an invalid length. [ 767.708895][T16272] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.2751'. [ 770.512778][T16286] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2754'. [ 770.525611][T16286] openvswitch: netlink: Geneve option length err (len 1788, max 255). [ 770.641236][T16295] netlink: 'syz.1.2755': attribute type 10 has an invalid length. [ 770.936496][T16295] team0: Device wg1 is of different type [ 772.624243][T16336] delete_channel: no stack [ 772.696455][T16334] delete_channel: no stack [ 772.739576][T16338] netlink: 'syz.1.2769': attribute type 2 has an invalid length. [ 772.768703][T16338] netlink: 14 bytes leftover after parsing attributes in process `syz.1.2769'. [ 772.952085][T16353] netlink: 'syz.2.2773': attribute type 10 has an invalid length. [ 772.960488][T16353] netlink: 55 bytes leftover after parsing attributes in process `syz.2.2773'. [ 775.005612][ T5778] Bluetooth: hci4: command 0x0406 tx timeout [ 775.805911][T16348] netlink: 'syz.3.2771': attribute type 10 has an invalid length. [ 775.815275][T16348] netlink: 65015 bytes leftover after parsing attributes in process `syz.3.2771'. [ 775.836374][T16356] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 775.843757][T16356] IPv6: NLM_F_CREATE should be set when creating new route [ 775.851190][T16356] IPv6: NLM_F_CREATE should be set when creating new route [ 775.858491][T16356] IPv6: NLM_F_CREATE should be set when creating new route [ 776.058211][T16369] netlink: 'syz.3.2778': attribute type 10 has an invalid length. [ 776.103939][T16369] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2778'. [ 776.143121][T16369] batman_adv: batadv0: Adding interface: virt_wifi0 [ 776.150373][T16369] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 776.198356][T16369] batman_adv: batadv0: Interface activated: virt_wifi0 [ 776.337858][T16374] netlink: 202920 bytes leftover after parsing attributes in process `syz.1.2776'. [ 777.714661][T14328] Bluetooth: hci4: ACL packet for unknown connection handle 0 [ 777.856382][T16412] netlink: 'syz.2.2789': attribute type 8 has an invalid length. [ 778.107741][T16426] netlink: 'syz.0.2792': attribute type 3 has an invalid length. [ 778.429414][T16432] syzkaller0: entered promiscuous mode [ 778.818527][T16436] netlink: 208092 bytes leftover after parsing attributes in process `syz.2.2796'. [ 778.844851][T16436] netlink: 'syz.2.2796': attribute type 1 has an invalid length. [ 778.863131][T16436] netlink: 'syz.2.2796': attribute type 2 has an invalid length. [ 778.888459][T16436] netlink: 'syz.2.2796': attribute type 3 has an invalid length. [ 778.914325][T16436] netlink: 'syz.2.2796': attribute type 4 has an invalid length. [ 779.103369][T16442] netlink: 'syz.1.2798': attribute type 21 has an invalid length. [ 779.138553][T16442] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2798'. [ 779.500017][T16449] netlink: 199824 bytes leftover after parsing attributes in process `syz.2.2800'. [ 779.755394][T16449] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2800'. [ 780.545847][T16468] netlink: 'syz.1.2806': attribute type 29 has an invalid length. [ 780.864673][T16468] syzkaller0: entered promiscuous mode [ 780.919670][T16468] syzkaller0: entered allmulticast mode [ 781.193232][T16487] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.2811'. [ 784.675582][T16510] validate_nla: 3 callbacks suppressed [ 784.675599][T16510] netlink: 'syz.2.2817': attribute type 21 has an invalid length. [ 784.707334][T16510] netlink: 128 bytes leftover after parsing attributes in process `syz.2.2817'. [ 784.722706][T16510] netlink: 'syz.2.2817': attribute type 4 has an invalid length. [ 784.732915][T16510] netlink: 'syz.2.2817': attribute type 3 has an invalid length. [ 784.744195][T16510] netlink: 3 bytes leftover after parsing attributes in process `syz.2.2817'. [ 785.261891][T16537] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.2827'. [ 785.451002][T16539] netlink: 64859 bytes leftover after parsing attributes in process `syz.3.2827'. [ 785.995310][T16547] syzkaller0: entered promiscuous mode [ 786.012104][T16547] syzkaller0: entered allmulticast mode [ 786.124461][T16553] netlink: 15999 bytes leftover after parsing attributes in process `syz.0.2831'. [ 786.369401][T16563] netlink: 'syz.2.2834': attribute type 1 has an invalid length. [ 786.413024][T16563] netlink: 154788 bytes leftover after parsing attributes in process `syz.2.2834'. [ 791.907861][T16562] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2835'. [ 791.957500][T16571] netlink: 'syz.3.2836': attribute type 10 has an invalid length. [ 791.985302][T16571] team0: Device ipvlan1 failed to register rx_handler [ 792.232831][T16591] netlink: 'syz.3.2841': attribute type 26 has an invalid length. [ 792.243466][T16591] netlink: 62827 bytes leftover after parsing attributes in process `syz.3.2841'. [ 792.391675][ T993] ..ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 792.530416][T16601] netlink: 'syz.0.2844': attribute type 27 has an invalid length. [ 792.564307][T16601] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2844'. [ 792.639309][T16605] netlink: 'syz.3.2845': attribute type 10 has an invalid length. [ 792.856136][T16605] team0: Port device geneve1 added [ 792.874985][T16616] netlink: 'syz.1.2849': attribute type 21 has an invalid length. [ 792.883360][T16616] netlink: 'syz.1.2849': attribute type 30 has an invalid length. [ 792.976745][T16614] syzkaller0: entered promiscuous mode [ 792.983879][T16614] syzkaller0: entered allmulticast mode [ 793.014500][T16621] netlink: 763 bytes leftover after parsing attributes in process `syz.1.2849'. [ 793.254607][T16623] netlink: 144316 bytes leftover after parsing attributes in process `syz.1.2850'. [ 795.471041][T14328] Bluetooth: hci0: command 0x0406 tx timeout [ 796.086708][T16625] netlink: 'syz.0.2851': attribute type 21 has an invalid length. [ 796.095968][T16625] netlink: 'syz.0.2851': attribute type 6 has an invalid length. [ 796.104793][T16625] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2851'. [ 796.522640][T16651] delete_channel: no stack [ 796.699082][T16663] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.2861'. [ 796.874154][T16665] netlink: 16410 bytes leftover after parsing attributes in process `syz.2.2863'. [ 797.093681][T16679] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 797.101644][T16679] IPv6: NLM_F_CREATE should be set when creating new route [ 797.109516][T16679] IPv6: NLM_F_CREATE should be set when creating new route [ 797.116988][T16679] IPv6: NLM_F_CREATE should be set when creating new route [ 798.106022][T16690] can: request_module (can-proto-0) failed. [ 798.924758][T16710] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.2874'. [ 802.607096][T16755] netlink: 'syz.3.2887': attribute type 2 has an invalid length. [ 802.625823][T16755] netlink: 'syz.3.2887': attribute type 1 has an invalid length. [ 802.648008][T16755] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2887'. [ 808.755523][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.762141][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 810.706350][T16889] netlink: 'syz.1.2923': attribute type 9 has an invalid length. [ 810.725388][T16889] netlink: 399 bytes leftover after parsing attributes in process `syz.1.2923'. [ 813.067554][T16911] netlink: 'syz.2.2930': attribute type 10 has an invalid length. [ 813.606446][T16911] bridge0: port 2(bridge_slave_1) entered disabled state [ 813.620401][T16911] bridge0: port 1(bridge_slave_0) entered disabled state [ 813.770377][T16911] bridge0: port 2(bridge_slave_1) entered blocking state [ 813.777673][T16911] bridge0: port 2(bridge_slave_1) entered forwarding state [ 813.785442][T16911] bridge0: port 1(bridge_slave_0) entered blocking state [ 813.792745][T16911] bridge0: port 1(bridge_slave_0) entered forwarding state [ 813.810798][T16911] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 814.450389][T16931] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2935'. [ 814.560780][T16939] netlink: 14 bytes leftover after parsing attributes in process `syz.0.2938'. [ 814.570923][T16939] netlink: get zone limit has 4 unknown bytes [ 815.415224][T16963] syzkaller0: entered promiscuous mode [ 815.420791][T16963] syzkaller0: entered allmulticast mode [ 817.176042][T16984] netlink: 'syz.2.2950': attribute type 2 has an invalid length. [ 817.184245][T16984] netlink: 17267 bytes leftover after parsing attributes in process `syz.2.2950'. [ 818.468815][T16997] netlink: 'syz.0.2953': attribute type 12 has an invalid length. [ 818.495658][T16997] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2953'. [ 818.698923][T16997] netlink: 'syz.0.2953': attribute type 15 has an invalid length. [ 818.738515][T16997] netlink: 'syz.0.2953': attribute type 7 has an invalid length. [ 819.344092][T17024] netlink: 'syz.3.2959': attribute type 9 has an invalid length. [ 819.375923][T17024] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.2959'. [ 819.498750][T17022] netlink: 'syz.3.2959': attribute type 10 has an invalid length. [ 820.869204][T17025] netlink: 'syz.3.2959': attribute type 9 has an invalid length. [ 820.877031][T17025] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.2959'. [ 821.079989][T14328] Bluetooth: hci3: command 0x0406 tx timeout [ 821.164720][T17053] syzkaller0: entered promiscuous mode [ 821.170604][T17053] syzkaller0: entered allmulticast mode [ 821.519455][T17065] netlink: 196 bytes leftover after parsing attributes in process `syz.2.2969'. [ 821.626562][T17067] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 821.711174][T17064] netlink: 'syz.2.2969': attribute type 29 has an invalid length. [ 821.803211][T17064] netlink: 'syz.2.2969': attribute type 29 has an invalid length. [ 823.419074][T16804] ..ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 826.533038][T17065] netlink: 'syz.2.2969': attribute type 29 has an invalid length. [ 826.544132][T17083] netlink: 14 bytes leftover after parsing attributes in process `syz.3.2973'. [ 826.813382][T17097] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2977'. [ 827.995748][T17121] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2982'. [ 828.329244][T17135] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2987'. [ 828.498025][T17142] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2989'. [ 829.094457][T17137] netlink: 'syz.3.2986': attribute type 3 has an invalid length. [ 829.195921][T17137] netlink: 'syz.3.2986': attribute type 1 has an invalid length. [ 829.305173][T17137] netlink: 130160 bytes leftover after parsing attributes in process `syz.3.2986'. [ 830.937257][T17169] netlink: 'syz.2.2996': attribute type 6 has an invalid length. [ 832.230361][T17182] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3000'. [ 833.277122][T17193] syzkaller0: entered promiscuous mode [ 833.284156][T17193] syzkaller0: entered allmulticast mode [ 835.673652][T17210] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3009'. [ 836.231186][T17244] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.3014'. [ 836.496519][T14328] Bluetooth: hci1: command 0x0406 tx timeout [ 837.225691][T17260] syzkaller0: entered promiscuous mode [ 837.232113][T17260] syzkaller0: entered allmulticast mode [ 837.531538][T17276] netlink: 'syz.1.3029': attribute type 29 has an invalid length. [ 837.542236][T17276] netlink: 'syz.1.3029': attribute type 3 has an invalid length. [ 837.552095][T17276] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3029'. [ 838.465094][T17304] netlink: 9275 bytes leftover after parsing attributes in process `syz.3.3034'. [ 839.990174][T17300] netlink: 112 bytes leftover after parsing attributes in process `syz.3.3034'. [ 840.192486][T17313] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3037'. [ 840.275996][T17313] netlink: 'syz.1.3037': attribute type 21 has an invalid length. [ 840.309062][T17313] netlink: 168 bytes leftover after parsing attributes in process `syz.1.3037'. [ 840.336474][T17313] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3037'. [ 840.507819][T17323] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3042'. [ 841.335667][T17357] netlink: set zone limit has 8 unknown bytes [ 841.388342][ T5812] page_pool_release_retry() stalled pool shutdown 1 inflight 60 sec [ 842.444301][T17383] syzkaller0: entered promiscuous mode [ 842.480174][T17383] syzkaller0: entered allmulticast mode [ 844.146598][T17412] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3067'. [ 845.517129][T17392] netlink: 180 bytes leftover after parsing attributes in process `syz.1.3062'. [ 845.542991][T17412] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3067'. [ 846.776472][T17441] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3077'. [ 846.788286][T17441] bond0: (slave bond_slave_0): Releasing backup interface [ 846.813728][T17441] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 848.702033][T17500] IPv6: Can't replace route, no match found [ 848.944840][T17508] netlink: 'syz.2.3096': attribute type 21 has an invalid length. [ 849.977830][T17518] netlink: 'syz.0.3099': attribute type 19 has an invalid length. [ 850.021063][T17518] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3099'. [ 851.328973][T17531] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.3103'. [ 854.446115][T13473] ..ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 855.090152][T17558] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.3109'. [ 856.222658][T17568] pim6reg1: entered promiscuous mode [ 856.238124][T17568] pim6reg1: entered allmulticast mode [ 857.046653][T17582] netlink: 'syz.3.3117': attribute type 5 has an invalid length. [ 857.063520][T17582] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3117'. [ 857.894202][T17592] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.3120'. [ 858.152964][T17595] netlink: 52711 bytes leftover after parsing attributes in process `syz.3.3122'. [ 858.408353][T17600] netlink: 'syz.1.3123': attribute type 2 has an invalid length. [ 858.440450][T17600] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.3123'. [ 858.539105][T17596] tun0: tun_chr_ioctl cmd 1074025675 [ 858.619937][T17596] tun0: persist enabled [ 858.705142][T17602] tun0: tun_chr_ioctl cmd 1074025675 [ 858.778440][T17602] tun0: persist disabled [ 858.939684][T17602] netlink: 'syz.0.3121': attribute type 6 has an invalid length. [ 859.324080][T17610] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3126'. [ 860.750194][T17634] pim6reg1: entered promiscuous mode [ 860.779678][T17634] pim6reg1: entered allmulticast mode [ 863.685058][T17648] netlink: 105120 bytes leftover after parsing attributes in process `syz.1.3138'. [ 863.720642][T17648] netlink: 'syz.1.3138': attribute type 2 has an invalid length. [ 864.441877][T17676] netlink: 'syz.0.3148': attribute type 21 has an invalid length. [ 864.488595][T17676] netlink: 'syz.0.3148': attribute type 4 has an invalid length. [ 864.557427][T17676] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3148'. [ 864.703757][T17678] netlink: 'syz.3.3150': attribute type 10 has an invalid length. [ 865.040691][T17678] team0: Port device wlan1 added [ 865.059726][T17677] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 865.335685][T17715] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.3160'. [ 865.999997][T17739] netlink: 6 bytes leftover after parsing attributes in process `syz.0.3168'. [ 866.023977][T17739] openvswitch: netlink: Flow actions attr not present in new flow. [ 866.269393][T17741] netlink: 'syz.2.3169': attribute type 2 has an invalid length. [ 866.278200][T17741] netlink: 'syz.2.3169': attribute type 8 has an invalid length. [ 866.286955][T17741] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3169'. [ 867.318864][T17775] netlink: 'syz.0.3179': attribute type 21 has an invalid length. [ 867.495309][T17781] tc_dump_action: action bad kind [ 869.228486][T17815] netlink: 10 bytes leftover after parsing attributes in process `syz.1.3191'. [ 869.506014][T17826] netlink: 'syz.3.3195': attribute type 10 has an invalid length. [ 869.514623][T17826] hsr_slave_0: left promiscuous mode [ 869.692271][T17826] hsr_slave_1: left promiscuous mode [ 869.775422][T17827] netlink: 'syz.0.3192': attribute type 21 has an invalid length. [ 869.784098][T17827] netlink: 176 bytes leftover after parsing attributes in process `syz.0.3192'. [ 870.197433][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 870.203992][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 870.247090][T17854] netlink: 'syz.3.3201': attribute type 17 has an invalid length. [ 870.267249][T17854] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3201'. [ 870.300642][T17854] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 872.164097][T17888] netlink: 168 bytes leftover after parsing attributes in process `syz.3.3212'. [ 872.354447][T17896] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3212'. [ 873.325799][T17933] syzkaller0: entered promiscuous mode [ 873.331789][T17933] syzkaller0: entered allmulticast mode [ 874.166257][T17952] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3230'. [ 875.892501][T17952] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3230'. [ 876.051643][T17965] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3234'. [ 876.066565][T17967] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3235'. [ 876.077532][T17967] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3235'. [ 876.095211][T17965] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3234'. [ 876.158909][T17965] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3234'. [ 876.184614][T17969] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3236'. [ 876.201217][T17969] netlink: 192436 bytes leftover after parsing attributes in process `syz.1.3236'. [ 876.213192][T17969] openvswitch: netlink: Duplicate key (type 0). [ 876.731035][ C1] [ 876.731045][ C1] ================================ [ 876.731051][ C1] WARNING: inconsistent lock state [ 876.731069][ C1] syzkaller #0 Not tainted [ 876.731079][ C1] -------------------------------- [ 876.731084][ C1] inconsistent {INITIAL USE} -> {IN-NMI} usage. [ 876.731092][ C1] syz.1.3242/17991 [HC1[1]:SC0[0]:HE0:SE1] takes: [ 876.731113][ C1] ffff88806b4468f8 (&htab->lockdep_key){....}-{2:2}, at: htab_lock_bucket+0x17d/0x300 [ 876.731169][ C1] {INITIAL USE} state was registered at: [ 876.731180][ C1] lock_acquire+0x19e/0x420 [ 876.731201][ C1] _raw_spin_lock+0x2e/0x40 [ 876.731222][ C1] htab_lock_bucket+0x17d/0x300 [ 876.731241][ C1] htab_map_delete_elem+0x1a4/0x650 [ 876.731258][ C1] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 876.731278][ C1] bpf_overflow_handler+0x1fc/0x510 [ 876.731313][ C1] __perf_event_overflow+0x447/0x630 [ 876.731331][ C1] perf_swevent_overflow+0x268/0x340 [ 876.731372][ C1] perf_swevent_event+0x45c/0x570 [ 876.731390][ C1] perf_bp_event+0x319/0x430 [ 876.731408][ C1] hw_breakpoint_exceptions_notify+0x23e/0x670 [ 876.731430][ C1] notifier_call_chain+0x197/0x380 [ 876.731451][ C1] atomic_notifier_call_chain+0xda/0x180 [ 876.731476][ C1] notify_die+0x145/0x1a0 [ 876.731496][ C1] notify_debug+0x2e/0x50 [ 876.731521][ C1] noist_exc_debug+0x77/0x120 [ 876.731536][ C1] asm_exc_debug+0x33/0x40 [ 876.731573][ C1] irq event stamp: 2960 [ 876.731579][ C1] hardirqs last enabled at (2959): [] exc_debug+0xf5/0x140 [ 876.731601][ C1] hardirqs last disabled at (2960): [] exc_debug+0x73/0x140 [ 876.731623][ C1] softirqs last enabled at (2648): [] fpu_clone+0x284/0xbf0 [ 876.731652][ C1] softirqs last disabled at (2646): [] fpu_clone+0x284/0xbf0 [ 876.731681][ C1] [ 876.731681][ C1] other info that might help us debug this: [ 876.731687][ C1] Possible unsafe locking scenario: [ 876.731687][ C1] [ 876.731692][ C1] CPU0 [ 876.731695][ C1] ---- [ 876.731698][ C1] lock(&htab->lockdep_key); [ 876.731710][ C1] [ 876.731713][ C1] lock(&htab->lockdep_key); [ 876.731724][ C1] [ 876.731724][ C1] *** DEADLOCK *** [ 876.731724][ C1] [ 876.731728][ C1] no locks held by syz.1.3242/17991. [ 876.731736][ C1] [ 876.731736][ C1] stack backtrace: [ 876.731742][ C1] CPU: 1 PID: 17991 Comm: syz.1.3242 Not tainted syzkaller #0 [ 876.731760][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 876.731771][ C1] Call Trace: [ 876.731778][ C1] <#DB> [ 876.731786][ C1] dump_stack_lvl+0x18c/0x250 [ 876.731824][ C1] ? show_regs_print_info+0x20/0x20 [ 876.731868][ C1] ? print_usage_bug+0x475/0x690 [ 876.731891][ C1] ? verify_lock_unused+0x18/0x140 [ 876.731922][ C1] lock_acquire+0x2c2/0x420 [ 876.731945][ C1] ? __lock_acquire+0x7d40/0x7d40 [ 876.731972][ C1] ? htab_lock_bucket+0x17d/0x300 [ 876.731998][ C1] ? read_lock_is_recursive+0x20/0x20 [ 876.732031][ C1] ? internal_get_user_pages_fast+0x214e/0x2760 [ 876.732066][ C1] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 876.732107][ C1] _raw_spin_lock+0x2e/0x40 [ 876.732128][ C1] ? htab_lock_bucket+0x17d/0x300 [ 876.732150][ C1] htab_lock_bucket+0x17d/0x300 [ 876.732178][ C1] ? htab_lru_map_delete_node+0x760/0x760 [ 876.732200][ C1] ? look_up_lock_class+0x75/0x140 [ 876.732229][ C1] ? verify_lock_unused+0x18/0x140 [ 876.732256][ C1] ? jhash+0x2e8/0x740 [ 876.732282][ C1] htab_map_delete_elem+0x1a4/0x650 [ 876.732315][ C1] ? htab_map_update_elem+0x1040/0x1040 [ 876.732337][ C1] ? perf_callchain+0x220/0x220 [ 876.732355][ C1] ? rcu_is_watching+0x15/0xb0 [ 876.732380][ C1] ? bpf_overflow_handler+0xde/0x510 [ 876.732408][ C1] ? lock_release+0xb5/0x8c0 [ 876.732438][ C1] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 876.732462][ C1] bpf_overflow_handler+0x1fc/0x510 [ 876.732491][ C1] ? perf_tp_event+0x1520/0x1520 [ 876.732515][ C1] ? perf_trace_buf_alloc+0x290/0x290 [ 876.732537][ C1] ? bpf_overflow_handler+0xde/0x510 [ 876.732565][ C1] ? tp_perf_event_destroy+0x20/0x20 [ 876.732626][ C1] ? __perf_event_account_interrupt+0x187/0x280 [ 876.732656][ C1] __perf_event_overflow+0x447/0x630 [ 876.732695][ C1] perf_swevent_overflow+0x268/0x340 [ 876.732731][ C1] ? perf_event_switch_output+0x790/0x790 [ 876.732780][ C1] perf_swevent_event+0x45c/0x570 [ 876.732811][ C1] ? perf_tp_event+0x1520/0x1520 [ 876.732832][ C1] ? trace_call_bpf+0x5e9/0x6c0 [ 876.732863][ C1] ? trace_call_bpf+0xc3/0x6c0 [ 876.732912][ C1] perf_bp_event+0x319/0x430 [ 876.732948][ C1] ? perf_event_free_bpf_prog+0x120/0x120 [ 876.733031][ C1] ? lock_acquire+0x2c2/0x420 [ 876.733078][ C1] hw_breakpoint_exceptions_notify+0x23e/0x670 [ 876.733115][ C1] notifier_call_chain+0x197/0x380 [ 876.733147][ C1] ? atomic_notifier_call_chain+0x26/0x180 [ 876.733178][ C1] atomic_notifier_call_chain+0xda/0x180 [ 876.733210][ C1] notify_die+0x145/0x1a0 [ 876.733241][ C1] ? srcu_init_notifier_head+0x90/0x90 [ 876.733284][ C1] ? rcu_is_watching+0x15/0xb0 [ 876.733317][ C1] notify_debug+0x2e/0x50 [ 876.733337][ C1] exc_debug+0xde/0x140 [ 876.733364][ C1] asm_exc_debug+0x1e/0x40 [ 876.733387][ C1] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 876.733409][ C1] Code: 75 f1 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 c3 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 29 f8 48 01 [ 876.733427][ C1] RSP: 0018:ffffc9000dcffd50 EFLAGS: 00050202 [ 876.733448][ C1] RAX: ffffffff842a2001 RBX: 0000000000000048 RCX: 0000000000000004 [ 876.733462][ C1] RDX: 0000000000000001 RSI: 0000200000000304 RDI: ffffc9000dcffe04 [ 876.733475][ C1] RBP: ffffc9000dcffee8 R08: ffffc9000dcffe07 R09: 1ffff92001b9ffc0 [ 876.733490][ C1] R10: dffffc0000000000 R11: fffff52001b9ffc1 R12: 0000200000000308 [ 876.733504][ C1] R13: 0000000000000048 R14: ffffc9000dcffdc0 R15: 00002000000002c0 [ 876.733532][ C1] ? rcuref_put_slowpath+0xe1/0x150 [ 876.733572][ C1] [ 876.733578][ C1] [ 876.733583][ C1] _copy_from_user+0x8b/0xe0 [ 876.733614][ C1] __sys_bpf+0x23e/0x890 [ 876.733642][ C1] ? bpf_link_show_fdinfo+0x390/0x390 [ 876.733694][ C1] ? lock_chain_count+0x20/0x20 [ 876.733735][ C1] __x64_sys_bpf+0x7c/0x90 [ 876.733759][ C1] do_syscall_64+0x55/0xa0 [ 876.733775][ C1] ? clear_bhb_loop+0x40/0x90 [ 876.733800][ C1] ? clear_bhb_loop+0x40/0x90 [ 876.733829][ C1] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 876.733853][ C1] RIP: 0033:0x7f95a359c819 [ 876.733870][ C1] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 876.733886][ C1] RSP: 002b:00007f95a4384028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 876.733905][ C1] RAX: ffffffffffffffda RBX: 00007f95a3815fa0 RCX: 00007f95a359c819 [ 876.733920][ C1] RDX: 0000000000000048 RSI: 00002000000002c0 RDI: 0000000000000000 [ 876.733932][ C1] RBP: 00007f95a3632c91 R08: 0000000000000000 R09: 0000000000000000 [ 876.733944][ C1] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 876.733955][ C1] R13: 00007f95a3816038 R14: 00007f95a3815fa0 R15: 00007ffc8a244288 [ 876.733998][ C1] [ 885.471584][T10803] ..ãc¤±: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)