last executing test programs: 2.847836059s ago: executing program 3 (id=10493): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) ioctl$TUNSETVNETLE(0xffffffffffffffff, 0x400454dc, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={0xffffffffffffffff, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000600142603600e1208000f0000000401a80016002000034004000200035c0461c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a1a83", 0xd4}, {&(0x7f00000014c0)="5c9ebe30", 0x4}], 0x2}, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000001000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a34b8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b7543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8f23e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae0000c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910ab193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b884057aeb68f3d675a79907a72ace70902459f6950a06a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68fe6b7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f8ce659e340c714809ec4d060bb1c9cfcde57b79625e2979fe689a5a246cbbd488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546308a0004be94dfab28c2a51dc816df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d044fa492aa38717481455e86dcd7816ad8940bd192595369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d4f17a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9570d730a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b94952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d830e1431ed6d646d13e8e7230300ef0a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000000000000000000002000000000044ff72f96f084f4b6cdcb1b4a9d8e9f9021b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded5027a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b092b70f77f0f428d2000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634009aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3f19f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f9863800f127d6b4518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c104fe52837a19006952fe2724c0105ab158a54a6a73000000000000000000000000b0d135da438cbe303f3ae070def97d6649b5a693ff5c788e5a406e1d06942ed51bff073011f6e6c29d3ea22e5fc26c7fbe37656229a6a12857ae9ed131ccdd513066bc9422ec38a1dc5212986d9bc330a23eb3b200af1a3678c2bfbe4b4ba6e8471495f6e82c5ee425973c590253e875352a3acaee044868f9b80f8fdc9d402007bb4c8df1b69d3d2b364ec9e4ed2f554118684eff1adf5b49b6b29232198e682dfa45dced8b332c404c8f292f36730845dc37dfe7a59e252ddc33ea9072dcd697a700cfac90b487660795f564ddb61fa3e4835f936984200000000000000000008e9f7bc3a00cd72ced7684e264e45398f7087734fcf2023a7a4c880f562f46f14cdc1bf472d74bc0c777b1021ff75de086c08f72a41399d3a3065b2f50a531cc90edbf88370ff50ba1aa6cc59076165a3ab90a3c90527b7c9711cf85bbb0cb0aebc47ab5c65458c40020f2cfb10e5f0a1594ae491e8756446e6873a8b222ae7e58dd7640666e359fc583e17ed6bcb30c0fafbba761e756ca80286d38bb92dd9ba17c1bb628e5b8d52c9a02a67f788ab88dca817cb4886942a279e06f45c8c936f5c46e1a008097471ca0ee26bcfabf7adb9c90a10539d960dec5c84464f6bc68318e7e899acf20ea41b071132d7a5945e941334855ce6149deaae1b5b83045e83bfc208079e6e58ebb4176b126c743111c5a712f465a3007d665ac21c43a544947c9d13e5206a21025f6acd47c2d333e648dcbf2e4989a1d4a176fe8f7a8cf0aeaf9736118b036639cb35810ea88213ff2a0842d420d418d026a101222a4ebd18fc89f04b5a9056ca6c00308936679474fa83bdf6eac126c9be33c551bccd42d8000736ed9a64ff7cb87d44c9bcf821c96dcd34aadfcc42fabd5976cedc9a4eef24764168056d0645c7aa007d69df4fa8de1224a56f0799ad59ee5c84418a1faae590b6c896cdd808376b6b51b217fcad5fbd7e3208d009e37484378df3ee5969f817d715d60fdd02c04e3fdd62a29285ac92f6836cbeb4d04d84c396150b2e17828d924013978173c48635e0b1ad4a0c5956717629794b39cf18d599e723d3c24689a5fea6cc1f59d1ba1fccfba88e02f9907"], &(0x7f0000000140)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r2, 0x18000000000002a0, 0x7ee, 0x0, &(0x7f0000000e80)="b9e403c6631e39495aa05dc7cf1c", 0x0, 0x7ab, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x890b, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x9, 0x2, 0x56d, 0x3, 0x2, 0xffffffffffffffff, 0x4}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600), &(0x7f0000001f80), 0xfffffffb, r3}, 0x38) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000200), &(0x7f00000003c0), 0x1000, r3}, 0x38) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x1, 0x0, 0xd66}, 0x0) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0x2, &(0x7f00000000c0), 0x31}, 0x0) sendmsg$inet(r4, &(0x7f0000001540)={0x0, 0x0, 0x0}, 0x40040) socket$kcm(0x10, 0x2, 0x10) r6 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)='\x00', 0x1}], 0x1}, 0x4000001) sendmsg$inet(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x4000) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008800000b704000011000000850000008200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r7, 0x18000000000002a0, 0x4f, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.642041219s ago: executing program 3 (id=10515): bpf$MAP_CREATE(0x0, &(0x7f0000000980)=@base={0x1, 0x4, 0x4, 0x7, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1}, 0x50) 1.403660481s ago: executing program 3 (id=10522): socket$kcm(0xa, 0x5, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{}]}]}}, &(0x7f0000000140)=""/237, 0x5a, 0xed, 0x1}, 0x20) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$kcm(0x21, 0x2, 0x2) r2 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}, 0x0, 0x0, r2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x5, [@float={0x3, 0x0, 0x0, 0x10, 0x8}, @decl_tag={0x3, 0x0, 0x0, 0x11, 0x3}, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x4, [{0x0, 0x2}]}]}, {0x0, [0x61, 0x61, 0x2e]}}, 0x0, 0x51}, 0x28) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB], &(0x7f0000000c00)='GPL\x00'}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8a10ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000000c0)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a0010000000028000031294", 0x2e}], 0x1}, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@bloom_filter={0x1e, 0x0, 0xca, 0x3, 0x0, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x18, 0xf, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="00000000000000002702000014005800b7030000000000008500000059000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b70000000000000095"], &(0x7f0000000c80)='syzkaller\x00'}, 0x94) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) socket$kcm(0x10, 0x2, 0x0) r7 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r7}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x6, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b702000000070000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000be000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c460880000000080000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000c80)={r8, 0x2000012, 0x0, 0x0, 0x0, 0x0, 0x7ffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.308039066s ago: executing program 4 (id=10525): r0 = socket$kcm(0x21, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000440)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @loopback}}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)="a6", 0xfffffcf4}, {0x0}], 0x2, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb718aef932f3889d1fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x106) recvmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x100) 1.051987069s ago: executing program 1 (id=10529): bpf$BPF_PROG_DETACH(0x8, &(0x7f00000003c0)=ANY=[@ANYRES32, @ANYRES64], 0x20) 1.051696548s ago: executing program 4 (id=10530): perf_event_open(&(0x7f0000001480)={0x2, 0x80, 0x85, 0x1, 0x0, 0x0, 0x0, 0x2, 0x20022, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x20000000}, 0x0, 0x0, 0x0, 0x9, 0x0, 0xd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0xda, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 1.015802s ago: executing program 3 (id=10532): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="97eb01001800000000000000500000005000000002000000090000000000000e03000000010000000a0000000000000203000000000000000500000d0000fa8c99dc0000010000000000000000000000000000000000000009000000000000000100000003"], 0x0, 0x6a, 0x0, 0x0, 0x7fffffff}, 0x28) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r0, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) 920.005325ms ago: executing program 1 (id=10533): r0 = socket$kcm(0x2b, 0x1, 0x0) close(r0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000300)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d004892e822a6abc02ad2602a5ad6f7007ea60864160af365935cfaea3f49d8df1931a0e64ffc4c78029ee517d34460bc06000000938037e70e457ae2bb24ef6697070000000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x40) recvmsg(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x40000022) recvmsg(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000780)=""/221, 0xdd}, {&(0x7f00000063c0)=""/4062, 0xfde}, {&(0x7f0000000880)=""/136, 0x88}, {&(0x7f0000001a40)=""/4124, 0x101c}, {&(0x7f0000000680)=""/233, 0xe9}, {&(0x7f0000000940)=""/181, 0xb5}, {&(0x7f0000000280)=""/47, 0x2f}, {&(0x7f0000000040)=""/49, 0x31}], 0x8}, 0x10022) recvmsg$kcm(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x10182) 919.725065ms ago: executing program 2 (id=10534): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0x13, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000080)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 870.711957ms ago: executing program 4 (id=10536): perf_event_open(&(0x7f0000001180)={0xa, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x840, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb4, 0x4, @perf_config_ext={0x80, 0xffffffbfffffffff}, 0x10000, 0x2, 0x5, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000d}, 0x0, 0x1, 0xffffffffffffffff, 0x0) 801.315291ms ago: executing program 3 (id=10537): sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000000c0)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef59510525ba56dcd79a36c23d3b9844e1571a86ea1698fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480e1211000000e3bd012a128748b429021627e305dd2b7a146efb4400", 0x2e}], 0x1}, 0x40004) 761.892402ms ago: executing program 0 (id=10538): socketpair(0x3a, 0x6, 0x1, &(0x7f0000000340)) 752.939943ms ago: executing program 2 (id=10539): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) 720.952525ms ago: executing program 4 (id=10540): perf_event_open(&(0x7f0000000900)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x2420, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, @perf_bp={0x0}, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4}, [@call={0x85, 0x0, 0x0, 0x36}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x17}}]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xe, 0x0, &(0x7f00000001c0)="0101000871a7832e6b7303c3cd59", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3}, 0x50) 599.990541ms ago: executing program 1 (id=10541): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x5, 0x5, &(0x7f0000000700)=ANY=[@ANYBLOB="180000004830000000000000fa40000007010000080020207500feff000082009500"], &(0x7f0000000000)='GPL\x00', 0x4, 0xfa, &(0x7f0000000480)=""/250}, 0x94) 599.787841ms ago: executing program 2 (id=10542): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x14, 0x14, 0xb, [@enum={0x0, 0x1, 0x0, 0x6, 0x4, [{0x9}]}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51]}}, &(0x7f0000000080)=""/159, 0x37, 0x9f, 0x1}, 0x28) 587.925451ms ago: executing program 0 (id=10543): r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0x5, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x541b, 0xfffffffffffffffb) 521.682304ms ago: executing program 4 (id=10544): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x10, &(0x7f00000008c0)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000006000000850000001c00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 472.051137ms ago: executing program 2 (id=10545): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0xf, 0xa, &(0x7f00000002c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x6279, 0x0, 0x0, 0x0, 0x80}, [@func={0x85, 0x0, 0x1, 0x0, 0x1}, @exit, @tail_call]}, &(0x7f0000000340)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0xa}, 0x94) 471.822387ms ago: executing program 1 (id=10546): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x305) 442.138259ms ago: executing program 3 (id=10547): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000080)="48000000150081fb7059ae08060c04000aff0f11000000040011018701546fabca1b4e7d06a6bd7c493872f750375ed08a562af5745e17b8c119418f0f000000d6", 0x41}], 0x1}, 0x4040804) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f00000000c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 396.41285ms ago: executing program 4 (id=10548): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x4, @perf_config_ext={0xfffffffffffffffe, 0xfffffffffefffffe}, 0x0, 0x20, 0xc2ba, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = socket$kcm(0x11, 0x200000000000002, 0x300) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getpid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, 0x0, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0xc, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20000002}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xa8}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x39}, 0x94) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{}, {0x90010022}]}, 0x90) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0x12, &(0x7f00000008c0)=r6, 0x4) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b70600007fffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfc8e012e79578e51bc5f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b803000000661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b32a0080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e14861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16b089f37b3591a15c0a9be6eb18208404c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979e29857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37ceff9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b90dfae158b94f0800000000000000af5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed210d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734f87da3770845cf442d488afdc0e170000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd52364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bbf8ab9c691841ab0931d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fca4d97a0ae75ccf11e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35e9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff17320adda5867947257f080091c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efde0142cf90ff668b9757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b7202c2bbae137dc1c3cf40db74a4c1c2f56855b18f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e150695ffae3a676555b10da11751865126d19336116a1e58ab727dda6b343cc97f9479136a66f552abf8fe3d134f6d69df1cffe6740f90735f66ca54fd87800b4bda4db5e68aaccf44d24e09f8a769e3ae7bf246673f15e3d1adae4384bdb7cd30a33e30466b421feb96006c810fd3830a1c75af2580727ffc604d2b04f476acc21419fad9b1baec88974da2db29b80859bde08b85c8086e4b7f1fd568042ad5396d3179c71b1dc43291e450ce9b8d7d80fcb44966d7ad4691a37870000000000000000000000000000000000000000000000000000000000000000000083a5765d06da91165d24bc316607e2d69344aa1c07ff7cd7bc3d17f122478b6e81077782b9c298edc2546045feff90e7aa7da88d2489fb000a4aa838f911c1a869fa55e979e033b7707df75b93cf5b8d25242741a88f2d54a7107375b25911aa11efa3a4f87fc14f180e353615b3cb9a5cf5ea843014a277c3694a5a83266f73ef039dd739187923715548d58ff43be997e357e0cbed29faef19c0082e26fb867bf0ff0099d71bb0d2f443e77a44e8c4b0455d95b19c73ef4c98f775aad9e1b317b3cc48f7ad1d82ea6ad6c3c7d943fb0157c250e2ba56301e25c19a7e37ce880bed8a8e1538560f2be7d4cca6539277505826bd61bad2bcd4914344d4a27b29d2eb89bdc7a702e485d68c04e8f6b05336bf8d8e116605eaf375a592fe2382763c3cba76a0e4029dad5d37dd77abb1b7d2e2de23a4131e45ed81123ad6fa4f8b92c47e00000000000000774c"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r7, 0x18000000000002a0, 0xe80, 0x6000002c, &(0x7f0000000100)="b9ff03316844268cb89e14f008004ce0001300002000008877fbac141416e000030a89079f03b180ff83080520e0845013f2325f004408050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014c0000c0adc043084617d7ecf41effff38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d7da058f6efa6d1f5f7ff400"/254, 0x0, 0xfe, 0x60000000, 0x0, 0xfffffffe}, 0x2c) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008188040f46ecdb4cb9cca7480e1212000000e3bd012a128748b429021627e305dd2b7a146efb4400", 0x2e}], 0x1}, 0x4048004) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000140)={r0}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000100), 0x4) r9 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r9, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90124fc60100c03400a000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 395.72022ms ago: executing program 0 (id=10558): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 292.002486ms ago: executing program 2 (id=10549): r0 = socket$kcm(0x23, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000000)=@phonet, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000200)="3fe7", 0x2}], 0x1, 0x0, 0x0, 0xeaff}, 0x0) 277.884866ms ago: executing program 0 (id=10550): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0xd, 0xb, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000006400ffffffffffffffff0000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f6feffffa702000008000000b703000084200000850000007200000095b2"], &(0x7f0000000300)='GPL\x00', 0x1, 0x5, &(0x7f0000000340)=""/5}, 0x94) 231.632539ms ago: executing program 1 (id=10551): perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x800c0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x2}, 0x0, 0x9, 0x0, 0x3, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 164.092522ms ago: executing program 0 (id=10552): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="190000000400000004", @ANYRES32, @ANYRES32], 0x50) 148.491973ms ago: executing program 2 (id=10553): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r0, &(0x7f0000000780)}, 0x20) 65.140117ms ago: executing program 1 (id=10554): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@call={0x85, 0x0, 0x0, 0x29}]}, &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) 0s ago: executing program 0 (id=10555): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) kernel console output (not intermixed with test programs): b_loop+0x60/0xb0 [ 1521.140937][ T3678] ? clear_bhb_loop+0x60/0xb0 [ 1521.145668][ T3678] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1521.151963][ T3678] RIP: 0033:0x7fe753f9c799 [ 1521.156439][ T3678] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1521.176108][ T3678] RSP: 002b:00007fe754eb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1521.184676][ T3678] RAX: ffffffffffffffda RBX: 00007fe754215fa0 RCX: 00007fe753f9c799 [ 1521.192722][ T3678] RDX: 0000000000000012 RSI: 00002000000000c0 RDI: 0000000000000004 [ 1521.200751][ T3678] RBP: 00007fe754eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1521.208782][ T3678] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1521.216804][ T3678] R13: 00007fe754216038 R14: 00007fe754215fa0 R15: 00007ffe830ebd28 [ 1521.224880][ T3678] [ 1522.236746][ T3700] netlink: 'syz.3.9250': attribute type 10 has an invalid length. [ 1522.418145][ T3707] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9260'. [ 1523.583095][ T3725] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.9258'. [ 1524.160730][ T3741] netlink: 'syz.2.9264': attribute type 10 has an invalid length. [ 1524.656480][ T3745] netlink: 'syz.3.9266': attribute type 2 has an invalid length. [ 1524.774437][ T3745] device 0 entered promiscuous mode [ 1524.815692][ T3750] netlink: 'syz.4.9267': attribute type 21 has an invalid length. [ 1524.846205][ T3750] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9267'. [ 1524.888504][ T3752] netlink: 'syz.2.9268': attribute type 21 has an invalid length. [ 1526.805260][ T3796] netlink: 'syz.0.9279': attribute type 10 has an invalid length. [ 1527.181251][ T3799] netlink: 'syz.3.9282': attribute type 21 has an invalid length. [ 1527.220119][ T3799] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9282'. [ 1527.246575][ T3800] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9281'. [ 1527.506042][ T3805] netlink: 'syz.1.9284': attribute type 2 has an invalid length. [ 1527.602663][ T3805] device 0 entered promiscuous mode [ 1527.953608][ T3818] netlink: 'syz.0.9288': attribute type 17 has an invalid length. [ 1528.194873][ C1] icmp: detected local route for 172.20.20.170 during ICMP sending, src 172.20.20.187 [ 1528.383477][ T3823] netlink: 152 bytes leftover after parsing attributes in process `syz.1.9292'. [ 1528.432294][ T3823] netlink: 'syz.1.9292': attribute type 25 has an invalid length. [ 1528.832968][ T3829] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9294'. [ 1529.314902][ C1] icmp: detected local route for 172.20.20.170 during ICMP sending, src 172.20.20.50 [ 1529.335824][T13866] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1529.349656][T13866] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1529.358922][T13866] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1529.377589][T13866] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1529.387024][T13866] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 1529.394381][T13866] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1529.492027][ T3839] netlink: 'syz.0.9296': attribute type 10 has an invalid length. [ 1529.562173][ T3847] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9298'. [ 1529.959806][ T3834] chnl_net:caif_netlink_parms(): no params data found [ 1530.032371][ T3855] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9302'. [ 1530.209850][ T3857] netlink: 'syz.1.9303': attribute type 21 has an invalid length. [ 1530.260195][ T3857] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9303'. [ 1530.464984][ T3834] bridge0: port 1(bridge_slave_0) entered blocking state [ 1530.472731][ T3834] bridge0: port 1(bridge_slave_0) entered disabled state [ 1530.508710][ T3834] device bridge_slave_0 entered promiscuous mode [ 1530.560693][ T3834] bridge0: port 2(bridge_slave_1) entered blocking state [ 1530.585898][ T3834] bridge0: port 2(bridge_slave_1) entered disabled state [ 1530.625393][ T3834] device bridge_slave_1 entered promiscuous mode [ 1530.813310][ T3834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1530.849646][ T3834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1530.984914][ T3834] team0: Port device team_slave_0 added [ 1531.003739][ T3834] team0: Port device team_slave_1 added [ 1531.101263][ T3872] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9307'. [ 1531.198505][ T3834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1531.209663][ T3874] netlink: 152 bytes leftover after parsing attributes in process `syz.0.9308'. [ 1531.249993][ T3834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1531.299643][ T3834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1531.340305][ T3874] netlink: 'syz.0.9308': attribute type 25 has an invalid length. [ 1531.376690][ T3834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1531.393957][ T3834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1531.454779][ T3834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1531.475401][T13866] Bluetooth: hci5: command 0x0409 tx timeout [ 1531.493147][ T3889] netlink: 'syz.4.9311': attribute type 10 has an invalid length. [ 1531.621998][ T3834] device hsr_slave_0 entered promiscuous mode [ 1531.629444][ T3834] device hsr_slave_1 entered promiscuous mode [ 1531.653794][ T3834] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1531.675091][ T3834] Cannot create hsr debugfs directory [ 1531.909988][T28714] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1532.033397][ T3902] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.9317'. [ 1532.074665][T28714] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1532.137275][ T3896] netlink: 'syz.4.9313': attribute type 1 has an invalid length. [ 1532.164936][ T3896] netlink: 105120 bytes leftover after parsing attributes in process `syz.4.9313'. [ 1532.219222][T28714] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1532.509637][T28714] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1532.632102][ T3925] netlink: 'syz.1.9323': attribute type 10 has an invalid length. [ 1532.747233][ T3928] netlink: 'syz.3.9324': attribute type 21 has an invalid length. [ 1532.758010][ T3928] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9324'. [ 1533.118229][ T3938] netlink: 'syz.1.9325': attribute type 4 has an invalid length. [ 1533.144265][ T3938] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.9325'. [ 1533.197674][ T3944] FAULT_INJECTION: forcing a failure. [ 1533.197674][ T3944] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1533.337654][ T3944] CPU: 1 PID: 3944 Comm: syz.4.9326 Not tainted syzkaller #0 [ 1533.345103][ T3944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1533.355183][ T3944] Call Trace: [ 1533.358486][ T3944] [ 1533.361438][ T3944] dump_stack_lvl+0x188/0x24e [ 1533.366157][ T3944] ? show_regs_print_info+0x12/0x12 [ 1533.371386][ T3944] ? load_image+0x400/0x400 [ 1533.376019][ T3944] ? __lock_acquire+0x7d10/0x7d10 [ 1533.381083][ T3944] should_fail_ex+0x399/0x4d0 [ 1533.385796][ T3944] _copy_to_user+0x2c/0x130 [ 1533.390334][ T3944] __htab_map_lookup_and_delete_batch+0x1cea/0x2060 [ 1533.397003][ T3944] ? lookup_nulls_elem_raw+0x160/0x160 [ 1533.402505][ T3944] ? __fdget+0x17c/0x200 [ 1533.406784][ T3944] ? htab_lru_percpu_map_lookup_and_delete_elem+0x40/0x40 [ 1533.413932][ T3944] bpf_map_do_batch+0x466/0x600 [ 1533.418821][ T3944] __sys_bpf+0x6f7/0x780 [ 1533.423095][ T3944] ? bpf_link_show_fdinfo+0x380/0x380 [ 1533.428509][ T3944] ? lock_chain_count+0x20/0x20 [ 1533.433533][ T3944] __x64_sys_bpf+0x78/0x90 [ 1533.437987][ T3944] do_syscall_64+0x4c/0xa0 [ 1533.442428][ T3944] ? clear_bhb_loop+0x60/0xb0 [ 1533.447129][ T3944] ? clear_bhb_loop+0x60/0xb0 [ 1533.451835][ T3944] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1533.457760][ T3944] RIP: 0033:0x7fe753f9c799 [ 1533.462199][ T3944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1533.481831][ T3944] RSP: 002b:00007fe754e93028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1533.490264][ T3944] RAX: ffffffffffffffda RBX: 00007fe754216090 RCX: 00007fe753f9c799 [ 1533.498248][ T3944] RDX: 0000000000000038 RSI: 0000200000000600 RDI: 0000000000000019 [ 1533.506322][ T3944] RBP: 00007fe754e93090 R08: 0000000000000000 R09: 0000000000000000 [ 1533.514299][ T3944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1533.522285][ T3944] R13: 00007fe754216128 R14: 00007fe754216090 R15: 00007ffe830ebd28 [ 1533.530270][ T3944] [ 1533.562582][T13866] Bluetooth: hci5: command 0x041b tx timeout [ 1533.992463][ T3963] netlink: 'syz.0.9330': attribute type 21 has an invalid length. [ 1534.025007][ T3963] netlink: 152 bytes leftover after parsing attributes in process `syz.0.9330'. [ 1534.823771][ T3977] netlink: 152 bytes leftover after parsing attributes in process `syz.3.9340'. [ 1534.983038][ T3834] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1534.996040][ T3980] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.9331'. [ 1535.021508][ T3834] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1535.174861][ T3834] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1535.195723][ T3834] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1535.268632][ T3991] netlink: 'syz.0.9335': attribute type 10 has an invalid length. [ 1535.352109][ T3990] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1535.359282][ T3990] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1535.563118][ T3997] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9337'. [ 1535.636317][T13866] Bluetooth: hci5: command 0x040f tx timeout [ 1535.957787][ T4007] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9342'. [ 1536.096089][T28714] device vlan0 left promiscuous mode [ 1536.119108][T28714] À: port 1(vlan0) entered disabled state [ 1536.152153][T28714] device hsr_slave_0 left promiscuous mode [ 1536.167246][T28714] device hsr_slave_1 left promiscuous mode [ 1536.182964][T28714] device bridge_slave_1 left promiscuous mode [ 1536.198646][T28714] bridge0: port 2(bridge_slave_1) entered disabled state [ 1536.212050][T28714] device bridge_slave_0 left promiscuous mode [ 1536.233883][T28714] bridge0: port 1(bridge_slave_0) entered disabled state [ 1536.283597][T28714] device veth1_macvtap left promiscuous mode [ 1536.291533][T28714] device veth0_macvtap left promiscuous mode [ 1536.300755][T28714] device veth1_vlan left promiscuous mode [ 1536.313773][T28714] device veth0_vlan left promiscuous mode [ 1536.777615][ T4037] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9347'. [ 1537.150000][ T4049] FAULT_INJECTION: forcing a failure. [ 1537.150000][ T4049] name failslab, interval 1, probability 0, space 0, times 0 [ 1537.170042][ T4049] CPU: 1 PID: 4049 Comm: syz.3.9352 Not tainted syzkaller #0 [ 1537.177474][ T4049] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1537.187568][ T4049] Call Trace: [ 1537.190871][ T4049] [ 1537.193910][ T4049] dump_stack_lvl+0x188/0x24e [ 1537.198616][ T4049] ? show_regs_print_info+0x12/0x12 [ 1537.204010][ T4049] ? load_image+0x400/0x400 [ 1537.208622][ T4049] ? __might_sleep+0xd0/0xd0 [ 1537.213224][ T4049] ? __lock_acquire+0x7d10/0x7d10 [ 1537.218362][ T4049] should_fail_ex+0x399/0x4d0 [ 1537.223141][ T4049] should_failslab+0x5/0x20 [ 1537.228040][ T4049] slab_pre_alloc_hook+0x59/0x310 [ 1537.233160][ T4049] ? tracepoint_add_func+0x2f9/0x990 [ 1537.239146][ T4049] __kmem_cache_alloc_node+0x4f/0x260 [ 1537.244522][ T4049] ? tracepoint_add_func+0x2f9/0x990 [ 1537.249984][ T4049] __kmalloc+0xa0/0x240 [ 1537.254143][ T4049] ? trace_event_raw_event_bpf_trace_printk+0x230/0x230 [ 1537.261097][ T4049] tracepoint_add_func+0x2f9/0x990 [ 1537.266217][ T4049] ? trace_event_raw_event_bpf_trace_printk+0x230/0x230 [ 1537.273153][ T4049] tracepoint_probe_register+0x5a/0x90 [ 1537.278615][ T4049] ? trace_event_raw_event_bpf_trace_printk+0x230/0x230 [ 1537.285732][ T4049] perf_trace_event_init+0x420/0x940 [ 1537.291038][ T4049] perf_trace_init+0x234/0x2d0 [ 1537.295807][ T4049] perf_tp_event_init+0x89/0x110 [ 1537.300754][ T4049] perf_try_init_event+0x12b/0x3d0 [ 1537.305866][ T4049] perf_event_alloc+0xf5c/0x21b0 [ 1537.310805][ T4049] ? perf_event_alloc+0xbe2/0x21b0 [ 1537.315923][ T4049] ? find_lively_task_by_vpid+0x19/0x290 [ 1537.321819][ T4049] __se_sys_perf_event_open+0x6fd/0x1ec0 [ 1537.327543][ T4049] ? __fget_files+0x43d/0x4b0 [ 1537.332228][ T4049] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 1537.337877][ T4049] ? lockdep_hardirqs_on+0x94/0x140 [ 1537.343155][ T4049] ? __x64_sys_perf_event_open+0x1c/0xc0 [ 1537.348820][ T4049] do_syscall_64+0x4c/0xa0 [ 1537.353271][ T4049] ? clear_bhb_loop+0x60/0xb0 [ 1537.357959][ T4049] ? clear_bhb_loop+0x60/0xb0 [ 1537.362651][ T4049] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1537.368712][ T4049] RIP: 0033:0x7fb3f279c799 [ 1537.373150][ T4049] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1537.392765][ T4049] RSP: 002b:00007fb3f3662028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1537.401185][ T4049] RAX: ffffffffffffffda RBX: 00007fb3f2a15fa0 RCX: 00007fb3f279c799 [ 1537.409159][ T4049] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000140 [ 1537.417130][ T4049] RBP: 00007fb3f3662090 R08: 0000000000000000 R09: 0000000000000000 [ 1537.425103][ T4049] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1537.433095][ T4049] R13: 00007fb3f2a16038 R14: 00007fb3f2a15fa0 R15: 00007ffd08643a68 [ 1537.441105][ T4049] [ 1537.716655][T13866] Bluetooth: hci5: command 0x0419 tx timeout [ 1537.952806][T28714] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1538.995943][ C0] icmp: detected local route for 172.20.20.170 during ICMP sending, src 172.20.20.187 [ 1541.263197][T28714] bond0 (unregistering): Released all slaves [ 1541.389836][ T4037] netlink: 'syz.4.9347': attribute type 25 has an invalid length. [ 1541.414886][ T4044] netlink: 'syz.1.9350': attribute type 21 has an invalid length. [ 1541.422800][ T4044] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9350'. [ 1541.485525][ T3834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1541.547981][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1541.577829][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1541.618555][ T3834] 8021q: adding VLAN 0 to HW filter on device team0 [ 1541.666820][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1541.688124][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1541.706793][T25367] bridge0: port 1(bridge_slave_0) entered blocking state [ 1541.714048][T25367] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1541.771902][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1541.794251][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1541.812899][T25367] bridge0: port 2(bridge_slave_1) entered blocking state [ 1541.820210][T25367] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1541.853179][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1541.881803][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1541.914153][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1541.956454][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1541.979283][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1541.999386][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1542.019645][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1542.052399][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1542.062175][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1542.086122][ T3834] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1542.107971][ T3834] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1542.131341][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1542.144128][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1542.158397][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1542.272083][ T4099] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9367'. [ 1542.303068][ T4099] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9367'. [ 1542.349651][ T4101] netlink: 60 bytes leftover after parsing attributes in process `syz.1.9367'. [ 1542.451915][ T4102] bridge0: port 3(ip6gretap0) entered blocking state [ 1542.482133][ T4102] bridge0: port 3(ip6gretap0) entered disabled state [ 1542.547573][ T4102] device ip6gretap0 entered promiscuous mode [ 1542.574093][ T4102] bridge0: port 3(ip6gretap0) entered blocking state [ 1542.581766][ T4102] bridge0: port 3(ip6gretap0) entered forwarding state [ 1543.033123][ T4121] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9374'. [ 1543.154033][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1543.177076][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1543.203648][ T3834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1543.259323][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1543.288684][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1543.367118][T28718] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1543.397524][T28718] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1543.415732][ T3834] device veth0_vlan entered promiscuous mode [ 1543.428106][T28718] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1543.437404][T28718] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1543.452542][ T3834] device veth1_vlan entered promiscuous mode [ 1543.460675][T28718] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1543.510455][ T4137] netlink: 'syz.0.9381': attribute type 27 has an invalid length. [ 1543.527952][T24583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1543.528980][ T4137] netlink: 164 bytes leftover after parsing attributes in process `syz.0.9381'. [ 1543.538005][T24583] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1543.563732][ T3834] device veth0_macvtap entered promiscuous mode [ 1543.575302][ T3834] device veth1_macvtap entered promiscuous mode [ 1543.576426][ T4139] netlink: 'syz.3.9382': attribute type 3 has an invalid length. [ 1543.602504][ T3834] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1543.610980][ T4139] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.9382'. [ 1543.613634][ T3834] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1543.639864][ T3834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1543.659358][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1543.673319][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1543.681714][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1543.690731][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1543.708227][ T3834] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1543.719593][ T3834] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1543.731909][ T3834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1543.742212][ T2962] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1543.755930][ T2962] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1543.769259][ T3834] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.780254][ T3834] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.790508][ T3834] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.801610][ T3834] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.917157][ T2962] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1543.930946][ T2962] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1543.946182][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1543.991826][T24583] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1544.001357][T24583] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1544.013189][T28718] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1544.168913][ T4150] netlink: 'syz.3.9386': attribute type 4 has an invalid length. [ 1544.187927][ T4150] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.9386'. [ 1545.739913][ T4196] netlink: 'syz.4.9397': attribute type 1 has an invalid length. [ 1545.770593][ T4196] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9397'. [ 1545.792199][ T1947] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1545.801529][ T1947] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1545.811234][ T1947] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1545.831470][ T1947] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1545.843656][ T1947] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1545.851146][ T1947] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1545.972452][ T4194] tap0: tun_chr_ioctl cmd 1074025677 [ 1545.980481][ T4194] tap0: linktype set to 776 [ 1546.005867][ T4199] device bridge_slave_1 left promiscuous mode [ 1546.015323][ T4199] bridge0: port 2(bridge_slave_1) entered disabled state [ 1546.027166][ T4199] device bridge_slave_0 left promiscuous mode [ 1546.033772][ T4199] bridge0: port 1(bridge_slave_0) entered disabled state [ 1546.037937][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.048937][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.140389][ T4204] netlink: 'syz.0.9403': attribute type 4 has an invalid length. [ 1546.148600][ T4204] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.9403'. [ 1546.300171][ T2962] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.433865][ T2962] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.533859][ T2962] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.674327][ T2962] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1547.160157][ T2962] device 0 left promiscuous mode [ 1547.310180][ T4197] chnl_net:caif_netlink_parms(): no params data found [ 1547.783631][ T4197] bridge0: port 1(bridge_slave_0) entered blocking state [ 1547.822056][ T4197] bridge0: port 1(bridge_slave_0) entered disabled state [ 1547.866175][ T4197] device bridge_slave_0 entered promiscuous mode [ 1547.955446][ T1947] Bluetooth: hci1: command 0x0409 tx timeout [ 1547.974889][ T4197] bridge0: port 2(bridge_slave_1) entered blocking state [ 1547.982055][ T4197] bridge0: port 2(bridge_slave_1) entered disabled state [ 1548.050947][ T4264] netlink: 'syz.2.9418': attribute type 4 has an invalid length. [ 1548.079970][ T4197] device bridge_slave_1 entered promiscuous mode [ 1548.110809][ T4264] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.9418'. [ 1548.234449][ T4197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1548.270340][ T4262] can: request_module (can-proto-0) failed. [ 1548.446983][ T4197] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1548.699311][ T4197] team0: Port device team_slave_0 added [ 1548.723085][ T4197] team0: Port device team_slave_1 added [ 1548.850480][ T4197] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1548.879058][ T4197] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1549.030696][ T4197] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1549.156048][ T4197] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1549.163641][ T4197] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1549.301975][ T4197] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1549.559155][ T4197] device hsr_slave_0 entered promiscuous mode [ 1549.569852][ T4197] device hsr_slave_1 entered promiscuous mode [ 1549.598393][ T4197] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1549.606187][ T4197] Cannot create hsr debugfs directory [ 1549.643310][ T4308] netlink: 'syz.1.9428': attribute type 10 has an invalid length. [ 1549.667347][ T4309] netlink: 'syz.4.9427': attribute type 21 has an invalid length. [ 1549.691758][ T4309] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9427'. [ 1550.041711][ T1947] Bluetooth: hci1: command 0x041b tx timeout [ 1550.064528][ T4319] bridge0: port 3(ip6gretap0) entered blocking state [ 1550.089527][ T4319] bridge0: port 3(ip6gretap0) entered disabled state [ 1550.152242][ T4319] device ip6gretap0 entered promiscuous mode [ 1550.183646][ T4319] bridge0: port 3(ip6gretap0) entered blocking state [ 1550.190693][ T4319] bridge0: port 3(ip6gretap0) entered forwarding state [ 1550.920285][ T4328] netlink: 'syz.2.9431': attribute type 4 has an invalid length. [ 1550.960593][ T4328] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.9431'. [ 1552.125110][ T1947] Bluetooth: hci1: command 0x040f tx timeout [ 1554.221272][ T1947] Bluetooth: hci1: command 0x0419 tx timeout [ 1555.333297][ T4349] netlink: 10 bytes leftover after parsing attributes in process `syz.2.9435'. [ 1555.367440][ T4356] netlink: 'syz.0.9436': attribute type 16 has an invalid length. [ 1555.384961][ T4356] netlink: 48 bytes leftover after parsing attributes in process `syz.0.9436'. [ 1555.922809][ T4373] netlink: 'syz.2.9441': attribute type 21 has an invalid length. [ 1556.128191][ T4373] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9441'. [ 1557.121338][ T4387] netlink: 'syz.4.9444': attribute type 4 has an invalid length. [ 1557.153057][ T4387] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.9444'. [ 1557.199986][ T2962] device hsr_slave_0 left promiscuous mode [ 1557.278791][ T2962] device hsr_slave_1 left promiscuous mode [ 1557.366048][ T2962] device veth1_macvtap left promiscuous mode [ 1557.390858][ T2962] device veth0_macvtap left promiscuous mode [ 1558.451333][ T2962] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1558.669515][ T4409] FAULT_INJECTION: forcing a failure. [ 1558.669515][ T4409] name failslab, interval 1, probability 0, space 0, times 0 [ 1558.685264][ T4409] CPU: 1 PID: 4409 Comm: syz.1.9451 Not tainted syzkaller #0 [ 1558.692687][ T4409] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1558.703277][ T4409] Call Trace: [ 1558.706553][ T4409] [ 1558.709485][ T4409] dump_stack_lvl+0x188/0x24e [ 1558.714174][ T4409] ? show_regs_print_info+0x12/0x12 [ 1558.719384][ T4409] ? load_image+0x400/0x400 [ 1558.723895][ T4409] ? __might_sleep+0xd0/0xd0 [ 1558.728489][ T4409] ? __lock_acquire+0x7d10/0x7d10 [ 1558.733512][ T4409] should_fail_ex+0x399/0x4d0 [ 1558.738185][ T4409] should_failslab+0x5/0x20 [ 1558.742720][ T4409] slab_pre_alloc_hook+0x59/0x310 [ 1558.747741][ T4409] kmem_cache_alloc_node+0x5a/0x320 [ 1558.752956][ T4409] ? __alloc_skb+0xfc/0x7e0 [ 1558.757464][ T4409] __alloc_skb+0xfc/0x7e0 [ 1558.761793][ T4409] ? netlink_autobind+0xda/0x300 [ 1558.766742][ T4409] netlink_sendmsg+0x654/0xbd0 [ 1558.771511][ T4409] ? netlink_getsockopt+0x550/0x550 [ 1558.776709][ T4409] ? aa_sock_msg_perm+0x94/0x150 [ 1558.781640][ T4409] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1558.786920][ T4409] ? security_socket_sendmsg+0x7c/0xa0 [ 1558.792381][ T4409] ? netlink_getsockopt+0x550/0x550 [ 1558.797577][ T4409] ____sys_sendmsg+0x5be/0x970 [ 1558.802376][ T4409] ? __sys_sendmsg_sock+0x30/0x30 [ 1558.807398][ T4409] ? __import_iovec+0x315/0x500 [ 1558.812258][ T4409] ? import_iovec+0x6f/0xa0 [ 1558.816754][ T4409] ___sys_sendmsg+0x2a2/0x360 [ 1558.821434][ T4409] ? __sys_sendmsg+0x290/0x290 [ 1558.826210][ T4409] ? __lock_acquire+0x7d10/0x7d10 [ 1558.831258][ T4409] __se_sys_sendmsg+0x1bb/0x2a0 [ 1558.836109][ T4409] ? __x64_sys_sendmsg+0x80/0x80 [ 1558.841057][ T4409] ? lockdep_hardirqs_on+0x94/0x140 [ 1558.846258][ T4409] do_syscall_64+0x4c/0xa0 [ 1558.850674][ T4409] ? clear_bhb_loop+0x60/0xb0 [ 1558.855346][ T4409] ? clear_bhb_loop+0x60/0xb0 [ 1558.860025][ T4409] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1558.865914][ T4409] RIP: 0033:0x7fc4fb59c799 [ 1558.870360][ T4409] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1558.889960][ T4409] RSP: 002b:00007fc4f97f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1558.898485][ T4409] RAX: ffffffffffffffda RBX: 00007fc4fb815fa0 RCX: 00007fc4fb59c799 [ 1558.906627][ T4409] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 1558.914681][ T4409] RBP: 00007fc4f97f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1558.922647][ T4409] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1558.930609][ T4409] R13: 00007fc4fb816038 R14: 00007fc4fb815fa0 R15: 00007ffda4676ca8 [ 1558.938581][ T4409] [ 1559.064500][ T2962] bond0 (unregistering): Released all slaves [ 1559.138045][ T4389] netlink: 'syz.0.9445': attribute type 10 has an invalid length. [ 1559.186983][ T4197] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1559.257244][ T4197] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1559.286617][ T4197] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1559.355840][ T4197] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1559.728453][ T4197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1559.776430][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 1559.794598][T25367] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 1559.835290][ T4197] 8021q: adding VLAN 0 to HW filter on device team0 [ 1559.881270][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 1559.915894][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 1559.939248][T28715] bridge0: port 1(bridge_slave_0) entered blocking state [ 1559.946474][T28715] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1559.969910][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 1559.991817][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 1560.014430][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 1560.055370][T28713] bridge0: port 2(bridge_slave_1) entered blocking state [ 1560.062548][T28713] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1560.337795][ T4447] netlink: 'syz.0.9457': attribute type 4 has an invalid length. [ 1560.364828][ T4447] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.9457'. [ 1560.412671][ T4449] netlink: 'syz.1.9458': attribute type 4 has an invalid length. [ 1560.431686][ T4436] netlink: 'syz.2.9456': attribute type 21 has an invalid length. [ 1560.464399][ T4449] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.9458'. [ 1560.484154][ T4436] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9456'. [ 1560.566524][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 1560.590267][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 1560.630599][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 1560.665935][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 1560.701661][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 1560.748423][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 1560.779578][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 1560.813297][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 1560.842646][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 1560.865899][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 1560.886602][ T4325] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 1560.917504][ T4197] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 1561.066559][ T4466] netlink: 44 bytes leftover after parsing attributes in process `syz.1.9461'. [ 1561.209253][ T4474] netlink: 'syz.2.9464': attribute type 10 has an invalid length. [ 1561.254152][ T4474] batman_adv: batadv0: Adding interface: netdevsim0 [ 1561.267757][ T4474] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1561.344582][ T4474] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 1561.860126][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 1561.872240][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 1561.899479][ T4197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1562.019773][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 1562.046975][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 1562.109272][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 1562.141793][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 1562.178981][ T4197] device veth0_vlan entered promiscuous mode [ 1562.197122][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 1562.268763][T28713] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 1562.314285][ T4197] device veth1_vlan entered promiscuous mode [ 1562.379537][ T4503] netlink: 'syz.2.9473': attribute type 4 has an invalid length. [ 1562.393014][ T2962] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 1562.401705][ T4503] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.9473'. [ 1562.416214][ T2962] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 1562.450766][ T2962] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 1562.478602][ T2962] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 1562.549377][ T4197] device veth0_macvtap entered promiscuous mode [ 1562.600671][ T4197] device veth1_macvtap entered promiscuous mode [ 1562.642973][ T4516] netlink: 'syz.0.9474': attribute type 21 has an invalid length. [ 1562.689975][ T4516] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9474'. [ 1562.749305][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 1562.768977][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 1562.801954][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1562.855752][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1562.888037][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1562.926936][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1562.949069][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1562.971053][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 1562.987903][T28715] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 1563.038127][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1563.054739][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1563.064602][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1563.134865][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1563.159033][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1563.190115][T24583] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 1563.206582][T24583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 1563.249088][ T4197] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.258585][ T4197] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.267951][ T4197] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.291004][ T4197] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.304453][ T4534] netlink: 152 bytes leftover after parsing attributes in process `syz.2.9476'. [ 1563.339786][ T4539] netlink: 'syz.1.9478': attribute type 10 has an invalid length. [ 1563.381491][ T4529] netlink: 'syz.2.9476': attribute type 25 has an invalid length. [ 1563.541753][T28714] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1563.582163][T28714] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1563.637050][T28714] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 1563.658711][T25367] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1563.676116][T25367] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1563.720856][T24583] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 1564.552092][ T4569] netlink: 'syz.4.9486': attribute type 4 has an invalid length. [ 1564.644991][ T4569] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.9486'. [ 1565.350623][ T4586] netlink: 'syz.2.9489': attribute type 10 has an invalid length. [ 1565.413135][ T4587] netlink: 'syz.4.9490': attribute type 21 has an invalid length. [ 1565.438657][ T4587] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9490'. [ 1566.370592][ T4612] netlink: 152 bytes leftover after parsing attributes in process `syz.0.9496'. [ 1566.942174][ T4621] netlink: 'syz.4.9502': attribute type 4 has an invalid length. [ 1566.990778][ T4621] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.9502'. [ 1567.299232][ T4629] netlink: 'syz.1.9505': attribute type 10 has an invalid length. [ 1567.488304][ T4631] netlink: 'syz.0.9506': attribute type 10 has an invalid length. [ 1567.704291][ T4631] team0: Port device wlan1 added [ 1567.890301][ T4638] netlink: 'syz.1.9518': attribute type 4 has an invalid length. [ 1567.924932][ T4638] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.9518'. [ 1568.239818][ T4657] netlink: 'syz.2.9513': attribute type 21 has an invalid length. [ 1568.248502][ T4658] FAULT_INJECTION: forcing a failure. [ 1568.248502][ T4658] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1568.275226][ T4657] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9513'. [ 1568.277772][ T4658] CPU: 0 PID: 4658 Comm: syz.3.9514 Not tainted syzkaller #0 [ 1568.291724][ T4658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1568.301810][ T4658] Call Trace: [ 1568.305110][ T4658] [ 1568.308061][ T4658] dump_stack_lvl+0x188/0x24e [ 1568.312771][ T4658] ? show_regs_print_info+0x12/0x12 [ 1568.318003][ T4658] ? load_image+0x400/0x400 [ 1568.322563][ T4658] ? __lock_acquire+0x7d10/0x7d10 [ 1568.327614][ T4658] ? __fget_files+0x28/0x4b0 [ 1568.332237][ T4658] should_fail_ex+0x399/0x4d0 [ 1568.336956][ T4658] _copy_from_user+0x2c/0x170 [ 1568.341759][ T4658] bpf_obj_get_info_by_fd+0x45b/0x2f50 [ 1568.347229][ T4658] ? perf_trace_buf_alloc+0x300/0x300 [ 1568.352597][ T4658] ? verify_lock_unused+0x140/0x140 [ 1568.357798][ T4658] ? bpf_map_get_fd_by_id+0x310/0x310 [ 1568.363194][ T4658] ? __might_fault+0xa6/0x120 [ 1568.367864][ T4658] ? __might_fault+0xc2/0x120 [ 1568.372531][ T4658] ? __might_fault+0xa6/0x120 [ 1568.377232][ T4658] ? bpf_lsm_bpf+0x5/0x10 [ 1568.381647][ T4658] ? security_bpf+0x7a/0xa0 [ 1568.386160][ T4658] __sys_bpf+0x505/0x780 [ 1568.390426][ T4658] ? bpf_link_show_fdinfo+0x380/0x380 [ 1568.395816][ T4658] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1568.402004][ T4658] __x64_sys_bpf+0x78/0x90 [ 1568.406424][ T4658] do_syscall_64+0x4c/0xa0 [ 1568.410838][ T4658] ? clear_bhb_loop+0x60/0xb0 [ 1568.415509][ T4658] ? clear_bhb_loop+0x60/0xb0 [ 1568.420190][ T4658] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1568.426093][ T4658] RIP: 0033:0x7fea1119c799 [ 1568.430501][ T4658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1568.450104][ T4658] RSP: 002b:00007fea1211a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1568.458516][ T4658] RAX: ffffffffffffffda RBX: 00007fea11415fa0 RCX: 00007fea1119c799 [ 1568.466484][ T4658] RDX: 0000000000000010 RSI: 0000200000003380 RDI: 000000000000000f [ 1568.474451][ T4658] RBP: 00007fea1211a090 R08: 0000000000000000 R09: 0000000000000000 [ 1568.482415][ T4658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1568.490382][ T4658] R13: 00007fea11416038 R14: 00007fea11415fa0 R15: 00007ffcccaace98 [ 1568.498364][ T4658] [ 1568.746757][ T4665] netlink: 'syz.0.9526': attribute type 4 has an invalid length. [ 1568.765377][ T4665] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.9526'. [ 1568.974378][ T4669] netlink: 152 bytes leftover after parsing attributes in process `syz.1.9515'. [ 1569.171812][ T4669] netlink: 'syz.1.9515': attribute type 25 has an invalid length. [ 1569.549282][ T4686] netlink: 'syz.2.9520': attribute type 10 has an invalid length. [ 1569.813396][ T4689] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9521'. [ 1569.881344][ T4691] tap0: tun_chr_ioctl cmd 1074025677 [ 1569.888118][ T4691] tap0: linktype set to 776 [ 1569.907363][ T4691] netlink: 'syz.1.9523': attribute type 1 has an invalid length. [ 1569.938692][ T4691] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9523'. [ 1569.950369][ T4691] device bridge_slave_1 left promiscuous mode [ 1569.982536][ T4691] bridge0: port 2(bridge_slave_1) entered disabled state [ 1570.056182][ T4691] device bridge_slave_0 left promiscuous mode [ 1570.088560][ T4691] bridge0: port 1(bridge_slave_0) entered disabled state [ 1570.449865][ T4710] netlink: 'syz.4.9531': attribute type 21 has an invalid length. [ 1570.466374][ T4710] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9531'. [ 1570.565225][ T4715] netlink: 14 bytes leftover after parsing attributes in process `syz.0.9533'. [ 1570.629612][ T4717] netlink: 153952 bytes leftover after parsing attributes in process `syz.0.9533'. [ 1571.299733][ T4729] batman_adv: batadv0: Adding interface: netdevsim0 [ 1571.337022][ T4729] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1571.431616][ T4729] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 1571.871714][ T4751] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9545'. [ 1572.293179][ T4765] validate_nla: 3 callbacks suppressed [ 1572.293216][ T4765] netlink: 'syz.1.9551': attribute type 21 has an invalid length. [ 1572.331421][ T4766] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1572.338055][ T4766] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1572.372753][ T4765] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9551'. [ 1573.193414][ T4782] netlink: 'syz.3.9555': attribute type 10 has an invalid length. [ 1573.710057][ T4805] netlink: 44 bytes leftover after parsing attributes in process `syz.3.9563'. [ 1573.725083][T13866] Bluetooth: hci3: command 0x0406 tx timeout [ 1573.889440][ T4800] device sit0 entered promiscuous mode [ 1573.980626][ T4811] netlink: 'syz.1.9565': attribute type 28 has an invalid length. [ 1574.005590][ T4811] netlink: 'syz.1.9565': attribute type 29 has an invalid length. [ 1574.025337][ T4811] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9565'. [ 1574.354410][ T4811] netlink: 'syz.1.9565': attribute type 10 has an invalid length. [ 1574.397688][ T4811] netlink: 55 bytes leftover after parsing attributes in process `syz.1.9565'. [ 1577.657614][ T4828] netlink: 'syz.0.9570': attribute type 21 has an invalid length. [ 1577.673058][ T4828] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9570'. [ 1577.707141][ T4831] netlink: 'syz.3.9571': attribute type 10 has an invalid length. [ 1577.945774][ T4850] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9577'. [ 1577.960433][ T4850] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9577'. [ 1577.980756][ T4850] netlink: 60 bytes leftover after parsing attributes in process `syz.0.9577'. [ 1578.233140][ T4857] netlink: 'syz.1.9579': attribute type 13 has an invalid length. [ 1578.277141][ T4857] netlink: 152 bytes leftover after parsing attributes in process `syz.1.9579'. [ 1578.341838][ T4857] erspan0: refused to change device tx_queue_len [ 1578.406362][ T4857] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1578.920131][ T4881] netlink: 'syz.1.9587': attribute type 21 has an invalid length. [ 1578.965117][ T4881] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9587'. [ 1579.037932][ T4884] netlink: 'syz.4.9586': attribute type 10 has an invalid length. [ 1579.639679][ T4900] netlink: 'syz.2.9593': attribute type 3 has an invalid length. [ 1579.663673][ T4900] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9593'. [ 1580.300278][ T4928] netlink: 'syz.1.9603': attribute type 10 has an invalid length. [ 1581.540711][ T4956] netlink: 'syz.4.9613': attribute type 21 has an invalid length. [ 1581.566645][ T4956] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9613'. [ 1581.650655][ T4960] netlink: 'syz.3.9614': attribute type 10 has an invalid length. [ 1581.742000][ T4945] device syzkaller0 entered promiscuous mode [ 1583.367793][ T4986] netlink: 60 bytes leftover after parsing attributes in process `syz.4.9625'. [ 1585.129048][ T4968] device bridge0 entered promiscuous mode [ 1585.137888][ T4986] netlink: 60 bytes leftover after parsing attributes in process `syz.4.9625'. [ 1585.275297][ T4992] netlink: 'syz.3.9627': attribute type 10 has an invalid length. [ 1585.481737][ T5002] netlink: 'syz.2.9631': attribute type 21 has an invalid length. [ 1585.499641][ T5002] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9631'. [ 1586.341512][ T5023] netlink: 'syz.4.9637': attribute type 41 has an invalid length. [ 1586.362927][ T5023] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9637'. [ 1586.387104][ T5023] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 1586.484365][ T5027] netlink: 16255 bytes leftover after parsing attributes in process `syz.1.9639'. [ 1586.855690][ T5042] netlink: 'syz.0.9642': attribute type 10 has an invalid length. [ 1587.068107][ T5054] netlink: 'syz.3.9648': attribute type 21 has an invalid length. [ 1587.090085][ T5054] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9648'. [ 1587.127352][ T5052] netlink: 65043 bytes leftover after parsing attributes in process `syz.1.9647'. [ 1587.157734][ T5057] netlink: 'syz.1.9647': attribute type 6 has an invalid length. [ 1587.223647][ T5064] netlink: 'syz.4.9652': attribute type 3 has an invalid length. [ 1587.240951][ T5064] netlink: 'syz.4.9652': attribute type 1 has an invalid length. [ 1587.264280][ T5064] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9652'. [ 1587.294421][ T5067] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9654'. [ 1587.530081][ T5073] netlink: 'syz.0.9656': attribute type 3 has an invalid length. [ 1587.589676][ T5073] netlink: 105116 bytes leftover after parsing attributes in process `syz.0.9656'. [ 1587.660987][ T5073] netlink: 'syz.0.9656': attribute type 19 has an invalid length. [ 1588.539639][ T5100] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.9665'. [ 1588.577480][ T5100] netlink: 105116 bytes leftover after parsing attributes in process `syz.3.9665'. [ 1588.649754][ T5100] device pim6reg1 entered promiscuous mode [ 1588.701581][ T5100] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9665'. [ 1588.715235][ T5100] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9665'. [ 1588.728768][ T5100] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9665'. [ 1588.814114][ T5115] netlink: 105120 bytes leftover after parsing attributes in process `syz.4.9669'. [ 1588.941714][ T5119] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9671'. [ 1589.800416][ T5142] FAULT_INJECTION: forcing a failure. [ 1589.800416][ T5142] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1589.884888][ T5142] CPU: 1 PID: 5142 Comm: syz.4.9678 Not tainted syzkaller #0 [ 1589.892343][ T5142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1589.902522][ T5142] Call Trace: [ 1589.905850][ T5142] [ 1589.908804][ T5142] dump_stack_lvl+0x188/0x24e [ 1589.913520][ T5142] ? show_regs_print_info+0x12/0x12 [ 1589.918737][ T5142] ? load_image+0x400/0x400 [ 1589.923253][ T5142] ? __lock_acquire+0x7d10/0x7d10 [ 1589.928289][ T5142] should_fail_ex+0x399/0x4d0 [ 1589.933091][ T5142] _copy_from_iter+0x1c0/0x1130 [ 1589.937948][ T5142] ? __lock_acquire+0x7d10/0x7d10 [ 1589.942982][ T5142] ? copyout_mc+0x110/0x110 [ 1589.947489][ T5142] ? __virt_addr_valid+0x188/0x540 [ 1589.952609][ T5142] ? __virt_addr_valid+0x188/0x540 [ 1589.957759][ T5142] ? __virt_addr_valid+0x465/0x540 [ 1589.962877][ T5142] ? __check_object_size+0x500/0xa40 [ 1589.968169][ T5142] kernfs_fop_write_iter+0x1a0/0x520 [ 1589.973476][ T5142] vfs_write+0x4b1/0xa30 [ 1589.977758][ T5142] ? file_end_write+0x250/0x250 [ 1589.982619][ T5142] ? __fget_files+0x43d/0x4b0 [ 1589.987307][ T5142] ? __fdget_pos+0x2ae/0x360 [ 1589.991905][ T5142] ? ksys_write+0x71/0x250 [ 1589.996330][ T5142] ksys_write+0x14c/0x250 [ 1590.000682][ T5142] ? __ia32_sys_read+0x80/0x80 [ 1590.005455][ T5142] ? lockdep_hardirqs_on+0x94/0x140 [ 1590.010657][ T5142] do_syscall_64+0x4c/0xa0 [ 1590.015076][ T5142] ? clear_bhb_loop+0x60/0xb0 [ 1590.019756][ T5142] ? clear_bhb_loop+0x60/0xb0 [ 1590.024436][ T5142] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1590.030327][ T5142] RIP: 0033:0x7fe753f9c799 [ 1590.034745][ T5142] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1590.054354][ T5142] RSP: 002b:00007fe754eb4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1590.062778][ T5142] RAX: ffffffffffffffda RBX: 00007fe754215fa0 RCX: 00007fe753f9c799 [ 1590.070752][ T5142] RDX: 0000000000000012 RSI: 0000200000000040 RDI: 0000000000000006 [ 1590.078722][ T5142] RBP: 00007fe754eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1590.086696][ T5142] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1590.094671][ T5142] R13: 00007fe754216038 R14: 00007fe754215fa0 R15: 00007ffe830ebd28 [ 1590.102671][ T5142] [ 1590.906515][ T5160] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.9683'. [ 1591.292105][ T5163] device wg2 entered promiscuous mode [ 1591.443505][ T5171] validate_nla: 6 callbacks suppressed [ 1591.443523][ T5171] netlink: 'syz.3.9688': attribute type 10 has an invalid length. [ 1591.573381][ T5178] tipc: Started in network mode [ 1591.593412][ T5178] tipc: Node identity 9215a268, cluster identity 4711 [ 1591.613578][ T5178] tipc: Node number set to 2450891368 [ 1591.797356][ T5188] netlink: 'syz.2.9693': attribute type 21 has an invalid length. [ 1591.820557][ T5188] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9693'. [ 1592.099129][ T5195] netlink: 'syz.1.9695': attribute type 21 has an invalid length. [ 1592.125511][ T5195] netlink: 'syz.1.9695': attribute type 1 has an invalid length. [ 1592.133482][ T5195] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9695'. [ 1592.311174][ T5196] bridge_slave_1: default FDB implementation only supports local addresses [ 1592.991500][ T5215] netlink: 'syz.1.9702': attribute type 10 has an invalid length. [ 1593.918703][ T5235] netlink: 'syz.3.9710': attribute type 21 has an invalid length. [ 1593.942146][ T5235] __nla_validate_parse: 1 callbacks suppressed [ 1593.942186][ T5235] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9710'. [ 1594.195162][ T1947] Bluetooth: hci0: command 0x0406 tx timeout [ 1594.695865][ T5237] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1594.772748][ T5242] netlink: 'syz.4.9711': attribute type 16 has an invalid length. [ 1594.821775][ T5242] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9711'. [ 1595.089742][ T5257] netlink: 'syz.1.9716': attribute type 20 has an invalid length. [ 1595.205222][ T5263] netlink: 'syz.3.9718': attribute type 10 has an invalid length. [ 1596.409732][ T5271] FAULT_INJECTION: forcing a failure. [ 1596.409732][ T5271] name failslab, interval 1, probability 0, space 0, times 0 [ 1596.428189][ T5270] netlink: 763 bytes leftover after parsing attributes in process `syz.3.9721'. [ 1596.433494][ T5271] CPU: 0 PID: 5271 Comm: syz.2.9720 Not tainted syzkaller #0 [ 1596.444737][ T5271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1596.454885][ T5271] Call Trace: [ 1596.458168][ T5271] [ 1596.461358][ T5271] dump_stack_lvl+0x188/0x24e [ 1596.466061][ T5271] ? show_regs_print_info+0x12/0x12 [ 1596.471267][ T5271] ? load_image+0x400/0x400 [ 1596.475781][ T5271] ? __might_sleep+0xd0/0xd0 [ 1596.480376][ T5271] ? __lock_acquire+0x7d10/0x7d10 [ 1596.485418][ T5271] should_fail_ex+0x399/0x4d0 [ 1596.490111][ T5271] should_failslab+0x5/0x20 [ 1596.494620][ T5271] slab_pre_alloc_hook+0x59/0x310 [ 1596.499653][ T5271] ? prepend_path+0xa68/0xc20 [ 1596.504333][ T5271] ? tomoyo_encode+0x27e/0x540 [ 1596.509166][ T5271] __kmem_cache_alloc_node+0x4f/0x260 [ 1596.514551][ T5271] ? tomoyo_encode+0x27e/0x540 [ 1596.519320][ T5271] __kmalloc+0xa0/0x240 [ 1596.523486][ T5271] tomoyo_encode+0x27e/0x540 [ 1596.528094][ T5271] tomoyo_realpath_from_path+0x58e/0x5d0 [ 1596.533837][ T5271] ? tomoyo_path_number_perm+0x205/0x650 [ 1596.539482][ T5271] tomoyo_path_number_perm+0x22f/0x650 [ 1596.544951][ T5271] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 1596.550418][ T5271] ? ksys_write+0x1c0/0x250 [ 1596.554939][ T5271] ? common_file_perm+0x171/0x1c0 [ 1596.560101][ T5271] ? __fget_files+0x28/0x4b0 [ 1596.564695][ T5271] ? __fget_files+0x28/0x4b0 [ 1596.569393][ T5271] security_file_ioctl+0x6c/0xa0 [ 1596.574349][ T5271] __se_sys_ioctl+0x48/0x170 [ 1596.578950][ T5271] do_syscall_64+0x4c/0xa0 [ 1596.583371][ T5271] ? clear_bhb_loop+0x60/0xb0 [ 1596.588050][ T5271] ? clear_bhb_loop+0x60/0xb0 [ 1596.592734][ T5271] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1596.598634][ T5271] RIP: 0033:0x7ff39839c799 [ 1596.603056][ T5271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1596.622753][ T5271] RSP: 002b:00007ff399234028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1596.631259][ T5271] RAX: ffffffffffffffda RBX: 00007ff398615fa0 RCX: 00007ff39839c799 [ 1596.639231][ T5271] RDX: 0000200000000180 RSI: 0000000040107446 RDI: 0000000000000004 [ 1596.647225][ T5271] RBP: 00007ff399234090 R08: 0000000000000000 R09: 0000000000000000 [ 1596.655217][ T5271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1596.663186][ T5271] R13: 00007ff398616038 R14: 00007ff398615fa0 R15: 00007ffe4b127048 [ 1596.671185][ T5271] [ 1596.739793][ T5271] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1597.221078][ T5290] netlink: 'syz.3.9729': attribute type 21 has an invalid length. [ 1597.250570][ T5290] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9729'. [ 1597.288547][ T5292] netlink: 'syz.2.9730': attribute type 21 has an invalid length. [ 1597.307544][ T5292] netlink: 'syz.2.9730': attribute type 1 has an invalid length. [ 1597.335377][ T5292] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9730'. [ 1597.457217][ T5292] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.9730'. [ 1597.695200][ T5300] netlink: 'syz.2.9732': attribute type 10 has an invalid length. [ 1598.395559][ T5332] netlink: 'syz.0.9744': attribute type 2 has an invalid length. [ 1598.447690][ T5332] netlink: 14 bytes leftover after parsing attributes in process `syz.0.9744'. [ 1598.663294][ T5342] netlink: 'syz.3.9747': attribute type 10 has an invalid length. [ 1599.618263][ T5360] netlink: 164 bytes leftover after parsing attributes in process `syz.1.9755'. [ 1599.767894][ T5366] netlink: 'syz.4.9754': attribute type 21 has an invalid length. [ 1599.895762][ T5366] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9754'. [ 1600.034784][ T5370] netlink: 'syz.2.9757': attribute type 4 has an invalid length. [ 1600.282578][ T5381] netlink: 'syz.3.9760': attribute type 10 has an invalid length. [ 1600.367253][ T5385] netlink: 'syz.1.9761': attribute type 3 has an invalid length. [ 1600.394832][ T5385] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9761'. [ 1602.821818][ T5435] netlink: 'syz.3.9774': attribute type 4 has an invalid length. [ 1602.864844][ T5435] netlink: 'syz.3.9774': attribute type 39 has an invalid length. [ 1603.023792][ T5435] device hsr_slave_1 left promiscuous mode [ 1603.098168][ T5437] netlink: 'syz.4.9775': attribute type 10 has an invalid length. [ 1603.133158][ T5440] netlink: 'syz.1.9776': attribute type 21 has an invalid length. [ 1603.175760][ T5440] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9776'. [ 1603.628351][ T5456] netlink: 'syz.4.9782': attribute type 13 has an invalid length. [ 1603.669035][ T5456] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9782'. [ 1603.692177][ T5456] syz_tun: refused to change device tx_queue_len [ 1603.699795][ T5456] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1603.720282][ T5457] netlink: 'syz.4.9782': attribute type 13 has an invalid length. [ 1603.761248][ T5457] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9782'. [ 1603.796931][ T5457] syz_tun: refused to change device tx_queue_len [ 1603.803330][ T5457] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1603.908561][ T5458] netlink: 'syz.4.9782': attribute type 13 has an invalid length. [ 1603.922164][ T5458] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9782'. [ 1603.962558][ T5458] syz_tun: refused to change device tx_queue_len [ 1603.979780][ T5458] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 1604.023854][ T5456] netlink: 'syz.4.9782': attribute type 10 has an invalid length. [ 1604.061442][ T1947] Bluetooth: hci0: ISO packet for unknown connection handle 3337 [ 1604.116700][ T5456] team0: Port device netdevsim0 added [ 1604.257534][ T5473] netlink: 16162 bytes leftover after parsing attributes in process `syz.2.9787'. [ 1604.509521][ T5480] netlink: 'syz.1.9789': attribute type 10 has an invalid length. [ 1605.370209][ T5489] netlink: 'syz.2.9793': attribute type 10 has an invalid length. [ 1605.447431][ T5494] netlink: 109560 bytes leftover after parsing attributes in process `syz.2.9793'. [ 1605.571283][ T5489] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1605.608588][ T5489] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1605.770998][ T5504] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9796'. [ 1605.929452][ T5506] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1605.972313][ T5506] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1606.005788][ T5506] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1606.023080][ T5506] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1606.057231][ T5506] batman_adv: batadv0: Removing interface: netdevsim0 [ 1607.491146][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.497550][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.997136][ T5551] validate_nla: 5 callbacks suppressed [ 1607.997175][ T5551] netlink: 'syz.4.9814': attribute type 21 has an invalid length. [ 1608.065928][ T5551] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9814'. [ 1608.130376][ T5559] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.9817'. [ 1608.148492][ T5559] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.9817'. [ 1608.178908][ T5559] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.9817'. [ 1608.323031][ T5569] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.9820'. [ 1608.359248][ T5569] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.9820'. [ 1608.402476][ T5577] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.9820'. [ 1608.765428][ T5590] netlink: 'syz.1.9826': attribute type 10 has an invalid length. [ 1608.791533][ T5592] netlink: 'syz.0.9828': attribute type 29 has an invalid length. [ 1608.802403][ T5592] netlink: 'syz.0.9828': attribute type 29 has an invalid length. [ 1608.823193][ T5592] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.9828'. [ 1609.040761][ T5598] device ip6gretap0 left promiscuous mode [ 1609.052247][ T5598] bridge0: port 3(ip6gretap0) entered disabled state [ 1609.077671][ T5598] device bridge_slave_1 left promiscuous mode [ 1609.135549][ T5598] bridge0: port 2(bridge_slave_1) entered disabled state [ 1609.179524][ T5598] device bridge_slave_0 left promiscuous mode [ 1609.210166][ T5598] bridge0: port 1(bridge_slave_0) entered disabled state [ 1609.528589][ T5611] netlink: 'syz.1.9835': attribute type 12 has an invalid length. [ 1609.997961][ T5630] netlink: 'syz.0.9842': attribute type 21 has an invalid length. [ 1610.076526][ T5632] netlink: 'syz.4.9843': attribute type 10 has an invalid length. [ 1610.193423][ T5632] team0: Port device netdevsim0 removed [ 1611.831408][ T5682] __nla_validate_parse: 3 callbacks suppressed [ 1611.831462][ T5682] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.9858'. [ 1611.876002][ T5685] netlink: 'syz.1.9859': attribute type 10 has an invalid length. [ 1612.012649][ T5690] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1612.197843][ T5703] netlink: 'syz.0.9866': attribute type 21 has an invalid length. [ 1612.230727][ T5703] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9866'. [ 1612.278322][ T5698] netlink: 'syz.2.9864': attribute type 17 has an invalid length. [ 1612.943111][ T5715] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9869'. [ 1613.209959][ T5729] validate_nla: 2 callbacks suppressed [ 1613.209977][ T5729] netlink: 'syz.0.9875': attribute type 29 has an invalid length. [ 1613.284874][ T5729] netlink: 'syz.0.9875': attribute type 3 has an invalid length. [ 1613.297589][ T5729] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9875'. [ 1613.338067][ T5729] FAULT_INJECTION: forcing a failure. [ 1613.338067][ T5729] name failslab, interval 1, probability 0, space 0, times 0 [ 1613.357820][ T5729] CPU: 0 PID: 5729 Comm: syz.0.9875 Not tainted syzkaller #0 [ 1613.365259][ T5729] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1613.375413][ T5729] Call Trace: [ 1613.378707][ T5729] [ 1613.381655][ T5729] dump_stack_lvl+0x188/0x24e [ 1613.386361][ T5729] ? show_regs_print_info+0x12/0x12 [ 1613.391589][ T5729] ? load_image+0x400/0x400 [ 1613.396122][ T5729] ? kasan_set_track+0x60/0x70 [ 1613.400899][ T5729] ? kasan_set_track+0x4b/0x70 [ 1613.405680][ T5729] ? __kasan_slab_alloc+0x6b/0x80 [ 1613.410724][ T5729] ? slab_post_alloc_hook+0x4b/0x480 [ 1613.416037][ T5729] should_fail_ex+0x399/0x4d0 [ 1613.420726][ T5729] should_failslab+0x5/0x20 [ 1613.425242][ T5729] slab_pre_alloc_hook+0x59/0x310 [ 1613.430274][ T5729] ? ref_tracker_alloc+0x14e/0x4b0 [ 1613.435575][ T5729] __kmem_cache_alloc_node+0x4f/0x260 [ 1613.440959][ T5729] ? ref_tracker_alloc+0x14e/0x4b0 [ 1613.446081][ T5729] kmalloc_trace+0x26/0xe0 [ 1613.450547][ T5729] ref_tracker_alloc+0x14e/0x4b0 [ 1613.455490][ T5729] ? ref_tracker_dir_print+0x150/0x150 [ 1613.460958][ T5729] ? __kasan_slab_alloc+0x6b/0x80 [ 1613.465986][ T5729] ? slab_post_alloc_hook+0x67/0x480 [ 1613.471265][ T5729] ? slab_pre_alloc_hook+0x59/0x310 [ 1613.476459][ T5729] dst_init+0xda/0x410 [ 1613.480528][ T5729] dst_alloc+0x12a/0x160 [ 1613.484770][ T5729] ip_route_input_rcu+0x2055/0x3160 [ 1613.489969][ T5729] ? ip_route_input_noref+0x270/0x270 [ 1613.495358][ T5729] inet_rtm_getroute+0x1012/0x2810 [ 1613.500471][ T5729] ? inet_rtm_getroute+0xdc8/0x2810 [ 1613.505670][ T5729] ? ip_rt_multicast_event+0x80/0x80 [ 1613.510982][ T5729] ? __lock_acquire+0x7d10/0x7d10 [ 1613.516030][ T5729] ? ip_rt_multicast_event+0x80/0x80 [ 1613.521313][ T5729] ? rtnetlink_rcv_msg+0x226/0xfc0 [ 1613.526432][ T5729] ? ip_rt_multicast_event+0x80/0x80 [ 1613.531754][ T5729] rtnetlink_rcv_msg+0x8cc/0xfc0 [ 1613.536787][ T5729] ? rtnetlink_bind+0x80/0x80 [ 1613.541480][ T5729] ? mark_lock+0x94/0x320 [ 1613.545813][ T5729] ? __lock_acquire+0x12f4/0x7d10 [ 1613.550853][ T5729] ? verify_lock_unused+0x140/0x140 [ 1613.556049][ T5729] ? netlink_sendmsg+0x654/0xbd0 [ 1613.560989][ T5729] ? verify_lock_unused+0x140/0x140 [ 1613.566205][ T5729] netlink_rcv_skb+0x1fb/0x450 [ 1613.570969][ T5729] ? rtnetlink_bind+0x80/0x80 [ 1613.575646][ T5729] ? netlink_ack+0x1170/0x1170 [ 1613.580414][ T5729] ? netlink_deliver_tap+0x2e/0x1b0 [ 1613.585617][ T5729] netlink_unicast+0x74d/0x8d0 [ 1613.590387][ T5729] netlink_sendmsg+0x8ad/0xbd0 [ 1613.595153][ T5729] ? netlink_getsockopt+0x550/0x550 [ 1613.600350][ T5729] ? aa_sock_msg_perm+0x94/0x150 [ 1613.605282][ T5729] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 1613.610559][ T5729] ? security_socket_sendmsg+0x7c/0xa0 [ 1613.616019][ T5729] ? netlink_getsockopt+0x550/0x550 [ 1613.621218][ T5729] ____sys_sendmsg+0x5be/0x970 [ 1613.625989][ T5729] ? __sys_sendmsg_sock+0x30/0x30 [ 1613.631011][ T5729] ? __import_iovec+0x315/0x500 [ 1613.635869][ T5729] ? import_iovec+0x6f/0xa0 [ 1613.640369][ T5729] ___sys_sendmsg+0x2a2/0x360 [ 1613.645052][ T5729] ? __sys_sendmsg+0x290/0x290 [ 1613.649833][ T5729] ? __lock_acquire+0x7d10/0x7d10 [ 1613.654892][ T5729] __se_sys_sendmsg+0x1bb/0x2a0 [ 1613.659751][ T5729] ? __x64_sys_sendmsg+0x80/0x80 [ 1613.664702][ T5729] ? lockdep_hardirqs_on+0x94/0x140 [ 1613.669907][ T5729] do_syscall_64+0x4c/0xa0 [ 1613.674327][ T5729] ? clear_bhb_loop+0x60/0xb0 [ 1613.678998][ T5729] ? clear_bhb_loop+0x60/0xb0 [ 1613.683672][ T5729] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1613.689565][ T5729] RIP: 0033:0x7f5a7dd9c799 [ 1613.693975][ T5729] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1613.713578][ T5729] RSP: 002b:00007f5a7eb71028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1613.721992][ T5729] RAX: ffffffffffffffda RBX: 00007f5a7e015fa0 RCX: 00007f5a7dd9c799 [ 1613.729958][ T5729] RDX: 0000000020000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1613.737923][ T5729] RBP: 00007f5a7eb71090 R08: 0000000000000000 R09: 0000000000000000 [ 1613.745890][ T5729] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1613.753865][ T5729] R13: 00007f5a7e016038 R14: 00007f5a7e015fa0 R15: 00007ffe39657528 [ 1613.761846][ T5729] [ 1613.956854][ T5739] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.9879'. [ 1613.997256][ T5734] netlink: 'syz.2.9876': attribute type 10 has an invalid length. [ 1614.154781][ T5729] memory allocation failure, unreliable refcount tracker. [ 1614.391804][ T5742] netlink: 'syz.0.9880': attribute type 3 has an invalid length. [ 1614.400641][ T5742] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9880'. [ 1614.608216][ T5749] netlink: 194236 bytes leftover after parsing attributes in process `syz.2.9882'. [ 1614.620852][ T5749] netlink: zone id is out of range [ 1614.626457][ T5749] netlink: zone id is out of range [ 1614.631856][ T5749] netlink: zone id is out of range [ 1614.640641][ T5749] netlink: get zone limit has 8 unknown bytes [ 1614.649401][ T5751] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.9883'. [ 1614.659446][ T5751] bridge_slave_1: default FDB implementation only supports local addresses [ 1614.846329][ T5760] netlink: 'syz.1.9886': attribute type 21 has an invalid length. [ 1614.868211][ T5760] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9886'. [ 1615.080442][ T5771] netlink: 'syz.4.9890': attribute type 7 has an invalid length. [ 1615.165185][ T5773] netlink: 'syz.3.9892': attribute type 10 has an invalid length. [ 1615.972019][ T5791] netlink: 'syz.2.9897': attribute type 12 has an invalid length. [ 1615.987104][ T5791] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9897'. [ 1616.476631][ T5809] netlink: 'syz.1.9905': attribute type 10 has an invalid length. [ 1616.765106][ T5818] netlink: 'syz.3.9908': attribute type 21 has an invalid length. [ 1616.942058][ T5826] __nla_validate_parse: 2 callbacks suppressed [ 1616.942075][ T5826] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.9909'. [ 1617.313664][ T5844] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.9914'. [ 1617.334083][ T5844] netlink: 16098 bytes leftover after parsing attributes in process `syz.2.9914'. [ 1618.143781][ T5882] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9932'. [ 1618.145239][ T5879] netlink: 170140 bytes leftover after parsing attributes in process `syz.0.9930'. [ 1618.289271][ T5887] validate_nla: 11 callbacks suppressed [ 1618.289292][ T5887] netlink: 'syz.3.9933': attribute type 10 has an invalid length. [ 1618.373388][ T5894] FAULT_INJECTION: forcing a failure. [ 1618.373388][ T5894] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1618.415653][ T5894] CPU: 1 PID: 5894 Comm: syz.2.9935 Not tainted syzkaller #0 [ 1618.423087][ T5894] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1618.433148][ T5894] Call Trace: [ 1618.436434][ T5894] [ 1618.439365][ T5894] dump_stack_lvl+0x188/0x24e [ 1618.444059][ T5894] ? show_regs_print_info+0x12/0x12 [ 1618.449263][ T5894] ? load_image+0x400/0x400 [ 1618.453770][ T5894] ? __lock_acquire+0x7d10/0x7d10 [ 1618.458796][ T5894] ? perf_trace_run_bpf_submit+0xf3/0x1c0 [ 1618.464527][ T5894] should_fail_ex+0x399/0x4d0 [ 1618.469301][ T5894] _copy_from_user+0x2c/0x170 [ 1618.473982][ T5894] ___sys_sendmsg+0x1c3/0x360 [ 1618.478671][ T5894] ? __sys_sendmsg+0x290/0x290 [ 1618.483470][ T5894] ? __lock_acquire+0x7d10/0x7d10 [ 1618.488536][ T5894] __se_sys_sendmsg+0x1bb/0x2a0 [ 1618.493394][ T5894] ? __x64_sys_sendmsg+0x80/0x80 [ 1618.498360][ T5894] ? lockdep_hardirqs_on+0x94/0x140 [ 1618.503566][ T5894] do_syscall_64+0x4c/0xa0 [ 1618.507985][ T5894] ? clear_bhb_loop+0x60/0xb0 [ 1618.512663][ T5894] ? clear_bhb_loop+0x60/0xb0 [ 1618.517346][ T5894] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1618.523243][ T5894] RIP: 0033:0x7ff39839c799 [ 1618.527666][ T5894] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1618.547391][ T5894] RSP: 002b:00007ff399234028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1618.555812][ T5894] RAX: ffffffffffffffda RBX: 00007ff398615fa0 RCX: 00007ff39839c799 [ 1618.563790][ T5894] RDX: 0000000000008000 RSI: 0000200000000940 RDI: 0000000000000004 [ 1618.571759][ T5894] RBP: 00007ff399234090 R08: 0000000000000000 R09: 0000000000000000 [ 1618.579730][ T5894] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1618.587699][ T5894] R13: 00007ff398616038 R14: 00007ff398615fa0 R15: 00007ffe4b127048 [ 1618.595692][ T5894] [ 1618.732591][ T5902] netlink: 'syz.4.9939': attribute type 21 has an invalid length. [ 1618.749824][ T5902] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9939'. [ 1618.974039][ T5918] netlink: 'syz.2.9943': attribute type 29 has an invalid length. [ 1619.139743][ T5921] IPv6: Can't replace route, no match found [ 1619.158122][ T5921] mac80211_hwsim hwsim131 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1619.189851][ T5923] netlink: 'syz.3.9946': attribute type 27 has an invalid length. [ 1619.358896][ T5923] bond0: (slave bond_slave_0): Releasing backup interface [ 1619.463141][ T5925] netlink: 'syz.1.9947': attribute type 10 has an invalid length. [ 1619.473986][ T5931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9945'. [ 1619.920567][ T5940] tipc: Started in network mode [ 1619.927442][ T5940] tipc: Node identity 9215a268, cluster identity 4711 [ 1619.934275][ T5940] tipc: Node number set to 2450891368 [ 1620.362572][ T5955] netlink: 'syz.3.9957': attribute type 21 has an invalid length. [ 1620.407293][ T5955] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9957'. [ 1620.455194][ T5959] netlink: 'syz.1.9959': attribute type 10 has an invalid length. [ 1620.471422][ T5959] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9959'. [ 1620.492355][ T5959] device dummy0 entered promiscuous mode [ 1620.532585][ T5959] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1620.579764][ T5962] netlink: 'syz.4.9960': attribute type 10 has an invalid length. [ 1621.107127][ T5982] netlink: 'syz.1.9963': attribute type 2 has an invalid length. [ 1621.181617][ T5982] netlink: 182908 bytes leftover after parsing attributes in process `syz.1.9963'. [ 1622.255368][ T6013] netlink: 'syz.4.9974': attribute type 10 has an invalid length. [ 1622.289052][ T6015] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9973'. [ 1622.633767][ T6025] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.9977'. [ 1622.941647][ T6030] netlink: 146340 bytes leftover after parsing attributes in process `syz.2.9978'. [ 1622.954122][ T6030] openvswitch: netlink: Key type 386 is out of range max 32 [ 1623.443979][ T6036] validate_nla: 1 callbacks suppressed [ 1623.444018][ T6036] netlink: 'syz.0.9980': attribute type 21 has an invalid length. [ 1623.495162][ T6036] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9980'. [ 1623.838451][ T6051] netlink: 'syz.2.9986': attribute type 10 has an invalid length. [ 1624.112330][ T6064] FAULT_INJECTION: forcing a failure. [ 1624.112330][ T6064] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1624.128358][ T6064] CPU: 0 PID: 6064 Comm: syz.3.9990 Not tainted syzkaller #0 [ 1624.135783][ T6064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1624.145856][ T6064] Call Trace: [ 1624.149150][ T6064] [ 1624.152091][ T6064] dump_stack_lvl+0x188/0x24e [ 1624.156802][ T6064] ? show_regs_print_info+0x12/0x12 [ 1624.162017][ T6064] ? load_image+0x400/0x400 [ 1624.166539][ T6064] ? __lock_acquire+0x7d10/0x7d10 [ 1624.171595][ T6064] should_fail_ex+0x399/0x4d0 [ 1624.176301][ T6064] _copy_from_user+0x2c/0x170 [ 1624.181006][ T6064] ___sys_sendmsg+0x1c3/0x360 [ 1624.185798][ T6064] ? __sys_sendmsg+0x290/0x290 [ 1624.190600][ T6064] ? __lock_acquire+0x7d10/0x7d10 [ 1624.195690][ T6064] __se_sys_sendmsg+0x1bb/0x2a0 [ 1624.200589][ T6064] ? __x64_sys_sendmsg+0x80/0x80 [ 1624.205564][ T6064] ? lockdep_hardirqs_on+0x94/0x140 [ 1624.210779][ T6064] do_syscall_64+0x4c/0xa0 [ 1624.215212][ T6064] ? clear_bhb_loop+0x60/0xb0 [ 1624.219904][ T6064] ? clear_bhb_loop+0x60/0xb0 [ 1624.224609][ T6064] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1624.230537][ T6064] RIP: 0033:0x7fea1119c799 [ 1624.234989][ T6064] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1624.254698][ T6064] RSP: 002b:00007fea1211a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1624.263143][ T6064] RAX: ffffffffffffffda RBX: 00007fea11415fa0 RCX: 00007fea1119c799 [ 1624.271138][ T6064] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1624.279131][ T6064] RBP: 00007fea1211a090 R08: 0000000000000000 R09: 0000000000000000 [ 1624.287119][ T6064] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1624.295107][ T6064] R13: 00007fea11416038 R14: 00007fea11415fa0 R15: 00007ffcccaace98 [ 1624.303111][ T6064] [ 1624.492173][ T6075] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9993'. [ 1624.502374][ T6075] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9993'. [ 1624.530874][ T6075] netlink: 60 bytes leftover after parsing attributes in process `syz.3.9993'. [ 1624.915255][T13866] Bluetooth: hci2: command 0x0406 tx timeout [ 1624.962320][ T6093] netlink: 'syz.0.10001': attribute type 10 has an invalid length. [ 1625.174491][ T6099] netlink: 'syz.2.10003': attribute type 29 has an invalid length. [ 1625.188735][ T6099] netlink: 'syz.2.10003': attribute type 29 has an invalid length. [ 1625.229741][ T6099] netlink: 'syz.2.10003': attribute type 29 has an invalid length. [ 1625.290963][ T6106] netlink: 'syz.4.10007': attribute type 21 has an invalid length. [ 1625.303135][ T6106] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10007'. [ 1625.412335][ T6109] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10008'. [ 1625.462090][ T6109] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10008'. [ 1625.583830][ T6115] netlink: 'syz.3.10010': attribute type 27 has an invalid length. [ 1626.112667][ T6131] netlink: 'syz.1.10016': attribute type 10 has an invalid length. [ 1627.352626][ T6155] netlink: 'syz.4.10027': attribute type 21 has an invalid length. [ 1627.371690][ T6155] __nla_validate_parse: 2 callbacks suppressed [ 1627.371728][ T6155] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10027'. [ 1628.487498][ T6194] validate_nla: 2 callbacks suppressed [ 1628.487516][ T6194] netlink: 'syz.2.10042': attribute type 10 has an invalid length. [ 1628.915562][ T6211] netlink: 'syz.3.10048': attribute type 9 has an invalid length. [ 1629.336722][ T6226] netlink: 40 bytes leftover after parsing attributes in process `syz.4.10054'. [ 1629.442275][ T6228] netlink: 'syz.4.10054': attribute type 29 has an invalid length. [ 1629.650239][ T6223] netlink: 'syz.2.10053': attribute type 21 has an invalid length. [ 1629.682158][ T6223] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10053'. [ 1629.731428][ T6228] netlink: 'syz.4.10054': attribute type 29 has an invalid length. [ 1629.755772][ T6233] netlink: 'syz.4.10054': attribute type 29 has an invalid length. [ 1629.904406][ T6238] netlink: 'syz.0.10057': attribute type 10 has an invalid length. [ 1630.170568][ T6245] netlink: 168 bytes leftover after parsing attributes in process `syz.3.10060'. [ 1630.195833][ T6242] netlink: 14719 bytes leftover after parsing attributes in process `syz.1.10059'. [ 1630.443613][ T6248] netlink: 'syz.4.10061': attribute type 29 has an invalid length. [ 1630.463160][ T6248] netlink: 'syz.4.10061': attribute type 29 has an invalid length. [ 1630.547867][ T6248] netlink: 'syz.4.10061': attribute type 29 has an invalid length. [ 1630.844075][ T6273] FAULT_INJECTION: forcing a failure. [ 1630.844075][ T6273] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1630.861006][ T6273] CPU: 0 PID: 6273 Comm: syz.4.10070 Not tainted syzkaller #0 [ 1630.868518][ T6273] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1630.875708][ T6274] netlink: 180 bytes leftover after parsing attributes in process `syz.3.10071'. [ 1630.878574][ T6273] Call Trace: [ 1630.878585][ T6273] [ 1630.878593][ T6273] dump_stack_lvl+0x188/0x24e [ 1630.878626][ T6273] ? show_regs_print_info+0x12/0x12 [ 1630.878649][ T6273] ? load_image+0x400/0x400 [ 1630.878673][ T6273] ? __lock_acquire+0x7d10/0x7d10 [ 1630.878704][ T6273] should_fail_ex+0x399/0x4d0 [ 1630.878729][ T6273] _copy_from_user+0x2c/0x170 [ 1630.922992][ T6273] ___sys_sendmsg+0x1c3/0x360 [ 1630.927716][ T6273] ? __sys_sendmsg+0x290/0x290 [ 1630.932533][ T6273] ? __lock_acquire+0x7d10/0x7d10 [ 1630.937614][ T6273] __se_sys_sendmsg+0x1bb/0x2a0 [ 1630.942498][ T6273] ? __x64_sys_sendmsg+0x80/0x80 [ 1630.947483][ T6273] ? lockdep_hardirqs_on+0x94/0x140 [ 1630.952718][ T6273] do_syscall_64+0x4c/0xa0 [ 1630.957166][ T6273] ? clear_bhb_loop+0x60/0xb0 [ 1630.961870][ T6273] ? clear_bhb_loop+0x60/0xb0 [ 1630.966586][ T6273] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1630.972511][ T6273] RIP: 0033:0x7fe753f9c799 [ 1630.976952][ T6273] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1630.996588][ T6273] RSP: 002b:00007fe754eb4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1631.005038][ T6273] RAX: ffffffffffffffda RBX: 00007fe754215fa0 RCX: 00007fe753f9c799 [ 1631.013033][ T6273] RDX: 0000000004004000 RSI: 0000200000000180 RDI: 0000000000000009 [ 1631.021010][ T6273] RBP: 00007fe754eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1631.028982][ T6273] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1631.036953][ T6273] R13: 00007fe754216038 R14: 00007fe754215fa0 R15: 00007ffe830ebd28 [ 1631.044933][ T6273] [ 1631.183377][ T6281] netlink: 116376 bytes leftover after parsing attributes in process `syz.3.10073'. [ 1631.300590][ T6285] netlink: 180 bytes leftover after parsing attributes in process `syz.3.10074'. [ 1631.428414][ T6286] delete_channel: no stack [ 1631.548460][ T6290] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10076'. [ 1631.649789][ T6292] tap0: tun_chr_ioctl cmd 1074025677 [ 1631.679357][ T6292] tap0: linktype set to 0 [ 1631.697713][ T6292] tap0: tun_chr_ioctl cmd 2148553947 [ 1631.727337][ T6292] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10078'. [ 1632.695129][ T6321] device geneve0 entered promiscuous mode [ 1632.708479][ T6321] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 1632.851932][ T6331] device hsr0 entered promiscuous mode [ 1632.861085][ T6331] bond0: (slave hsr0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1632.992222][ T6339] __nla_validate_parse: 4 callbacks suppressed [ 1632.992241][ T6339] netlink: 11562 bytes leftover after parsing attributes in process `syz.3.10090'. [ 1633.037755][ T6341] netlink: 68 bytes leftover after parsing attributes in process `syz.0.10092'. [ 1633.430502][ T6355] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10098'. [ 1633.459890][ T6353] bond0: (slave bond_slave_0): Releasing backup interface [ 1633.707464][ T6362] validate_nla: 12 callbacks suppressed [ 1633.707483][ T6362] netlink: 'syz.2.10100': attribute type 10 has an invalid length. [ 1633.796916][ T6368] netlink: 'syz.0.10102': attribute type 11 has an invalid length. [ 1633.805651][ T6368] netlink: 140 bytes leftover after parsing attributes in process `syz.0.10102'. [ 1635.239668][ T6405] FAULT_INJECTION: forcing a failure. [ 1635.239668][ T6405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1635.274784][ T6405] CPU: 1 PID: 6405 Comm: syz.2.10113 Not tainted syzkaller #0 [ 1635.282310][ T6405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1635.292393][ T6405] Call Trace: [ 1635.295694][ T6405] [ 1635.298647][ T6405] dump_stack_lvl+0x188/0x24e [ 1635.303352][ T6405] ? show_regs_print_info+0x12/0x12 [ 1635.308559][ T6405] ? load_image+0x400/0x400 [ 1635.313075][ T6405] ? __lock_acquire+0x7d10/0x7d10 [ 1635.318108][ T6405] ? snprintf+0xe5/0x140 [ 1635.322355][ T6405] should_fail_ex+0x399/0x4d0 [ 1635.327056][ T6405] _copy_to_user+0x2c/0x130 [ 1635.331588][ T6405] simple_read_from_buffer+0xe3/0x150 [ 1635.336985][ T6405] proc_fail_nth_read+0x1a6/0x220 [ 1635.342015][ T6405] ? proc_fault_inject_write+0x310/0x310 [ 1635.347655][ T6405] ? fsnotify_perm+0x248/0x550 [ 1635.352424][ T6405] ? proc_fault_inject_write+0x310/0x310 [ 1635.358056][ T6405] vfs_read+0x2de/0xa00 [ 1635.362222][ T6405] ? kernel_read+0x1e0/0x1e0 [ 1635.366990][ T6405] ? __fget_files+0x28/0x4b0 [ 1635.371580][ T6405] ? __fget_files+0x28/0x4b0 [ 1635.376173][ T6405] ? __fget_files+0x43d/0x4b0 [ 1635.380868][ T6405] ? __fdget_pos+0x2ae/0x360 [ 1635.385462][ T6405] ? ksys_read+0x71/0x250 [ 1635.389804][ T6405] ksys_read+0x14c/0x250 [ 1635.394077][ T6405] ? vfs_write+0xa30/0xa30 [ 1635.398519][ T6405] ? lockdep_hardirqs_on+0x94/0x140 [ 1635.403728][ T6405] do_syscall_64+0x4c/0xa0 [ 1635.408156][ T6405] ? clear_bhb_loop+0x60/0xb0 [ 1635.412856][ T6405] ? clear_bhb_loop+0x60/0xb0 [ 1635.417541][ T6405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1635.423435][ T6405] RIP: 0033:0x7ff39835cfce [ 1635.427851][ T6405] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1635.447491][ T6405] RSP: 002b:00007ff399233fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1635.455906][ T6405] RAX: ffffffffffffffda RBX: 00007ff3992346c0 RCX: 00007ff39835cfce [ 1635.463880][ T6405] RDX: 000000000000000f RSI: 00007ff3992340a0 RDI: 0000000000000005 [ 1635.471851][ T6405] RBP: 00007ff399234090 R08: 0000000000000000 R09: 0000000000000000 [ 1635.479823][ T6405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1635.487794][ T6405] R13: 00007ff398616038 R14: 00007ff398615fa0 R15: 00007ffe4b127048 [ 1635.495783][ T6405] [ 1635.599652][ T6412] netlink: 'syz.3.10115': attribute type 10 has an invalid length. [ 1636.002195][ T6429] netlink: 463 bytes leftover after parsing attributes in process `syz.2.10118'. [ 1636.137880][ T6431] netlink: 'syz.1.10121': attribute type 21 has an invalid length. [ 1636.151871][ T6418] can: request_module (can-proto-3) failed. [ 1636.161836][ T6431] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10121'. [ 1636.163170][ T6433] netlink: 'syz.4.10122': attribute type 46 has an invalid length. [ 1636.173848][ T6435] netlink: 14 bytes leftover after parsing attributes in process `syz.3.10123'. [ 1636.240650][ T6433] netlink: 'syz.4.10122': attribute type 46 has an invalid length. [ 1636.540535][ T6453] netlink: 'syz.3.10129': attribute type 10 has an invalid length. [ 1636.597990][ T6455] FAULT_INJECTION: forcing a failure. [ 1636.597990][ T6455] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1636.616265][ T6455] CPU: 0 PID: 6455 Comm: syz.2.10130 Not tainted syzkaller #0 [ 1636.623770][ T6455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1636.633836][ T6455] Call Trace: [ 1636.637123][ T6455] [ 1636.640074][ T6455] dump_stack_lvl+0x188/0x24e [ 1636.644773][ T6455] ? show_regs_print_info+0x12/0x12 [ 1636.649998][ T6455] ? load_image+0x400/0x400 [ 1636.654505][ T6455] ? __lock_acquire+0x7d10/0x7d10 [ 1636.659542][ T6455] ? snprintf+0xe5/0x140 [ 1636.663789][ T6455] should_fail_ex+0x399/0x4d0 [ 1636.668474][ T6455] _copy_to_user+0x2c/0x130 [ 1636.672988][ T6455] simple_read_from_buffer+0xe3/0x150 [ 1636.678374][ T6455] proc_fail_nth_read+0x1a6/0x220 [ 1636.683398][ T6455] ? proc_fault_inject_write+0x310/0x310 [ 1636.689040][ T6455] ? fsnotify_perm+0x248/0x550 [ 1636.693808][ T6455] ? proc_fault_inject_write+0x310/0x310 [ 1636.699452][ T6455] vfs_read+0x2de/0xa00 [ 1636.703631][ T6455] ? kernel_read+0x1e0/0x1e0 [ 1636.708228][ T6455] ? __fget_files+0x28/0x4b0 [ 1636.712817][ T6455] ? __fget_files+0x28/0x4b0 [ 1636.717415][ T6455] ? __fget_files+0x43d/0x4b0 [ 1636.722112][ T6455] ? __fdget_pos+0x2ae/0x360 [ 1636.726707][ T6455] ? ksys_read+0x71/0x250 [ 1636.731128][ T6455] ksys_read+0x14c/0x250 [ 1636.735637][ T6455] ? vfs_write+0xa30/0xa30 [ 1636.740056][ T6455] ? lockdep_hardirqs_on+0x94/0x140 [ 1636.745648][ T6455] do_syscall_64+0x4c/0xa0 [ 1636.750357][ T6455] ? clear_bhb_loop+0x60/0xb0 [ 1636.755221][ T6455] ? clear_bhb_loop+0x60/0xb0 [ 1636.759899][ T6455] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1636.765889][ T6455] RIP: 0033:0x7ff39835cfce [ 1636.770304][ T6455] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1636.790005][ T6455] RSP: 002b:00007ff399233fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1636.798422][ T6455] RAX: ffffffffffffffda RBX: 00007ff3992346c0 RCX: 00007ff39835cfce [ 1636.806390][ T6455] RDX: 000000000000000f RSI: 00007ff3992340a0 RDI: 0000000000000005 [ 1636.814366][ T6455] RBP: 00007ff399234090 R08: 0000000000000000 R09: 0000000000000000 [ 1636.822336][ T6455] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1636.830311][ T6455] R13: 00007ff398616038 R14: 00007ff398615fa0 R15: 00007ffe4b127048 [ 1636.838293][ T6455] [ 1636.862209][ T6457] netlink: 'syz.4.10131': attribute type 12 has an invalid length. [ 1636.874762][ T6457] netlink: 104 bytes leftover after parsing attributes in process `syz.4.10131'. [ 1636.946506][ T6460] netlink: 'syz.2.10132': attribute type 3 has an invalid length. [ 1636.959560][ T6460] netlink: 105116 bytes leftover after parsing attributes in process `syz.2.10132'. [ 1638.957118][ T6500] netlink: 'syz.2.10143': attribute type 10 has an invalid length. [ 1639.225846][ T6506] netlink: 'syz.4.10145': attribute type 21 has an invalid length. [ 1639.258060][ T6506] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10145'. [ 1640.069746][ T6524] netlink: 14 bytes leftover after parsing attributes in process `syz.1.10152'. [ 1640.092863][ T6524] device hsr_slave_0 left promiscuous mode [ 1640.101504][ T6524] device hsr_slave_1 left promiscuous mode [ 1640.207579][ T6525] netlink: 14 bytes leftover after parsing attributes in process `syz.1.10152'. [ 1640.218350][ T6528] netlink: 'syz.0.10153': attribute type 21 has an invalid length. [ 1640.362701][ T6534] netlink: 'syz.4.10155': attribute type 11 has an invalid length. [ 1640.691737][ T6547] device wlan1 entered promiscuous mode [ 1640.733765][ T6540] netlink: 'syz.4.10155': attribute type 10 has an invalid length. [ 1640.791602][ T6540] team0: Device ipvlan1 failed to register rx_handler [ 1640.910220][ T6557] netlink: 'syz.2.10162': attribute type 29 has an invalid length. [ 1640.924590][ T6557] netlink: 'syz.2.10162': attribute type 29 has an invalid length. [ 1641.046115][ T6561] netlink: 'syz.1.10164': attribute type 21 has an invalid length. [ 1641.065101][ T6561] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10164'. [ 1641.182482][ T6570] FAULT_INJECTION: forcing a failure. [ 1641.182482][ T6570] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1641.212740][ T6570] CPU: 0 PID: 6570 Comm: syz.3.10167 Not tainted syzkaller #0 [ 1641.220261][ T6570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1641.230348][ T6570] Call Trace: [ 1641.233643][ T6570] [ 1641.236582][ T6570] dump_stack_lvl+0x188/0x24e [ 1641.241282][ T6570] ? show_regs_print_info+0x12/0x12 [ 1641.246505][ T6570] ? load_image+0x400/0x400 [ 1641.251029][ T6570] ? __lock_acquire+0x7d10/0x7d10 [ 1641.256083][ T6570] should_fail_ex+0x399/0x4d0 [ 1641.260783][ T6570] _copy_to_user+0x2c/0x130 [ 1641.265313][ T6570] __htab_map_lookup_and_delete_batch+0x1e79/0x2060 [ 1641.271958][ T6570] ? lookup_nulls_elem_raw+0x160/0x160 [ 1641.277455][ T6570] ? __fdget+0x17c/0x200 [ 1641.281746][ T6570] ? htab_lru_percpu_map_lookup_and_delete_elem+0x40/0x40 [ 1641.288890][ T6570] bpf_map_do_batch+0x466/0x600 [ 1641.293789][ T6570] __sys_bpf+0x6f7/0x780 [ 1641.298061][ T6570] ? bpf_link_show_fdinfo+0x380/0x380 [ 1641.303478][ T6570] ? lock_chain_count+0x20/0x20 [ 1641.308365][ T6570] __x64_sys_bpf+0x78/0x90 [ 1641.312834][ T6570] do_syscall_64+0x4c/0xa0 [ 1641.317357][ T6570] ? clear_bhb_loop+0x60/0xb0 [ 1641.322060][ T6570] ? clear_bhb_loop+0x60/0xb0 [ 1641.326762][ T6570] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1641.332674][ T6570] RIP: 0033:0x7fea1119c799 [ 1641.337138][ T6570] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1641.356769][ T6570] RSP: 002b:00007fea120f9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1641.365211][ T6570] RAX: ffffffffffffffda RBX: 00007fea11416090 RCX: 00007fea1119c799 [ 1641.373202][ T6570] RDX: 0000000000000038 RSI: 0000200000000600 RDI: 0000000000000019 [ 1641.381207][ T6570] RBP: 00007fea120f9090 R08: 0000000000000000 R09: 0000000000000000 [ 1641.389209][ T6570] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1641.397295][ T6570] R13: 00007fea11416128 R14: 00007fea11416090 R15: 00007ffcccaace98 [ 1641.405304][ T6570] [ 1641.913074][ T6583] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1642.096340][ T6587] device syzkaller0 entered promiscuous mode [ 1642.281639][ T6601] netlink: 'syz.3.10175': attribute type 4 has an invalid length. [ 1642.305512][ T6601] netlink: 152 bytes leftover after parsing attributes in process `syz.3.10175'. [ 1642.339916][ T6601] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1642.401192][ T6607] FAULT_INJECTION: forcing a failure. [ 1642.401192][ T6607] name failslab, interval 1, probability 0, space 0, times 0 [ 1642.414102][ T6607] CPU: 0 PID: 6607 Comm: syz.4.10177 Not tainted syzkaller #0 [ 1642.421600][ T6607] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1642.431767][ T6607] Call Trace: [ 1642.435075][ T6607] [ 1642.438039][ T6607] dump_stack_lvl+0x188/0x24e [ 1642.442739][ T6607] ? show_regs_print_info+0x12/0x12 [ 1642.447938][ T6607] ? load_image+0x400/0x400 [ 1642.452448][ T6607] ? __might_sleep+0xd0/0xd0 [ 1642.457033][ T6607] ? __lock_acquire+0x7d10/0x7d10 [ 1642.462061][ T6607] ? perf_lock_task_context+0x875/0x9b0 [ 1642.467628][ T6607] should_fail_ex+0x399/0x4d0 [ 1642.472370][ T6607] should_failslab+0x5/0x20 [ 1642.476880][ T6607] slab_pre_alloc_hook+0x59/0x310 [ 1642.481940][ T6607] ? perf_event_exit_event+0x210/0x210 [ 1642.487395][ T6607] ? alloc_perf_context+0x53/0x2d0 [ 1642.492511][ T6607] __kmem_cache_alloc_node+0x4f/0x260 [ 1642.497885][ T6607] ? alloc_perf_context+0x53/0x2d0 [ 1642.502997][ T6607] kmalloc_trace+0x26/0xe0 [ 1642.507424][ T6607] alloc_perf_context+0x53/0x2d0 [ 1642.512370][ T6607] find_get_context+0x337/0x950 [ 1642.517237][ T6607] ? find_lively_task_by_vpid+0x19/0x290 [ 1642.522876][ T6607] __se_sys_perf_event_open+0x925/0x1ec0 [ 1642.528512][ T6607] ? __fget_files+0x43d/0x4b0 [ 1642.533370][ T6607] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 1642.539039][ T6607] ? lockdep_hardirqs_on+0x94/0x140 [ 1642.544233][ T6607] ? __x64_sys_perf_event_open+0x1c/0xc0 [ 1642.549870][ T6607] do_syscall_64+0x4c/0xa0 [ 1642.554288][ T6607] ? clear_bhb_loop+0x60/0xb0 [ 1642.558968][ T6607] ? clear_bhb_loop+0x60/0xb0 [ 1642.563660][ T6607] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1642.569552][ T6607] RIP: 0033:0x7fe753f9c799 [ 1642.573962][ T6607] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1642.593569][ T6607] RSP: 002b:00007fe754eb4028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1642.601992][ T6607] RAX: ffffffffffffffda RBX: 00007fe754215fa0 RCX: 00007fe753f9c799 [ 1642.609964][ T6607] RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000140 [ 1642.617931][ T6607] RBP: 00007fe754eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1642.625987][ T6607] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1642.633953][ T6607] R13: 00007fe754216038 R14: 00007fe754215fa0 R15: 00007ffe830ebd28 [ 1642.641935][ T6607] [ 1643.667280][ T6622] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10183'. [ 1646.236394][ T6604] netlink: 'syz.1.10178': attribute type 4 has an invalid length. [ 1646.245645][ T6622] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10183'. [ 1646.264915][ T6632] netlink: 'syz.4.10185': attribute type 21 has an invalid length. [ 1646.272910][ T6632] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10185'. [ 1646.666601][ T6656] netlink: 'syz.1.10194': attribute type 3 has an invalid length. [ 1646.676098][ T6656] netlink: 105116 bytes leftover after parsing attributes in process `syz.1.10194'. [ 1646.951767][ T6673] netlink: 'syz.1.10202': attribute type 21 has an invalid length. [ 1646.984970][ T6673] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10202'. [ 1647.008157][ T6674] netlink: 60 bytes leftover after parsing attributes in process `syz.3.10201'. [ 1647.040995][ T6674] netlink: 'syz.3.10201': attribute type 25 has an invalid length. [ 1647.050789][ T6674] netlink: 'syz.3.10201': attribute type 9 has an invalid length. [ 1647.165415][ T6682] netlink: 'syz.4.10205': attribute type 28 has an invalid length. [ 1647.173491][ T6682] netlink: 'syz.4.10205': attribute type 29 has an invalid length. [ 1647.194983][ T6682] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10205'. [ 1647.255148][ T6680] delete_channel: no stack [ 1647.265021][ T6680] delete_channel: no stack [ 1647.461516][ T6690] delete_channel: no stack [ 1647.762628][ T6703] device lo entered promiscuous mode [ 1647.799322][ T6703] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 1648.697260][ T6731] netlink: 'syz.2.10221': attribute type 29 has an invalid length. [ 1648.719221][ T6731] netlink: 'syz.2.10221': attribute type 29 has an invalid length. [ 1649.341185][ T6744] bond0: (slave batadv0): Error: Slave device does not support XDP [ 1652.050193][ T6761] validate_nla: 2 callbacks suppressed [ 1652.050231][ T6761] netlink: 'syz.3.10229': attribute type 10 has an invalid length. [ 1652.112386][ T6767] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1652.123719][ T6767] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1652.134232][ T6767] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1652.145804][ T6767] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1652.165396][ T6767] batman_adv: batadv0: Removing interface: netdevsim0 [ 1655.278092][ T6815] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.10250'. [ 1655.635007][ T1947] Bluetooth: hci5: command 0x0406 tx timeout [ 1656.621957][ T6827] FAULT_INJECTION: forcing a failure. [ 1656.621957][ T6827] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1656.719514][ T6831] netlink: 'syz.0.10254': attribute type 4 has an invalid length. [ 1656.737587][ T6827] CPU: 1 PID: 6827 Comm: syz.2.10253 Not tainted syzkaller #0 [ 1656.745106][ T6827] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1656.755182][ T6827] Call Trace: [ 1656.758493][ T6827] [ 1656.761440][ T6827] dump_stack_lvl+0x188/0x24e [ 1656.766163][ T6827] ? show_regs_print_info+0x12/0x12 [ 1656.771380][ T6827] ? load_image+0x400/0x400 [ 1656.775901][ T6827] ? __lock_acquire+0x7d10/0x7d10 [ 1656.780942][ T6827] ? snprintf+0xed/0x140 [ 1656.785211][ T6827] should_fail_ex+0x399/0x4d0 [ 1656.789914][ T6827] _copy_to_user+0x2c/0x130 [ 1656.794874][ T6827] simple_read_from_buffer+0xe3/0x150 [ 1656.800280][ T6827] proc_fail_nth_read+0x1a6/0x220 [ 1656.805325][ T6827] ? proc_fault_inject_write+0x310/0x310 [ 1656.810980][ T6827] ? vfs_read+0x240/0xa00 [ 1656.815335][ T6827] ? proc_fault_inject_write+0x310/0x310 [ 1656.820990][ T6827] vfs_read+0x2de/0xa00 [ 1656.825173][ T6827] ? kernel_read+0x1e0/0x1e0 [ 1656.829780][ T6827] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1656.836034][ T6827] ? lockdep_hardirqs_on+0x94/0x140 [ 1656.841250][ T6827] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 1656.847442][ T6827] ksys_read+0x14c/0x250 [ 1656.851709][ T6827] ? vfs_write+0xa30/0xa30 [ 1656.856153][ T6827] ? syscall_enter_from_user_mode+0x2a/0x80 [ 1656.862065][ T6827] do_syscall_64+0x4c/0xa0 [ 1656.866516][ T6827] ? clear_bhb_loop+0x60/0xb0 [ 1656.871213][ T6827] ? clear_bhb_loop+0x60/0xb0 [ 1656.875908][ T6827] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1656.881829][ T6827] RIP: 0033:0x7ff39835cfce [ 1656.886262][ T6827] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1656.905890][ T6827] RSP: 002b:00007ff399233fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1656.914322][ T6827] RAX: ffffffffffffffda RBX: 00007ff3992346c0 RCX: 00007ff39835cfce [ 1656.922307][ T6827] RDX: 000000000000000f RSI: 00007ff3992340a0 RDI: 000000000000000c [ 1656.930291][ T6827] RBP: 00007ff399234090 R08: 0000000000000000 R09: 0000000000000000 [ 1656.938276][ T6827] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1656.946271][ T6827] R13: 00007ff398616038 R14: 00007ff398615fa0 R15: 00007ffe4b127048 [ 1656.954290][ T6827] [ 1657.037695][ T6831] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.10254'. [ 1657.579681][ T6840] netlink: 'syz.1.10257': attribute type 4 has an invalid length. [ 1657.675154][ T6840] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.10257'. [ 1657.693020][ T6842] FAULT_INJECTION: forcing a failure. [ 1657.693020][ T6842] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1657.838477][ T6842] CPU: 0 PID: 6842 Comm: syz.4.10256 Not tainted syzkaller #0 [ 1657.846014][ T6842] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1657.856097][ T6842] Call Trace: [ 1657.859402][ T6842] [ 1657.862357][ T6842] dump_stack_lvl+0x188/0x24e [ 1657.867075][ T6842] ? show_regs_print_info+0x12/0x12 [ 1657.872299][ T6842] ? load_image+0x400/0x400 [ 1657.876834][ T6842] ? __lock_acquire+0x7d10/0x7d10 [ 1657.881900][ T6842] should_fail_ex+0x399/0x4d0 [ 1657.886615][ T6842] _copy_from_user+0x2c/0x170 [ 1657.891320][ T6842] ___sys_sendmsg+0x1c3/0x360 [ 1657.896020][ T6842] ? migrate_enable+0x148/0x220 [ 1657.900901][ T6842] ? __sys_sendmsg+0x290/0x290 [ 1657.905711][ T6842] __se_sys_sendmsg+0x1bb/0x2a0 [ 1657.910568][ T6842] ? __x64_sys_sendmsg+0x80/0x80 [ 1657.915520][ T6842] ? syscall_enter_from_user_mode+0x2a/0x80 [ 1657.921505][ T6842] do_syscall_64+0x4c/0xa0 [ 1657.925925][ T6842] ? clear_bhb_loop+0x60/0xb0 [ 1657.930606][ T6842] ? clear_bhb_loop+0x60/0xb0 [ 1657.935280][ T6842] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1657.941172][ T6842] RIP: 0033:0x7fe753f9c799 [ 1657.945671][ T6842] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1657.965714][ T6842] RSP: 002b:00007fe754eb4028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1657.974216][ T6842] RAX: ffffffffffffffda RBX: 00007fe754215fa0 RCX: 00007fe753f9c799 [ 1657.982235][ T6842] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1657.990207][ T6842] RBP: 00007fe754eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1657.998173][ T6842] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1658.006135][ T6842] R13: 00007fe754216038 R14: 00007fe754215fa0 R15: 00007ffe830ebd28 [ 1658.014551][ T6842] [ 1658.591715][ T6874] tap0: tun_chr_ioctl cmd 1074025677 [ 1658.772054][ T6874] tap0: linktype set to 776 [ 1658.995418][ T6874] netlink: 'syz.2.10262': attribute type 1 has an invalid length. [ 1659.060618][ T6874] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10262'. [ 1659.827635][ T6885] netlink: 14 bytes leftover after parsing attributes in process `syz.4.10265'. [ 1660.010093][ T6891] netlink: 'syz.4.10265': attribute type 3 has an invalid length. [ 1660.034158][ T6895] netlink: 180900 bytes leftover after parsing attributes in process `syz.1.10269'. [ 1660.073531][ T6891] netlink: 199836 bytes leftover after parsing attributes in process `syz.4.10265'. [ 1660.092572][ T6895] openvswitch: netlink: Flow actions attr not present in new flow. [ 1660.109762][ T6889] netlink: 'syz.0.10266': attribute type 4 has an invalid length. [ 1660.118918][ T6889] netlink: 152 bytes leftover after parsing attributes in process `syz.0.10266'. [ 1660.157473][ T6889] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1660.215933][ T6895] netlink: 'syz.1.10269': attribute type 2 has an invalid length. [ 1660.297835][ T6895] netlink: 'syz.1.10269': attribute type 8 has an invalid length. [ 1660.326896][ T6895] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10269'. [ 1661.287726][ T6920] netlink: 'syz.1.10277': attribute type 11 has an invalid length. [ 1661.326455][ T6920] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.10277'. [ 1661.436781][ T6925] netlink: 'syz.2.10279': attribute type 21 has an invalid length. [ 1662.090794][ T6919] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1662.368607][ T6930] netlink: 'syz.3.10281': attribute type 28 has an invalid length. [ 1662.378664][ T6930] netlink: 'syz.3.10281': attribute type 29 has an invalid length. [ 1662.420597][ T6930] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10281'. [ 1662.453617][ T6941] netlink: 'syz.3.10281': attribute type 10 has an invalid length. [ 1662.485489][ T6941] netlink: 55 bytes leftover after parsing attributes in process `syz.3.10281'. [ 1663.459916][ T6962] netlink: 'syz.0.10288': attribute type 13 has an invalid length. [ 1663.470257][ T6962] netlink: 152 bytes leftover after parsing attributes in process `syz.0.10288'. [ 1663.500179][ T6962] erspan0: refused to change device tx_queue_len [ 1663.517719][ T6962] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1664.560501][ T6996] netlink: 'syz.3.10296': attribute type 3 has an invalid length. [ 1664.571052][ T6996] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10296'. [ 1667.563726][ T7055] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10317'. [ 1668.308272][ T7017] netlink: 'syz.3.10305': attribute type 33 has an invalid length. [ 1668.316560][ T7017] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10305'. [ 1668.366366][ T7055] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10317'. [ 1668.394991][ T7056] netlink: 60 bytes leftover after parsing attributes in process `syz.0.10317'. [ 1668.638946][ T7066] netlink: 'syz.0.10322': attribute type 41 has an invalid length. [ 1668.674225][ T7066] netlink: 40 bytes leftover after parsing attributes in process `syz.0.10322'. [ 1668.684434][ T7066] A link change request failed with some changes committed already. Interface hsr_slave_1 may have been left with an inconsistent configuration, please check. [ 1668.941082][ T7070] netlink: 129384 bytes leftover after parsing attributes in process `syz.4.10324'. [ 1668.949293][ T1278] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.956882][ T1278] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.051505][ T7077] netlink: 'syz.1.10327': attribute type 21 has an invalid length. [ 1669.064784][ T7077] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10327'. [ 1669.571749][ T7097] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10334'. [ 1669.702594][ T7103] netlink: 'syz.2.10335': attribute type 21 has an invalid length. [ 1669.724761][ T7103] IPv6: NLM_F_CREATE should be specified when creating new route [ 1669.741355][ T7099] can: request_module (can-proto-0) failed. [ 1670.549846][ T7109] netlink: 'syz.3.10337': attribute type 29 has an invalid length. [ 1670.588838][ T7109] netlink: 'syz.3.10337': attribute type 29 has an invalid length. [ 1670.666959][ T7131] netlink: 'syz.3.10337': attribute type 29 has an invalid length. [ 1670.831676][ T7139] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10344'. [ 1671.023718][T13866] Bluetooth: hci1: command 0x0406 tx timeout [ 1671.043965][ T7146] netlink: 134728 bytes leftover after parsing attributes in process `syz.3.10346'. [ 1671.328590][ T7155] netlink: 'syz.2.10349': attribute type 21 has an invalid length. [ 1675.793981][ T7164] netlink: 'syz.0.10351': attribute type 4 has an invalid length. [ 1675.810951][ T7181] Ÿë: port 1(veth0_to_team) entered blocking state [ 1675.825987][ T7181] Ÿë: port 1(veth0_to_team) entered disabled state [ 1675.844858][ T7181] device veth0_to_team entered promiscuous mode [ 1675.996321][ T7187] __nla_validate_parse: 3 callbacks suppressed [ 1675.996338][ T7187] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10360'. [ 1676.307526][ T7198] netlink: 'syz.0.10364': attribute type 21 has an invalid length. [ 1676.323477][ T7198] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10364'. [ 1676.820750][ T7212] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1676.901089][ T7218] netlink: 40 bytes leftover after parsing attributes in process `syz.2.10370'. [ 1677.897474][ T7237] netlink: 'syz.0.10377': attribute type 29 has an invalid length. [ 1677.930306][ T7240] FAULT_INJECTION: forcing a failure. [ 1677.930306][ T7240] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1677.955658][ T7237] netlink: 'syz.0.10377': attribute type 29 has an invalid length. [ 1677.988343][ T7241] netlink: 'syz.0.10377': attribute type 29 has an invalid length. [ 1678.014728][ T7240] CPU: 0 PID: 7240 Comm: syz.2.10378 Not tainted syzkaller #0 [ 1678.022255][ T7240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1678.032338][ T7240] Call Trace: [ 1678.035631][ T7240] [ 1678.038571][ T7240] dump_stack_lvl+0x188/0x24e [ 1678.043275][ T7240] ? show_regs_print_info+0x12/0x12 [ 1678.048502][ T7240] ? load_image+0x400/0x400 [ 1678.053035][ T7240] ? __lock_acquire+0x7d10/0x7d10 [ 1678.058087][ T7240] should_fail_ex+0x399/0x4d0 [ 1678.062780][ T7240] _copy_from_user+0x2c/0x170 [ 1678.067470][ T7240] perf_copy_attr+0x174/0x850 [ 1678.072157][ T7240] __se_sys_perf_event_open+0xf5/0x1ec0 [ 1678.077713][ T7240] ? __fget_files+0x43d/0x4b0 [ 1678.082403][ T7240] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 1678.088052][ T7240] ? lockdep_hardirqs_on+0x94/0x140 [ 1678.093246][ T7240] ? __x64_sys_perf_event_open+0x1c/0xc0 [ 1678.098881][ T7240] do_syscall_64+0x4c/0xa0 [ 1678.103380][ T7240] ? clear_bhb_loop+0x60/0xb0 [ 1678.108053][ T7240] ? clear_bhb_loop+0x60/0xb0 [ 1678.112736][ T7240] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1678.118711][ T7240] RIP: 0033:0x7ff39839c799 [ 1678.123120][ T7240] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1678.142726][ T7240] RSP: 002b:00007ff399213028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 1678.151137][ T7240] RAX: ffffffffffffffda RBX: 00007ff398616090 RCX: 00007ff39839c799 [ 1678.159106][ T7240] RDX: 0000000100000000 RSI: 0000000000000000 RDI: 0000200000000100 [ 1678.167070][ T7240] RBP: 00007ff399213090 R08: 0000000000000000 R09: 0000000000000000 [ 1678.175036][ T7240] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000001 [ 1678.183022][ T7240] R13: 00007ff398616128 R14: 00007ff398616090 R15: 00007ffe4b127048 [ 1678.191005][ T7240] [ 1678.312215][T13866] Bluetooth: hci1: ISO packet for unknown connection handle 2366 [ 1678.367004][ T7250] FAULT_INJECTION: forcing a failure. [ 1678.367004][ T7250] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1678.449381][ T7250] CPU: 0 PID: 7250 Comm: syz.0.10381 Not tainted syzkaller #0 [ 1678.456925][ T7250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1678.467003][ T7250] Call Trace: [ 1678.470321][ T7250] [ 1678.473291][ T7250] dump_stack_lvl+0x188/0x24e [ 1678.478029][ T7250] ? show_regs_print_info+0x12/0x12 [ 1678.483284][ T7250] ? load_image+0x400/0x400 [ 1678.487839][ T7250] ? __lock_acquire+0x7d10/0x7d10 [ 1678.492925][ T7250] ? do_raw_spin_unlock+0x11d/0x230 [ 1678.498180][ T7250] should_fail_ex+0x399/0x4d0 [ 1678.502914][ T7250] _copy_from_user+0x2c/0x170 [ 1678.507644][ T7250] ppp_get_filter+0xa3/0x1c0 [ 1678.512284][ T7250] ? ppp_set_compress+0x730/0x730 [ 1678.517412][ T7250] ppp_ioctl+0xe7b/0x1a50 [ 1678.521800][ T7250] ? ppp_poll+0x250/0x250 [ 1678.526168][ T7250] ? __fget_files+0x28/0x4b0 [ 1678.530837][ T7250] ? bpf_lsm_file_ioctl+0x5/0x10 [ 1678.535814][ T7250] ? security_file_ioctl+0x7c/0xa0 [ 1678.540972][ T7250] ? ppp_poll+0x250/0x250 [ 1678.545343][ T7250] __se_sys_ioctl+0xfa/0x170 [ 1678.549984][ T7250] do_syscall_64+0x4c/0xa0 [ 1678.554439][ T7250] ? clear_bhb_loop+0x60/0xb0 [ 1678.559154][ T7250] ? clear_bhb_loop+0x60/0xb0 [ 1678.563880][ T7250] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1678.569804][ T7250] RIP: 0033:0x7f5a7dd9c799 [ 1678.574230][ T7250] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1678.593849][ T7250] RSP: 002b:00007f5a7bff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1678.602281][ T7250] RAX: ffffffffffffffda RBX: 00007f5a7e016090 RCX: 00007f5a7dd9c799 [ 1678.610268][ T7250] RDX: 0000200000000180 RSI: 0000000040107446 RDI: 0000000000000004 [ 1678.618249][ T7250] RBP: 00007f5a7bff6090 R08: 0000000000000000 R09: 0000000000000000 [ 1678.626236][ T7250] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1678.634220][ T7250] R13: 00007f5a7e016128 R14: 00007f5a7e016090 R15: 00007ffe39657528 [ 1678.642242][ T7250] [ 1678.927238][ T7261] netlink: 'syz.3.10385': attribute type 21 has an invalid length. [ 1678.964469][ T7261] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10385'. [ 1680.592496][ T7333] netlink: 'syz.1.10409': attribute type 1 has an invalid length. [ 1680.613839][ T7333] netlink: 5 bytes leftover after parsing attributes in process `syz.1.10409'. [ 1681.089849][ T7349] netlink: 'syz.1.10414': attribute type 21 has an invalid length. [ 1681.105058][ T7349] netlink: 132 bytes leftover after parsing attributes in process `syz.1.10414'. [ 1681.935025][ T7373] netlink: 'syz.0.10421': attribute type 1 has an invalid length. [ 1681.971482][ T7373] netlink: 176 bytes leftover after parsing attributes in process `syz.0.10421'. [ 1682.234464][ T7360] delete_channel: no stack [ 1682.592487][ T7390] netlink: 16162 bytes leftover after parsing attributes in process `syz.0.10426'. [ 1682.944449][ T7397] netlink: 'syz.1.10428': attribute type 4 has an invalid length. [ 1683.034656][ T7397] netlink: 'syz.1.10428': attribute type 8 has an invalid length. [ 1683.109620][ T7397] netlink: 109560 bytes leftover after parsing attributes in process `syz.1.10428'. [ 1683.497144][ T7405] netlink: 'syz.2.10433': attribute type 21 has an invalid length. [ 1683.507618][ T7405] netlink: 132 bytes leftover after parsing attributes in process `syz.2.10433'. [ 1683.759877][ T7415] FAULT_INJECTION: forcing a failure. [ 1683.759877][ T7415] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1683.802847][ T7415] CPU: 1 PID: 7415 Comm: syz.1.10437 Not tainted syzkaller #0 [ 1683.810371][ T7415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1683.820447][ T7415] Call Trace: [ 1683.823748][ T7415] [ 1683.826686][ T7415] dump_stack_lvl+0x188/0x24e [ 1683.831385][ T7415] ? show_regs_print_info+0x12/0x12 [ 1683.836602][ T7415] ? load_image+0x400/0x400 [ 1683.841121][ T7415] ? __lock_acquire+0x7d10/0x7d10 [ 1683.846179][ T7415] should_fail_ex+0x399/0x4d0 [ 1683.850876][ T7415] prepare_alloc_pages+0x1e2/0x5f0 [ 1683.856019][ T7415] __alloc_pages+0x130/0x4f0 [ 1683.860631][ T7415] ? zone_statistics+0x170/0x170 [ 1683.865596][ T7415] ? lockdep_hardirqs_on+0x94/0x140 [ 1683.870825][ T7415] __folio_alloc+0xe/0x30 [ 1683.875180][ T7415] vma_alloc_folio+0x4a3/0x900 [ 1683.879974][ T7415] ? mpol_shared_policy_lookup+0x147/0x1e0 [ 1683.885806][ T7415] shmem_alloc_and_acct_folio+0x463/0xbc0 [ 1683.891562][ T7415] ? shmem_replace_folio+0xee0/0xee0 [ 1683.896877][ T7415] ? xas_load+0x119/0x140 [ 1683.901208][ T7415] ? __filemap_get_folio+0x10f/0xdb0 [ 1683.906499][ T7415] ? __filemap_get_folio+0xb24/0xdb0 [ 1683.911786][ T7415] ? __filemap_get_folio+0x10f/0xdb0 [ 1683.917077][ T7415] ? page_cache_prev_miss+0x380/0x380 [ 1683.922450][ T7415] ? mark_lock+0x94/0x320 [ 1683.926788][ T7415] shmem_get_folio_gfp+0x1361/0x3400 [ 1683.932092][ T7415] shmem_write_begin+0xee/0x3f0 [ 1683.936945][ T7415] generic_perform_write+0x2fa/0x5c0 [ 1683.942259][ T7415] ? generic_file_direct_write+0x330/0x330 [ 1683.948065][ T7415] ? __file_remove_privs+0x5f0/0x5f0 [ 1683.953386][ T7415] ? rwsem_write_trylock+0x135/0x1c0 [ 1683.958845][ T7415] ? clear_nonspinnable+0x60/0x60 [ 1683.963893][ T7415] ? generic_write_checks_count+0x3d9/0x4c0 [ 1683.969803][ T7415] __generic_file_write_iter+0x148/0x2a0 [ 1683.975451][ T7415] generic_file_write_iter+0xab/0x2e0 [ 1683.980846][ T7415] vfs_write+0x4b1/0xa30 [ 1683.985122][ T7415] ? file_end_write+0x250/0x250 [ 1683.989979][ T7415] ? __fget_files+0x43d/0x4b0 [ 1683.994661][ T7415] ? __fdget_pos+0x2ae/0x360 [ 1683.999256][ T7415] ? ksys_write+0x71/0x250 [ 1684.003672][ T7415] ksys_write+0x14c/0x250 [ 1684.008002][ T7415] ? __ia32_sys_read+0x80/0x80 [ 1684.012799][ T7415] ? lockdep_hardirqs_on+0x94/0x140 [ 1684.017993][ T7415] do_syscall_64+0x4c/0xa0 [ 1684.022405][ T7415] ? clear_bhb_loop+0x60/0xb0 [ 1684.027076][ T7415] ? clear_bhb_loop+0x60/0xb0 [ 1684.031762][ T7415] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1684.037652][ T7415] RIP: 0033:0x7fc4fb59c799 [ 1684.042066][ T7415] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1684.061681][ T7415] RSP: 002b:00007fc4f97f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1684.070112][ T7415] RAX: ffffffffffffffda RBX: 00007fc4fb815fa0 RCX: 00007fc4fb59c799 [ 1684.078095][ T7415] RDX: 0000000013bb711e RSI: 0000200000000180 RDI: 0000000000000008 [ 1684.086066][ T7415] RBP: 00007fc4f97f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1684.094034][ T7415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1684.102003][ T7415] R13: 00007fc4fb816038 R14: 00007fc4fb815fa0 R15: 00007ffda4676ca8 [ 1684.109983][ T7415] [ 1685.616088][ T7445] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.10447'. [ 1685.625617][ T7445] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.10447'. [ 1685.668340][ T7445] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.10447'. [ 1685.677970][ T7445] FAULT_INJECTION: forcing a failure. [ 1685.677970][ T7445] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1685.711022][ T7445] CPU: 1 PID: 7445 Comm: syz.4.10447 Not tainted syzkaller #0 [ 1685.718542][ T7445] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1685.728628][ T7445] Call Trace: [ 1685.731922][ T7445] [ 1685.734866][ T7445] dump_stack_lvl+0x188/0x24e [ 1685.739572][ T7445] ? show_regs_print_info+0x12/0x12 [ 1685.744798][ T7445] ? load_image+0x400/0x400 [ 1685.749322][ T7445] ? __lock_acquire+0x7d10/0x7d10 [ 1685.754376][ T7445] ? snprintf+0xe5/0x140 [ 1685.758636][ T7445] should_fail_ex+0x399/0x4d0 [ 1685.763316][ T7445] _copy_to_user+0x2c/0x130 [ 1685.767818][ T7445] simple_read_from_buffer+0xe3/0x150 [ 1685.773191][ T7445] proc_fail_nth_read+0x1a6/0x220 [ 1685.778211][ T7445] ? proc_fault_inject_write+0x310/0x310 [ 1685.783839][ T7445] ? fsnotify_perm+0x248/0x550 [ 1685.788601][ T7445] ? proc_fault_inject_write+0x310/0x310 [ 1685.794230][ T7445] vfs_read+0x2de/0xa00 [ 1685.798389][ T7445] ? kernel_read+0x1e0/0x1e0 [ 1685.802975][ T7445] ? __fget_files+0x28/0x4b0 [ 1685.807568][ T7445] ? __fget_files+0x28/0x4b0 [ 1685.812157][ T7445] ? __fget_files+0x43d/0x4b0 [ 1685.816838][ T7445] ? __fdget_pos+0x2ae/0x360 [ 1685.821424][ T7445] ? ksys_read+0x71/0x250 [ 1685.825751][ T7445] ksys_read+0x14c/0x250 [ 1685.829992][ T7445] ? vfs_write+0xa30/0xa30 [ 1685.834407][ T7445] ? lockdep_hardirqs_on+0x94/0x140 [ 1685.839604][ T7445] do_syscall_64+0x4c/0xa0 [ 1685.844019][ T7445] ? clear_bhb_loop+0x60/0xb0 [ 1685.848690][ T7445] ? clear_bhb_loop+0x60/0xb0 [ 1685.853364][ T7445] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1685.859427][ T7445] RIP: 0033:0x7fe753f5cfce [ 1685.863862][ T7445] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1685.883556][ T7445] RSP: 002b:00007fe754eb3fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1685.891966][ T7445] RAX: ffffffffffffffda RBX: 00007fe754eb46c0 RCX: 00007fe753f5cfce [ 1685.899928][ T7445] RDX: 000000000000000f RSI: 00007fe754eb40a0 RDI: 0000000000000005 [ 1685.907892][ T7445] RBP: 00007fe754eb4090 R08: 0000000000000000 R09: 0000000000000000 [ 1685.915855][ T7445] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1685.923817][ T7445] R13: 00007fe754216038 R14: 00007fe754215fa0 R15: 00007ffe830ebd28 [ 1685.931804][ T7445] [ 1686.225758][ T7448] netlink: 'syz.4.10448': attribute type 2 has an invalid length. [ 1686.285696][ T7452] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.10450'. [ 1686.318510][ T7454] netlink: 'syz.3.10451': attribute type 21 has an invalid length. [ 1686.330340][ T7454] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10451'. [ 1686.370268][ T7452] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.10450'. [ 1687.273445][ T7483] netlink: 'syz.4.10459': attribute type 3 has an invalid length. [ 1687.282180][ T7483] netlink: 132 bytes leftover after parsing attributes in process `syz.4.10459'. [ 1687.662075][ T7499] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10466'. [ 1687.748521][ T7506] netlink: 10 bytes leftover after parsing attributes in process `syz.0.10469'. [ 1688.119197][ T7515] netlink: 65047 bytes leftover after parsing attributes in process `syz.2.10472'. [ 1688.183340][ T7519] netlink: 'syz.0.10473': attribute type 21 has an invalid length. [ 1688.195093][ T7519] netlink: 132 bytes leftover after parsing attributes in process `syz.0.10473'. [ 1689.800225][ T7553] Dead loop on virtual device ip6_vti0, fix it urgently! [ 1691.941511][ T7572] netlink: 'syz.3.10493': attribute type 21 has an invalid length. [ 1691.964938][ T7572] netlink: 132 bytes leftover after parsing attributes in process `syz.3.10493'. [ 1692.036552][ T7574] bond0: (slave batadv0): Error: Slave device does not support XDP [ 1692.720215][ T7603] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10507'. [ 1692.791410][ T7603] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10507'. [ 1692.817417][ T7606] netlink: 60 bytes leftover after parsing attributes in process `syz.2.10507'. [ 1693.481177][ T7637] netlink: 'syz.3.10522': attribute type 10 has an invalid length. [ 1693.552130][ T7637] team0: Port device wlan1 added [ 1693.706631][ T7650] netlink: 'syz.2.10528': attribute type 13 has an invalid length. [ 1693.732582][ T7650] netlink: 164 bytes leftover after parsing attributes in process `syz.2.10528'. [ 1693.757158][ T7650] syz_tun: refused to change device tx_queue_len [ 1693.823536][ T7659] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10533'. [ 1693.864845][ T7659] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10533'. [ 1693.892352][ T7661] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10533'. [ 1693.955929][ T7659] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10533'. [ 1693.982574][ T7659] netlink: 60 bytes leftover after parsing attributes in process `syz.1.10533'. [ 1694.421075][ T7689] netlink: 'syz.3.10547': attribute type 39 has an invalid length. [ 1694.637835][ T7693] netlink: 'syz.4.10548': attribute type 3 has an invalid length. [ 1694.656754][ T7693] netlink: 'syz.4.10548': attribute type 3 has an invalid length. [ 1694.748720][ T7706] [ 1694.751455][ T7706] ============================= [ 1694.756742][ T7706] WARNING: suspicious RCU usage [ 1694.761629][ T7706] syzkaller #0 Not tainted [ 1694.766117][ T7706] ----------------------------- [ 1694.770990][ T7706] kernel/events/callchain.c:161 suspicious rcu_dereference_check() usage! [ 1694.779572][ T7706] [ 1694.779572][ T7706] other info that might help us debug this: [ 1694.779572][ T7706] [ 1694.789867][ T7706] [ 1694.789867][ T7706] rcu_scheduler_active = 2, debug_locks = 1 [ 1694.798025][ T7706] 1 lock held by syz.0.10555/7706: [ 1694.803193][ T7706] #0: ffffffff8cb2d7a0 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x37/0x70 [ 1694.813503][ T7706] [ 1694.813503][ T7706] stack backtrace: [ 1694.819448][ T7706] CPU: 1 PID: 7706 Comm: syz.0.10555 Not tainted syzkaller #0 [ 1694.826935][ T7706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1694.837014][ T7706] Call Trace: [ 1694.840314][ T7706] [ 1694.843276][ T7706] dump_stack_lvl+0x188/0x24e [ 1694.847992][ T7706] ? show_regs_print_info+0x12/0x12 [ 1694.853663][ T7706] ? load_image+0x400/0x400 [ 1694.858208][ T7706] lockdep_rcu_suspicious+0x1dd/0x300 [ 1694.863205][ T7709] netlink: 'syz.4.10556': attribute type 39 has an invalid length. [ 1694.863602][ T7706] get_callchain_entry+0x2a5/0x3b0 [ 1694.876662][ T7706] get_perf_callchain+0xc4/0x490 [ 1694.881666][ T7706] ? put_callchain_entry+0xb0/0xb0 [ 1694.886813][ T7706] ? preempt_schedule+0xbc/0xd0 [ 1694.891709][ T7706] ? preempt_schedule_common+0xa5/0xd0 [ 1694.897202][ T7706] ? verify_lock_unused+0x140/0x140 [ 1694.902522][ T7706] ? preempt_schedule+0xbc/0xd0 [ 1694.907494][ T7706] __bpf_get_stack+0x2de/0x520 [ 1694.912300][ T7706] ? stack_map_get_build_id_offset+0x970/0x970 [ 1694.918501][ T7706] ? __cant_sleep+0x220/0x220 [ 1694.923203][ T7706] ? bpf_prog_b8a90dd1efcc4ad9+0x3d/0x41 [ 1694.928866][ T7706] bpf_get_stack_raw_tp+0x189/0x1c0 [ 1694.934103][ T7706] bpf_prog_b8a90dd1efcc4ad9+0x3d/0x41 [ 1694.939575][ T7706] bpf_prog_run_pin_on_cpu+0x64/0x150 [ 1694.944955][ T7706] bpf_prog_test_run_syscall+0x313/0x4a0 [ 1694.950594][ T7706] ? sock_gen_cookie+0x60/0x60 [ 1694.955361][ T7706] ? sock_gen_cookie+0x60/0x60 [ 1694.960139][ T7706] bpf_prog_test_run+0x31e/0x390 [ 1694.965082][ T7706] __sys_bpf+0x62b/0x780 [ 1694.969322][ T7706] ? bpf_link_show_fdinfo+0x380/0x380 [ 1694.974695][ T7706] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 1694.980637][ T7706] ? lock_chain_count+0x20/0x20 [ 1694.985496][ T7706] __x64_sys_bpf+0x78/0x90 [ 1694.989912][ T7706] do_syscall_64+0x4c/0xa0 [ 1694.994342][ T7706] ? clear_bhb_loop+0x60/0xb0 [ 1694.999015][ T7706] ? clear_bhb_loop+0x60/0xb0 [ 1695.003689][ T7706] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1695.009579][ T7706] RIP: 0033:0x7f5a7dd9c799 [ 1695.013986][ T7706] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1695.033595][ T7706] RSP: 002b:00007f5a7eb71028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1695.042010][ T7706] RAX: ffffffffffffffda RBX: 00007f5a7e015fa0 RCX: 00007f5a7dd9c799 [ 1695.049978][ T7706] RDX: 000000000000000c RSI: 00002000000004c0 RDI: 000000000000000a [ 1695.057965][ T7706] RBP: 00007f5a7de32c99 R08: 0000000000000000 R09: 0000000000000000 [ 1695.065931][ T7706] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1695.073896][ T7706] R13: 00007f5a7e016038 R14: 00007f5a7e015fa0 R15: 00007ffe39657528 [ 1695.081879][ T7706] [ 1695.205294][ T7715] netlink: 'syz.2.10559': attribute type 10 has an invalid length.