last executing test programs: 7.810346874s ago: executing program 2 (id=7933): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x0, 0xfffffdff, 0xffffff81, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) bpf$MAP_CREATE(0x0, 0x0, 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000180)=r4) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000"], 0xffdd) 3.669228098s ago: executing program 0 (id=7948): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80102, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x9, 0x7}, 0x4, 0x0, 0x0, 0x1, 0x3fe, 0x7ffffffc, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000500000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r2, 0x18000000000002a0, 0x48, 0x62, &(0x7f0000000600)="b9ff03075fe9008cb89e08e086dd", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x28) r3 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_int(r3, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, [@call={0x85, 0x0, 0x0, 0x8a}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)={0x2, 0x0}, 0x8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r4, 0x8, 0x8}, 0xc) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d00)={r4, 0x3, 0x18}, 0xc) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="9e36d448b36e48d2e10400000000", 0x0, 0xc, 0xe8030000, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x41200000, &(0x7f00000005c0)="1cd852ba22e675d5bce4dca2f3ad9ceb6c20ab5604c4259af7e1bbac6043fec97b4e53cf363f83f1e469c0b2c451dd08fcde7a6270f4564f462201de7970625b41ce9e1bed26c526e7ad2076504736f0c4e79fac77bdbc10c65caa9b2147c7b94c90d85948553ae9388464daf6fea5f7a176403530dd2d406614cea933982949eac32b91d08b5f507dff02274535e031b8d5a79e951a457d70ab58e1c7a9e1ef539baa80f7b4e6cdccb5c13eb7a2b23d67b863d17a401d90130e9d4643533396710bfae459dc6f9f63628e8dca022b17042cb18b2dcc427c8874e2d9e2371f1069078b941a0869b68cde23a22c61d9083941e361e7460cccda227293f35af4637157d0212ccf867098ceab8a5900dd7fd6144754b7efbd9fcb66d8adcf299c528bcfaafed728e50b4a9cf3339f4515e4770e64557d8a14401507c403c2f8d1d9b4586ca3a4c1215340aeba6915a4ea0c6cb61b443a0bffdc7d0e1af113e914f101886c499385fe8604c31629e7faf13be0e39b83ee7d88704378b7b5a299912f10d2df5d8ae31f1d02bc27efc9a2b16616d416417a9d303281db272baf1cc982df3b83d08a972a260231c2dcb482f5f80780f7846fcc08617c12468f8c907a99d8e8fc2cd3519440b303fe5be61726ad60ac2dac30f0590e3bf43bf70f4b04e322c25e18f7f262b325d4f5521e419ada75c6b2ab94d8cc06319cf3dcfdb4a2cbc8e932052d951572eb6d58c80a3534e47dd77b18f84bbab21da2da8e27abfb508a8571bc2671b1f0bf9936501b71ec0bdc532a64d4ede370b4ff2e8add342b552c1c16ae86223f0a055f16390eb498cffd75310129bc9328bf23af64bfb0f706e5be713e2bb0e1bcc159b10e9fafd58111addf710db920f567bf70776de6c36c8a33b3d1c3726f6cd9042a7c077fa18e0d8b344f52e133663f049aa1602bfef234b5ef036840c418e0a1517772e50c8d697ee7fb8d46a8f182adcce4247b3b4288dfda40daaab640e6e0ed3d8d32871b10191e2d0a0191fb5482ac31f30f6011718b3dfd389041d70d3e1c812def7dbdb8ca61f4323d70d25e7eb5bcfc0030ee761f47a9607ba598bcf3daab7faff10a832cbbad454a25288089b39c1c3ecca6f077bbd5f467eb1d15ac30a49153c3007d3c119e8968ed3964a17219873a82551268e7446d3da46f4fd8a25bebb73d6496107efef593ee192d77f2099403180a26ce975dd0b02c2bf66aae08649d30ce1b2d13282de84fad22990781373b026051bbabb79af3c56b925bf310bc82ca3a7bee89305cd7b284749e07ed74d85856e77a2ed91173357315f96db0454a386aa950f92a0f671c4127fa93656187d60e16d6c87b818bcdacb598d7b4de15b61c262463c9bd631af9b99e968fd61f6198eef076a8112a1e94b77b7275d4a57677e688ccb79b69c2c2b23469cb9df6715cf83c9aeb8c5d637203215a693ef2f8386f6da4b67569dc22ab0282673bfa49c9f380598ffeda8ad82c7ee49ab343eb2c521d24ecc64d75261250a33fef9536e6c2db540991eb1b130d59f4915a2214f81cc4147c1d3944d50b43b59f0f8e82064ec915ab930a05d9868640fd3fc8e895e1a2e68fa98b634aced0f8d6b460edbb548cea399aded80f4658e922f32447deb37b2080a47d63796bc0e5d144e7d7f757929d10529be2b7e48ad816a10da756cc187c5895a59bf497c45e2d603d511d291b8e25dbf123dd9bd90933153609e7bcf547d534a181356c2610449aa2824050d9f6263b2dd0f4fde41a9d0e78ad6f242340c88a44905e98521cd3a0d298ab2cd68b34f75f82a36404abdcb1aa84dbdbdf372732344fe520d0057ee47a34811849ad7f612baac302983f0f99c31659e211ae639090d6df5ad8afd8a914545db78f1b5c7c072483652ed1d02f6d53efb024d0874701be7a91c315f1928b108a17646e75f7c2d200c8e6ee344f009906320a765af5b83386623a225c3c0b6ed80c9d77daf794a978f6fe758a2978606af7652a73a188183cb1b972715d757a59479bc08ebd49edb3520d1bd188824c6e07d59192a441b40f2fd7946c1ab918ce2564764c09c2d0925e46cdc3cb900b6c4b3c43bb0d2b9e4577a25a416e17975aa368ace1c8fa0d13905f36ccc765ddfe2fd90952feeeb2449305d18f7667cf94e952fd513cbfb8a5570602621dd83d42fc26009b9c14a0a99ef8690c6488b99ab1a35bb9b300e1047ef784e4949b975aa67c136be27b2564619927162efa5b044a59babf8daf258d5acd4e837d208c3be58447b6c53fcad7b7cefa6fc7a0c94c2b4b0f5ce4aa73c29ceb2d54e38bc480f8bc1ae4ded4e47d034b4d292e98ca8c878c99753580915f0447d4d69f2738c1f6308a3d286dbbbbc99a3e6520605e23464c6fbc5fbd9b2696a64acc94726d971e5b17ddc7021ff8f607ad2a5f0b889b371c81249daa1a3b956fd5d335024efa700bf31fd86c0d9e63571d8123b84b5ff93675de9ae63ae49e61c54d65b6f64bd5c4e8515f2c7378d475307bb49f5c3490cdea5ceee0a696cf6b1c739d1dbd9bad65ab93f6d7b4506ab634639f6ff6665d8a4bdb8dbff23c83a72b7f436d6f7690f9798f5a35354d2b8e3c1e8617dce7349da24f99b26f22487b36368edc6a7f288a2245031e0dbde077a0ee5616cbb81171b93f1547e22fdc62aaab1a4b7ba52c6372429133909492a16a12cf180cdcc9a63b7b108997e715435be6ec44f2ad9e35ef2a050b5fec37b4207eebf484ef51118d06454df020ea9b6b6dd2734f0f4716d3b6bd1e382de9ac97dc58a5fd85fb8dd00ea09a02e8dfe43cfd2bf811bba5ae7776ddd0307d75b8cc11dfa4db5b98e7e6ebb381e5049dd8e147fa832343c524aa1766b322ec9d10d222c3df0f3ee69652a69b4cdfc685ef47b9fd010d640a215f8f9da3efd66e64d8362cb5ece2ff23b2b455c76912963779fff4aadc42a2a04659062b0469dedee89a97dac713de3dda42896749c5ad615b038363150cc13ef0a13d4bf603281a0aac9e5d7153d225db5f04bbc365c4e3dabec79358c7df110d5553b6f18027466f0e33d4e62d48871c264273380f8c1785fead6673b359dd121df735edf9803d5989e148493c0759f47dda2a98bab986389e9e772f6a7498c752460f24a7eee40a320d9cc07a5a5773b76131e1d41917007b671d25f5421672afe3841706332c0e6b95f68599473f23acf76f2f35c5498e6b391765d18c22250e596f3cae9edb3e01a759a7698f34e009d402d9b992e8dc679430772e99fd731aa8ba45d6cd331aa6c4869c45818b46fc39b8de854543370d397baf5ceef3438a206366cd6ab3b99cb84009d678187fe13f4110a2caa32b4d508d259dd7c68e3a6efde01d3bdedd0fa3e097a5d9ab9ade81e4e1c66e448da7ca5bf91eb97eb8d236b80b2e1bf846792ebef9b5522bed9a1445f2742853c5b27ca34a7626c217775c78c0639ec8360c16894da750fc2cabcf67583675b774e8664bc871c62a9ef89be7e879325a748eb4693040db2dd7dc9a293e010a9990257e8941ecdecd9a04ebf2c574768329d09374faef9b7d9282397b6c2d498e13fbb088a423ce376928b7565c67eae5c87960be07b6e31a296a5b4a8f274909481175f668ee8062eb9d280d2fc36529c5350c91b672bc6a0c14b4aba224ba0a30459fd64242f3f80124cd6a36543d125417b115d74743d4dff70b066703a54cfbb320db83cefa222fe595622daeb29dc6ef2d60cb0c342a6d29864ec4650c8297db10b144a1c7393a388171ba4f2a477bba5db63ef9426b320e99a0cba26595f83a230a009b569984f4c519afd05210ed5c8d44b728b30104a1dfa53d6ec5faccba6f2b950ee6409d6af6c66a80507f641245d89f9b97a289a2b35f4dad5c0c183c210c310f52e8822b928ba9664779a8c4f964b68a73faf4dd772302518bfc82d636072753ccae9b89b72674ed6ba318f443fac4ab7cc3b54353501115ed228466f18f287b4faa6d6f7980f27e0c543c56ad3571c346f31a4dce09e248da66a52d523287f8882e1af099ccb1d550c975c63c256f8a8117a5f993fda0fc9dcc7e8e2f16e7646968e3396648b406dee44ea20dc7441303da2c04e76e1bbf968f055b20a48f650aa74416e4cc24919926295b62adf6c52c0d3674f160f700936254b5360c122dec85f55371006d36561f31b07a2de079b4d57bc336d6bb79747e5e3eeab3e18eef423b739fbfc2794ca2096f9a06d06fba801e1e4ed88dd9c5de272e6e3ef758194f74c05bbf8d69a5a28546fb1ac2843a408297718500d1b90c2c256843dbdd4d8b7150553886a11ac108986084ae774ff9596bf1105ce9a4df8b7f400c6b8ad51bbb512b3bc9437062b039d021d004a927860798b881fc189d79badfef214f90e0f70640947e59cb033638a14d2123751ab0536b05f9fb6363c4264ee0493dc2eb3f5d4fef658ae26546de4c36cdca7e92d33f83f56ffe1027f5c39975b6c576ee775511163280e95cc511edd6174bd016bcf8c186f0df9cca6cc831a4f0eabe2e3103de27b43412e87906cb0e545602cc7c0159d903138251d3518bfefbdb9be3ba102663846e173b6d8c9fb6bf15b85c6cc2c16325cefbe37e1a21dfa898a8f5b9a08f0928b721419885e5ad3839c34b5e0e612761f3fe9edda951fcb6181dbf3448b0205653e2a769b9691f6c8fde512c50f593a64b9be77b78c3f59395b7ec6450315b91ad6908f2d157dfa7032d5fbe6eb079e92550889fd145023122ec2b521993421fc976c061731f967a954984bd6f2942e509554eda6d40c8a0eed111a3687ae0f2659e7c580820128bc601772f93ae610553ac66cc376d74b21c74eb024cbf75747b524c7da3f90a38fcb8903c465ff35f0ce78f89184375ce9f7aeb0655c5735c41a81190a8eea02e71016427c5017f2352019076a91db272bebfe505e2490edfe2f7d0f4e019d011ffb5c8e7a27e41231bfe1c968e312e1cc9bdfd72508ee6f5bef4243fe0c817a4d5a5de69aa008609bb1a75f7cf92f8da24bfb99fd00fce5db7132f4e58d632756aed98836b1f6c9acad140e6536d4aae5bd11ac4cb0fb70cf2eea457167f94644e15d60bb328be35578b9137600f4e37c153a21f1a2e3ee28fc8d5cf9bec08866c626fc3c39f9414d9d6a2e5cab6fb74c720bbd412a7b0e300cb5ee73af2ef40efe72b7c9579d7ca96442afb98158c9d61e1bcc85bcf77a475b65d9f9c593e785b43fbf39a0541728c18cc075d921a5ac9dcb0967cdadd4d2a101ec82a65659844b92b3f725abf6ec0a56d37de8837def15d41c177b4660905b8476ec2dfea7cf150922488d8b90cef0aec938d56cf9587ed2c1df9b9b1c20d78c32e8464487aede07af634d77fc5918861ed7084b8026303d7e148d2b4bb1ba3947cc2dde64fdcf13bbaf8a913e2e009e681da56d20d114ea8a9a9cfa4dab1063fcc85092d6067b83edc862f358508d66cbf78f5272d0d43cf769abc5176569824171d0d4787fb0db1b180418f31e02da67f2097a320a32b97b874e3f5e7f6813f5c4fea228a52194d0bcaa64efc7ee747d6aa308684f8dc4c7baef00a84339f37fb5278bc8fcac19f2b79d4b89df4fe552fe59e8a606587961586dc240be84c7a3f27f30db0a44d991fc0bfc0e6a279ea8b08f305536a555d93b9524d240c3cfe7558f113fddf688dd46fd8bab9b66c847fdc379207f1dc53dfe4fe4c345e3c87908d988ecb4e182a737ced18beaa9d01db72f933e7f4d8e7cfbba733c16da31909db11b32a03", 0x1000, &(0x7f00000015c0), &(0x7f0000001600), &(0x7f0000001640)="9ce2c7f507bdab193d99744fa40ec1f71e040689f5dab0fdc69aab68d1c2d9364a28ebf3c0d8ce9dcdfeb3") bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001a40)={r6, 0xe0, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f00000017c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf7, &(0x7f0000001840)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000001880), &(0x7f00000018c0), 0x8, 0x8b, 0x8, 0x8, &(0x7f0000001900)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c40)={&(0x7f0000001a80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe0, 0xe0, 0x7, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x7fff, [{0x7, 0x4, 0x7}, {0x1, 0x1, 0x9}, {0xa, 0x5, 0x8000}, {0xa, 0x2, 0x8}, {0xf, 0x4, 0x4}, {0x10, 0x1, 0x80000001}, {0xa, 0x1}]}, @var={0xa, 0x0, 0x0, 0xe, 0x1, 0x1}, @const={0xc}, @func_proto={0x0, 0x9, 0x0, 0xd, 0x0, [{}, {0x8, 0x1}, {0x3, 0x4}, {0xa, 0x2}, {0x7, 0x1}, {0x5, 0x4}, {}, {0x8, 0x1}, {0xb, 0x4}]}, @decl_tag={0xc, 0x0, 0x0, 0x11, 0x5, 0x9}]}, {0x0, [0x30, 0x5f, 0x30, 0x30, 0x2e]}}, &(0x7f0000001b80)=""/181, 0xff, 0xb5, 0x1, 0x8, 0x10000}, 0x28) mkdir(&(0x7f0000000000)='./cgroup/file0\x00', 0xd0939199c36b4d28) 3.5928012s ago: executing program 2 (id=7951): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001, 0x0, @perf_config_ext={0xf, 0x5}, 0x100e64, 0xc78, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001040)=ANY=[@ANYBLOB="130000000800000008"], 0x50) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000005000000b70000000000000095"], &(0x7f0000001080)='syzkaller\x00'}, 0x83) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r1, 0x0, 0x0}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000002200)=@bpf_lsm={0x1d, 0x18, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, [@exit, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x4}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, 0x0, 0x7, 0x46, &(0x7f0000000500)=""/70, 0x40f00, 0x10, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000940)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000002180)=[{0x4, 0x5, 0x9, 0x2}, {0x1, 0x1, 0x6, 0x2}, {0x3, 0x2, 0xa}, {0x2, 0x4, 0x4, 0x2}, {0x3, 0x4, 0xb, 0x7}], 0x10, 0x7f}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r0, @ANYRES32=r2], 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x37) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r1, 0x0, &(0x7f0000000280)=""/153}, 0x20) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r3, 0x40305829, &(0x7f0000000040)) 3.356973536s ago: executing program 2 (id=7952): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x34}}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x1, @perf_config_ext={0x5, 0x6}, 0x440}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, [@call={0x85, 0x0, 0x0, 0x2e}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x5, 0x0, &(0x7f0000000080)='GPL\x00', 0x4, 0xc0, &(0x7f0000000140)=""/192}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) close(0xffffffffffffffff) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x8, 0x3, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0xffffffdd, 0xa}}, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x19}, 0x94) 3.047120604s ago: executing program 2 (id=7953): socketpair$nbd(0x1, 0x1, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000001100)={0x5, 0x80, 0x9, 0x8, 0xc, 0xfb, 0x0, 0x3c, 0xc002, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0x1}, 0x1c813, 0x0, 0x7fffffff, 0x7, 0x9, 0x3, 0x7, 0x0, 0x0, 0x0, 0x7}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000000)=0xe53f) 2.790658451s ago: executing program 2 (id=7955): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x5, &(0x7f0000000980)=ANY=[@ANYBLOB="180000008f0800000000000000000000850000002f000000850000009e00000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r0, 0x0, 0xe, 0x0, &(0x7f0000000300)="c8bb4e7d20514b64ddf73a7e828c", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.585690285s ago: executing program 2 (id=7957): perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x400, 0x10506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_config_ext={0x1000000000000801, 0x1}, 0x7402, 0x2, 0x0, 0x9, 0x0, 0xffffffff, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9c, 0x5, 0x0, 0x0, 0x0, 0x5, 0x62020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x9, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) perf_event_open$cgroup(&(0x7f00000003c0)={0x2, 0x80, 0x13, 0x2, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x5, 0x3, 0x0, 0x0, 0x7fff}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x8) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x50, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x101}, 0x4146}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x20020, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0}, 0xc800, 0x0, 0xfffffffc, 0x9, 0xb0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events.local\x00', 0x26e1, 0x0) perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0xff, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xa8}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'wlan0\x00', 0x200}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000080)) 2.453047839s ago: executing program 0 (id=7959): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0x0) r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000300000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="190000000400000004000000f4"], 0x50) close(r0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x10000000c8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r0, 0x3, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) write$cgroup_pressure(r4, &(0x7f0000000200)={'full', 0x20, 0x6, 0x20, 0xfffffffffffffffa}, 0x2f) 2.307429542s ago: executing program 0 (id=7962): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x82, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x480, 0x1, 0x0, 0x7, 0x9, 0x0, 0xc270, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x4000000000001, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) perf_event_open(0x0, 0x0, 0xb, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8946, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b20, 0x0) syz_clone(0x4aa29480, 0x0, 0x0, 0x0, 0x0, 0x0) 1.250498179s ago: executing program 1 (id=7967): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0xe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000660a020000000000180100002020782500000000002020207b9af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a0000e2c2d26585000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x25) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f00000007c0)={0x2, 0x80, 0x67, 0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x0, 0x2}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1}, 0x0, 0xffffffbfffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000dc0)={&(0x7f0000000180)=@generic, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000840)=""/240, 0xf0}, {&(0x7f0000000940)=""/40, 0x28}, {&(0x7f0000000a00)=""/77, 0x4d}, {&(0x7f0000000a80)=""/154, 0x9a}, {&(0x7f0000000b40)=""/170, 0xaa}, {&(0x7f0000000c00)=""/236, 0xec}], 0x6, &(0x7f0000000d80)=""/13, 0xd}, 0x42) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'wg2\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'wg2\x00', @multicast}) bpf$ITER_CREATE(0xb, 0x0, 0x0) 1.067972143s ago: executing program 1 (id=7968): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80102, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x9, 0x7}, 0x4, 0x0, 0x0, 0x1, 0x3fe, 0x7ffffffc, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x51, 0x0, @perf_config_ext={0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r0, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)='%-010d \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r1}, 0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000500000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r2, 0x18000000000002a0, 0x48, 0x62, &(0x7f0000000600)="b9ff03075fe9008cb89e08e086dd", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x28) r3 = openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) write$cgroup_int(r3, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1f, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}, [@call={0x85, 0x0, 0x0, 0x8a}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_MAP_GET_NEXT_ID(0xc, &(0x7f0000000000)={0x2, 0x0}, 0x8) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000100)={r4, 0x8, 0x8}, 0xc) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d00)={r4, 0x3, 0x18}, 0xc) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f0000000180)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="9e36d448b36e48d2e10400000000", 0x0, 0xc, 0xe8030000, 0x0, 0x0, 0x0, 0x0}, 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone(0x41200000, &(0x7f00000005c0)="1cd852ba22e675d5bce4dca2f3ad9ceb6c20ab5604c4259af7e1bbac6043fec97b4e53cf363f83f1e469c0b2c451dd08fcde7a6270f4564f462201de7970625b41ce9e1bed26c526e7ad2076504736f0c4e79fac77bdbc10c65caa9b2147c7b94c90d85948553ae9388464daf6fea5f7a176403530dd2d406614cea933982949eac32b91d08b5f507dff02274535e031b8d5a79e951a457d70ab58e1c7a9e1ef539baa80f7b4e6cdccb5c13eb7a2b23d67b863d17a401d90130e9d4643533396710bfae459dc6f9f63628e8dca022b17042cb18b2dcc427c8874e2d9e2371f1069078b941a0869b68cde23a22c61d9083941e361e7460cccda227293f35af4637157d0212ccf867098ceab8a5900dd7fd6144754b7efbd9fcb66d8adcf299c528bcfaafed728e50b4a9cf3339f4515e4770e64557d8a14401507c403c2f8d1d9b4586ca3a4c1215340aeba6915a4ea0c6cb61b443a0bffdc7d0e1af113e914f101886c499385fe8604c31629e7faf13be0e39b83ee7d88704378b7b5a299912f10d2df5d8ae31f1d02bc27efc9a2b16616d416417a9d303281db272baf1cc982df3b83d08a972a260231c2dcb482f5f80780f7846fcc08617c12468f8c907a99d8e8fc2cd3519440b303fe5be61726ad60ac2dac30f0590e3bf43bf70f4b04e322c25e18f7f262b325d4f5521e419ada75c6b2ab94d8cc06319cf3dcfdb4a2cbc8e932052d951572eb6d58c80a3534e47dd77b18f84bbab21da2da8e27abfb508a8571bc2671b1f0bf9936501b71ec0bdc532a64d4ede370b4ff2e8add342b552c1c16ae86223f0a055f16390eb498cffd75310129bc9328bf23af64bfb0f706e5be713e2bb0e1bcc159b10e9fafd58111addf710db920f567bf70776de6c36c8a33b3d1c3726f6cd9042a7c077fa18e0d8b344f52e133663f049aa1602bfef234b5ef036840c418e0a1517772e50c8d697ee7fb8d46a8f182adcce4247b3b4288dfda40daaab640e6e0ed3d8d32871b10191e2d0a0191fb5482ac31f30f6011718b3dfd389041d70d3e1c812def7dbdb8ca61f4323d70d25e7eb5bcfc0030ee761f47a9607ba598bcf3daab7faff10a832cbbad454a25288089b39c1c3ecca6f077bbd5f467eb1d15ac30a49153c3007d3c119e8968ed3964a17219873a82551268e7446d3da46f4fd8a25bebb73d6496107efef593ee192d77f2099403180a26ce975dd0b02c2bf66aae08649d30ce1b2d13282de84fad22990781373b026051bbabb79af3c56b925bf310bc82ca3a7bee89305cd7b284749e07ed74d85856e77a2ed91173357315f96db0454a386aa950f92a0f671c4127fa93656187d60e16d6c87b818bcdacb598d7b4de15b61c262463c9bd631af9b99e968fd61f6198eef076a8112a1e94b77b7275d4a57677e688ccb79b69c2c2b23469cb9df6715cf83c9aeb8c5d637203215a693ef2f8386f6da4b67569dc22ab0282673bfa49c9f380598ffeda8ad82c7ee49ab343eb2c521d24ecc64d75261250a33fef9536e6c2db540991eb1b130d59f4915a2214f81cc4147c1d3944d50b43b59f0f8e82064ec915ab930a05d9868640fd3fc8e895e1a2e68fa98b634aced0f8d6b460edbb548cea399aded80f4658e922f32447deb37b2080a47d63796bc0e5d144e7d7f757929d10529be2b7e48ad816a10da756cc187c5895a59bf497c45e2d603d511d291b8e25dbf123dd9bd90933153609e7bcf547d534a181356c2610449aa2824050d9f6263b2dd0f4fde41a9d0e78ad6f242340c88a44905e98521cd3a0d298ab2cd68b34f75f82a36404abdcb1aa84dbdbdf372732344fe520d0057ee47a34811849ad7f612baac302983f0f99c31659e211ae639090d6df5ad8afd8a914545db78f1b5c7c072483652ed1d02f6d53efb024d0874701be7a91c315f1928b108a17646e75f7c2d200c8e6ee344f009906320a765af5b83386623a225c3c0b6ed80c9d77daf794a978f6fe758a2978606af7652a73a188183cb1b972715d757a59479bc08ebd49edb3520d1bd188824c6e07d59192a441b40f2fd7946c1ab918ce2564764c09c2d0925e46cdc3cb900b6c4b3c43bb0d2b9e4577a25a416e17975aa368ace1c8fa0d13905f36ccc765ddfe2fd90952feeeb2449305d18f7667cf94e952fd513cbfb8a5570602621dd83d42fc26009b9c14a0a99ef8690c6488b99ab1a35bb9b300e1047ef784e4949b975aa67c136be27b2564619927162efa5b044a59babf8daf258d5acd4e837d208c3be58447b6c53fcad7b7cefa6fc7a0c94c2b4b0f5ce4aa73c29ceb2d54e38bc480f8bc1ae4ded4e47d034b4d292e98ca8c878c99753580915f0447d4d69f2738c1f6308a3d286dbbbbc99a3e6520605e23464c6fbc5fbd9b2696a64acc94726d971e5b17ddc7021ff8f607ad2a5f0b889b371c81249daa1a3b956fd5d335024efa700bf31fd86c0d9e63571d8123b84b5ff93675de9ae63ae49e61c54d65b6f64bd5c4e8515f2c7378d475307bb49f5c3490cdea5ceee0a696cf6b1c739d1dbd9bad65ab93f6d7b4506ab634639f6ff6665d8a4bdb8dbff23c83a72b7f436d6f7690f9798f5a35354d2b8e3c1e8617dce7349da24f99b26f22487b36368edc6a7f288a2245031e0dbde077a0ee5616cbb81171b93f1547e22fdc62aaab1a4b7ba52c6372429133909492a16a12cf180cdcc9a63b7b108997e715435be6ec44f2ad9e35ef2a050b5fec37b4207eebf484ef51118d06454df020ea9b6b6dd2734f0f4716d3b6bd1e382de9ac97dc58a5fd85fb8dd00ea09a02e8dfe43cfd2bf811bba5ae7776ddd0307d75b8cc11dfa4db5b98e7e6ebb381e5049dd8e147fa832343c524aa1766b322ec9d10d222c3df0f3ee69652a69b4cdfc685ef47b9fd010d640a215f8f9da3efd66e64d8362cb5ece2ff23b2b455c76912963779fff4aadc42a2a04659062b0469dedee89a97dac713de3dda42896749c5ad615b038363150cc13ef0a13d4bf603281a0aac9e5d7153d225db5f04bbc365c4e3dabec79358c7df110d5553b6f18027466f0e33d4e62d48871c264273380f8c1785fead6673b359dd121df735edf9803d5989e148493c0759f47dda2a98bab986389e9e772f6a7498c752460f24a7eee40a320d9cc07a5a5773b76131e1d41917007b671d25f5421672afe3841706332c0e6b95f68599473f23acf76f2f35c5498e6b391765d18c22250e596f3cae9edb3e01a759a7698f34e009d402d9b992e8dc679430772e99fd731aa8ba45d6cd331aa6c4869c45818b46fc39b8de854543370d397baf5ceef3438a206366cd6ab3b99cb84009d678187fe13f4110a2caa32b4d508d259dd7c68e3a6efde01d3bdedd0fa3e097a5d9ab9ade81e4e1c66e448da7ca5bf91eb97eb8d236b80b2e1bf846792ebef9b5522bed9a1445f2742853c5b27ca34a7626c217775c78c0639ec8360c16894da750fc2cabcf67583675b774e8664bc871c62a9ef89be7e879325a748eb4693040db2dd7dc9a293e010a9990257e8941ecdecd9a04ebf2c574768329d09374faef9b7d9282397b6c2d498e13fbb088a423ce376928b7565c67eae5c87960be07b6e31a296a5b4a8f274909481175f668ee8062eb9d280d2fc36529c5350c91b672bc6a0c14b4aba224ba0a30459fd64242f3f80124cd6a36543d125417b115d74743d4dff70b066703a54cfbb320db83cefa222fe595622daeb29dc6ef2d60cb0c342a6d29864ec4650c8297db10b144a1c7393a388171ba4f2a477bba5db63ef9426b320e99a0cba26595f83a230a009b569984f4c519afd05210ed5c8d44b728b30104a1dfa53d6ec5faccba6f2b950ee6409d6af6c66a80507f641245d89f9b97a289a2b35f4dad5c0c183c210c310f52e8822b928ba9664779a8c4f964b68a73faf4dd772302518bfc82d636072753ccae9b89b72674ed6ba318f443fac4ab7cc3b54353501115ed228466f18f287b4faa6d6f7980f27e0c543c56ad3571c346f31a4dce09e248da66a52d523287f8882e1af099ccb1d550c975c63c256f8a8117a5f993fda0fc9dcc7e8e2f16e7646968e3396648b406dee44ea20dc7441303da2c04e76e1bbf968f055b20a48f650aa74416e4cc24919926295b62adf6c52c0d3674f160f700936254b5360c122dec85f55371006d36561f31b07a2de079b4d57bc336d6bb79747e5e3eeab3e18eef423b739fbfc2794ca2096f9a06d06fba801e1e4ed88dd9c5de272e6e3ef758194f74c05bbf8d69a5a28546fb1ac2843a408297718500d1b90c2c256843dbdd4d8b7150553886a11ac108986084ae774ff9596bf1105ce9a4df8b7f400c6b8ad51bbb512b3bc9437062b039d021d004a927860798b881fc189d79badfef214f90e0f70640947e59cb033638a14d2123751ab0536b05f9fb6363c4264ee0493dc2eb3f5d4fef658ae26546de4c36cdca7e92d33f83f56ffe1027f5c39975b6c576ee775511163280e95cc511edd6174bd016bcf8c186f0df9cca6cc831a4f0eabe2e3103de27b43412e87906cb0e545602cc7c0159d903138251d3518bfefbdb9be3ba102663846e173b6d8c9fb6bf15b85c6cc2c16325cefbe37e1a21dfa898a8f5b9a08f0928b721419885e5ad3839c34b5e0e612761f3fe9edda951fcb6181dbf3448b0205653e2a769b9691f6c8fde512c50f593a64b9be77b78c3f59395b7ec6450315b91ad6908f2d157dfa7032d5fbe6eb079e92550889fd145023122ec2b521993421fc976c061731f967a954984bd6f2942e509554eda6d40c8a0eed111a3687ae0f2659e7c580820128bc601772f93ae610553ac66cc376d74b21c74eb024cbf75747b524c7da3f90a38fcb8903c465ff35f0ce78f89184375ce9f7aeb0655c5735c41a81190a8eea02e71016427c5017f2352019076a91db272bebfe505e2490edfe2f7d0f4e019d011ffb5c8e7a27e41231bfe1c968e312e1cc9bdfd72508ee6f5bef4243fe0c817a4d5a5de69aa008609bb1a75f7cf92f8da24bfb99fd00fce5db7132f4e58d632756aed98836b1f6c9acad140e6536d4aae5bd11ac4cb0fb70cf2eea457167f94644e15d60bb328be35578b9137600f4e37c153a21f1a2e3ee28fc8d5cf9bec08866c626fc3c39f9414d9d6a2e5cab6fb74c720bbd412a7b0e300cb5ee73af2ef40efe72b7c9579d7ca96442afb98158c9d61e1bcc85bcf77a475b65d9f9c593e785b43fbf39a0541728c18cc075d921a5ac9dcb0967cdadd4d2a101ec82a65659844b92b3f725abf6ec0a56d37de8837def15d41c177b4660905b8476ec2dfea7cf150922488d8b90cef0aec938d56cf9587ed2c1df9b9b1c20d78c32e8464487aede07af634d77fc5918861ed7084b8026303d7e148d2b4bb1ba3947cc2dde64fdcf13bbaf8a913e2e009e681da56d20d114ea8a9a9cfa4dab1063fcc85092d6067b83edc862f358508d66cbf78f5272d0d43cf769abc5176569824171d0d4787fb0db1b180418f31e02da67f2097a320a32b97b874e3f5e7f6813f5c4fea228a52194d0bcaa64efc7ee747d6aa308684f8dc4c7baef00a84339f37fb5278bc8fcac19f2b79d4b89df4fe552fe59e8a606587961586dc240be84c7a3f27f30db0a44d991fc0bfc0e6a279ea8b08f305536a555d93b9524d240c3cfe7558f113fddf688dd46fd8bab9b66c847fdc379207f1dc53dfe4fe4c345e3c87908d988ecb4e182a737ced18beaa9d01db72f933e7f4d8e7cfbba733c16da31909db11b32a03", 0x1000, &(0x7f00000015c0), &(0x7f0000001600), &(0x7f0000001640)="9ce2c7f507bdab193d99744fa40ec1f71e040689f5dab0fdc69aab68d1c2d9364a28ebf3c0d8ce9dcdfeb3") bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001a40)={r6, 0xe0, &(0x7f0000001940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000001780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x7, &(0x7f00000017c0)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000001800)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xf7, &(0x7f0000001840)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000001880), &(0x7f00000018c0), 0x8, 0x8b, 0x8, 0x8, &(0x7f0000001900)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001c40)={&(0x7f0000001a80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xe0, 0xe0, 0x7, [@struct={0xa, 0x7, 0x0, 0x4, 0x1, 0x7fff, [{0x7, 0x4, 0x7}, {0x1, 0x1, 0x9}, {0xa, 0x5, 0x8000}, {0xa, 0x2, 0x8}, {0xf, 0x4, 0x4}, {0x10, 0x1, 0x80000001}, {0xa, 0x1}]}, @var={0xa, 0x0, 0x0, 0xe, 0x1, 0x1}, @const={0xc}, @func_proto={0x0, 0x9, 0x0, 0xd, 0x0, [{}, {0x8, 0x1}, {0x3, 0x4}, {0xa, 0x2}, {0x7, 0x1}, {0x5, 0x4}, {}, {0x8, 0x1}, {0xb, 0x4}]}, @decl_tag={0xc, 0x0, 0x0, 0x11, 0x5, 0x9}]}, {0x0, [0x30, 0x5f, 0x30, 0x30, 0x2e]}}, &(0x7f0000001b80)=""/181, 0xff, 0xb5, 0x1, 0x8, 0x10000}, 0x28) mkdir(&(0x7f0000000000)='./cgroup/file0\x00', 0xd0939199c36b4d28) 803.92198ms ago: executing program 3 (id=7971): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000"], 0xffdd) 661.236874ms ago: executing program 3 (id=7972): perf_event_open(&(0x7f00000002c0)={0x2, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x9, 0x400, 0x6, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0xaf1d, 0x1, @perf_config_ext={0x8, 0x101}, 0xc58, 0x200, 0x5, 0x1, 0x9, 0x9, 0xfffb, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x96, 0x1, 0x0, 0x0, 0x0, 0x2, 0x20460, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200, 0x1, 0x0, 0x0, 0x5, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000005c0)=@bpf_tracing={0x1a, 0x2, &(0x7f0000000380)=ANY=[@ANYBLOB="b70000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x18, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x127ff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x11, 0x0, 0x0) 488.590178ms ago: executing program 3 (id=7973): perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x5, 0x2, 0x0, 0x0, 0x0, 0x4d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x9}, 0x4880}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r2 = bpf$ITER_CREATE(0xb, &(0x7f00000004c0)={r1}, 0x8) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r3}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r4}, &(0x7f00000000c0), &(0x7f0000000140)='%+9llu \x00'}, 0x20) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) 487.423278ms ago: executing program 1 (id=7974): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000500)=ANY=[], 0x50) bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x5, 0x3, 0x3, 0x1, r0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x2, 0x9}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x6, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000440)=ANY=[], 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r2) syz_open_procfs$namespace(0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'bridge0\x00', @random="01000020109b"}) 426.60269ms ago: executing program 0 (id=7975): bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x0, 0x0, 0x0, 0x1, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x5, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000001600)={0x11, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x518}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 408.45532ms ago: executing program 3 (id=7976): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="b40800000000000073113700000000008510000002000000b7ee0000000000009500c20000000000950000120000000081c743a1d83a853dcdde9820ce9a119c939960905e980327f6c99497a987e8c84ed17405bc3aa236b9fa38ad8d6f13f22716999b32dd72c24dd60bf8f82d856a4ff52288ae4c65dde334eab9649cf9db325d224b3eeefce7378e72bf2ab08c3c5d75"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0xb, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5}, [@printk={@p, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x5}, {}, {0x85, 0x0, 0x0, 0x72}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000480)={r1}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x403, 0xf6103, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, @perf_bp={0x0, 0x8}, 0x40, 0x0, 0x0, 0x0, 0x7, 0x0, 0xfffb, 0x0, 0x0, 0x0, 0x800000000}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.sectors\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r4, 0x8b26, &(0x7f0000000140)={'wlan1\x00', @random="ffffff8d0100"}) 322.608582ms ago: executing program 0 (id=7977): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x4}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0xe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff00000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000009500000000000000660a020000000000180100002020782500000000002020207b9af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a0000e2c2d26585000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x25) bpf$ENABLE_STATS(0x20, 0x0, 0x0) perf_event_open(&(0x7f00000007c0)={0x2, 0x80, 0x67, 0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x0, 0x2}, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1}, 0x0, 0xffffffbfffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000dc0)={&(0x7f0000000180)=@generic, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000840)=""/240, 0xf0}, {&(0x7f0000000940)=""/40, 0x28}, {&(0x7f0000000a00)=""/77, 0x4d}, {&(0x7f0000000a80)=""/154, 0x9a}, {&(0x7f0000000b40)=""/170, 0xaa}, {&(0x7f0000000c00)=""/236, 0xec}], 0x6, &(0x7f0000000d80)=""/13, 0xd}, 0x42) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000005"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'wg2\x00'}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x42}, 0x90) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'wg2\x00', @multicast}) bpf$ITER_CREATE(0xb, 0x0, 0x0) 322.388092ms ago: executing program 1 (id=7978): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020692500000000002060207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d00000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r0}, 0xc) 178.379326ms ago: executing program 1 (id=7979): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f00000003c0)={0x2, 0x80, 0x96, 0x1, 0x0, 0x0, 0x0, 0xa16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x2}, 0x1c001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000440)=ANY=[], &(0x7f0000000c00)='GPL\x00'}, 0x75) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380)=r2, 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000000)={r3, r1, 0x4, r1}, 0x10) 178.249816ms ago: executing program 3 (id=7980): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) write$cgroup_devices(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000"], 0xffdd) 91.545708ms ago: executing program 0 (id=7981): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000001c0)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2c0800, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_devices(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 35.173199ms ago: executing program 1 (id=7982): socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x1c1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETCARRIER(r0, 0x400454e2, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8914, &(0x7f0000000080)) 0s ago: executing program 3 (id=7983): ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x3) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}, 0x4000, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="180200000000800000000000fcffffff8500000027000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000170000009500000000000000"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x69) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) kernel console output (not intermixed with test programs): 158.682175][T25745] ? load_image+0x420/0x420 [ 1158.686741][T25745] should_fail_ex+0x394/0x4c0 [ 1158.691473][T25745] should_failslab+0x9/0x20 [ 1158.696273][T25745] slab_pre_alloc_hook+0x59/0x300 [ 1158.701506][T25745] ? mark_lock+0x94/0x320 [ 1158.705974][T25745] kmem_cache_alloc_node+0x5e/0x310 [ 1158.711240][T25745] ? __lock_acquire+0x1431/0x7eb0 [ 1158.716298][T25745] ? __alloc_skb+0x103/0x2c0 [ 1158.721020][T25745] __alloc_skb+0x103/0x2c0 [ 1158.725571][T25745] br_rtr_notify+0x19e/0xa00 [ 1158.730280][T25745] ? br_mdb_notify+0x970/0x970 [ 1158.735081][T25745] ? __irq_work_queue_local+0x13a/0x3b0 [ 1158.740750][T25745] ? verify_lock_unused+0x140/0x140 [ 1158.745996][T25745] br_multicast_add_router+0x4ca/0x5e0 [ 1158.751594][T25745] ? in_dev_get+0x280/0x280 [ 1158.756140][T25745] ? mark_lock+0x94/0x320 [ 1158.760566][T25745] br_multicast_mark_router+0x3b0/0x5a0 [ 1158.766194][T25745] ? br_multicast_add_router+0x5e0/0x5e0 [ 1158.771904][T25745] ? do_raw_spin_lock+0x11f/0x2b0 [ 1158.777063][T25745] ? __rwlock_init+0x150/0x150 [ 1158.781964][T25745] ? br_multicast_set_port_router+0x17d/0xcf0 [ 1158.788251][T25745] br_multicast_set_port_router+0x3d7/0xcf0 [ 1158.794318][T25745] ? br_multicast_set_router+0x3c0/0x3c0 [ 1158.800013][T25745] ? br_port_flags_change+0x19b/0x1f0 [ 1158.805426][T25745] br_setport+0xe7a/0x1680 [ 1158.809890][T25745] ? br_setlink+0x860/0x860 [ 1158.814437][T25745] ? __rwlock_init+0x150/0x150 [ 1158.819241][T25745] ? br_setlink+0x4df/0x860 [ 1158.823782][T25745] br_setlink+0x4f1/0x860 [ 1158.828253][T25745] ? br_vlan_info+0x460/0x460 [ 1158.833010][T25745] ? trace_contention_end+0x39/0xe0 [ 1158.838242][T25745] ? __mutex_lock+0x30d/0xc80 [ 1158.843063][T25745] ? mutex_is_locked+0x12/0x40 [ 1158.847878][T25745] rtnl_bridge_setlink+0x5b2/0x7d0 [ 1158.853035][T25745] ? mutex_lock_nested+0x20/0x20 [ 1158.858017][T25745] ? rtnl_bridge_dellink+0x6f0/0x6f0 [ 1158.863353][T25745] ? rtnl_bridge_dellink+0x6f0/0x6f0 [ 1158.868677][T25745] rtnetlink_rcv_msg+0x843/0xf90 [ 1158.873742][T25745] ? rtnetlink_rcv_msg+0x220/0xf90 [ 1158.878902][T25745] ? rtnetlink_bind+0x80/0x80 [ 1158.883626][T25745] ? perf_trace_preemptirq_template+0xac/0x330 [ 1158.889824][T25745] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1158.896108][T25745] ? lock_chain_count+0x20/0x20 [ 1158.901001][T25745] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1158.906410][T25745] ? lockdep_hardirqs_on+0x98/0x150 [ 1158.911646][T25745] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1158.917147][T25745] ? _local_bh_enable+0xa0/0xa0 [ 1158.922043][T25745] ? __dev_queue_xmit+0x272/0x37e0 [ 1158.927373][T25745] ? __dev_queue_xmit+0x1329/0x37e0 [ 1158.932816][T25745] ? __dev_queue_xmit+0x272/0x37e0 [ 1158.937988][T25745] ? ref_tracker_free+0x686/0x830 [ 1158.943092][T25745] netlink_rcv_skb+0x235/0x4c0 [ 1158.947902][T25745] ? rtnetlink_bind+0x80/0x80 [ 1158.952648][T25745] ? netlink_ack+0x1160/0x1160 [ 1158.957464][T25745] ? __lock_acquire+0x7eb0/0x7eb0 [ 1158.962531][T25745] ? netlink_deliver_tap+0x2e/0x1b0 [ 1158.967768][T25745] netlink_unicast+0x7b1/0x930 [ 1158.972579][T25745] netlink_sendmsg+0x8d0/0xbf0 [ 1158.977392][T25745] ? netlink_getsockopt+0x590/0x590 [ 1158.982632][T25745] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1158.988377][T25745] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1158.993730][T25745] ? security_socket_sendmsg+0x80/0xa0 [ 1158.999414][T25745] ? netlink_getsockopt+0x590/0x590 [ 1159.004751][T25745] ____sys_sendmsg+0x61b/0x980 [ 1159.009564][T25745] ? __asan_memset+0x22/0x40 [ 1159.014219][T25745] ? __sys_sendmsg_sock+0x30/0x30 [ 1159.019372][T25745] ? __import_iovec+0x5f2/0x850 [ 1159.024626][T25745] ? import_iovec+0x73/0xa0 [ 1159.029175][T25745] ___sys_sendmsg+0x2a6/0x360 [ 1159.033889][T25745] ? get_pid_task+0x20/0x1e0 [ 1159.038526][T25745] ? __sys_sendmsg+0x2b0/0x2b0 [ 1159.043376][T25745] ? __lock_acquire+0x7eb0/0x7eb0 [ 1159.048480][T25745] __se_sys_sendmsg+0x1d0/0x2c0 [ 1159.053360][T25745] ? __x64_sys_sendmsg+0x80/0x80 [ 1159.058447][T25745] ? lockdep_hardirqs_on+0x98/0x150 [ 1159.063688][T25745] do_syscall_64+0x55/0xb0 [ 1159.068636][T25745] ? clear_bhb_loop+0x40/0x90 [ 1159.073443][T25745] ? clear_bhb_loop+0x40/0x90 [ 1159.078159][T25745] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1159.084098][T25745] RIP: 0033:0x7fdd9319e1d9 [ 1159.088554][T25745] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1159.108208][T25745] RSP: 002b:00007fdd94082028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1159.116862][T25745] RAX: ffffffffffffffda RBX: 00007fdd93425fa0 RCX: 00007fdd9319e1d9 [ 1159.124969][T25745] RDX: 0000000000098010 RSI: 0000200000000240 RDI: 0000000000000003 [ 1159.132972][T25745] RBP: 00007fdd94082090 R08: 0000000000000000 R09: 0000000000000000 [ 1159.140984][T25745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1159.149085][T25745] R13: 00007fdd93426038 R14: 00007fdd93425fa0 R15: 00007ffdbdd911c8 [ 1159.157257][T25745] [ 1159.253580][T25747] netlink: 'syz.2.7281': attribute type 25 has an invalid length. [ 1161.083780][T25758] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7284'. [ 1161.115344][T25758] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7284'. [ 1161.133474][T25758] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7284'. [ 1161.378837][T25769] FAULT_INJECTION: forcing a failure. [ 1161.378837][T25769] name failslab, interval 1, probability 0, space 0, times 0 [ 1161.440324][T25769] CPU: 0 PID: 25769 Comm: syz.1.7287 Not tainted syzkaller #0 [ 1161.447857][T25769] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1161.458133][T25769] Call Trace: [ 1161.461454][T25769] [ 1161.464504][T25769] dump_stack_lvl+0x18c/0x250 [ 1161.469222][T25769] ? show_regs_print_info+0x20/0x20 [ 1161.474474][T25769] ? load_image+0x420/0x420 [ 1161.479079][T25769] should_fail_ex+0x394/0x4c0 [ 1161.483801][T25769] should_failslab+0x9/0x20 [ 1161.488423][T25769] slab_pre_alloc_hook+0x59/0x300 [ 1161.493485][T25769] ? __debug_object_init+0xec/0x450 [ 1161.498730][T25769] kmem_cache_alloc+0x5a/0x2c0 [ 1161.503568][T25769] ? slab_build_skb+0x28/0x3e0 [ 1161.508376][T25769] slab_build_skb+0x28/0x3e0 [ 1161.513101][T25769] bpf_prog_test_run_skb+0x38f/0x18f0 [ 1161.518528][T25769] ? __fget_files+0x28/0x460 [ 1161.523173][T25769] ? __fget_files+0x3fc/0x460 [ 1161.527892][T25769] ? cpu_online+0x60/0x60 [ 1161.532334][T25769] bpf_prog_test_run+0x31f/0x390 [ 1161.537399][T25769] __sys_bpf+0x49d/0x890 [ 1161.541770][T25769] ? bpf_link_show_fdinfo+0x560/0x560 [ 1161.547196][T25769] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1161.553424][T25769] __x64_sys_bpf+0x7c/0x90 [ 1161.557980][T25769] do_syscall_64+0x55/0xb0 [ 1161.562514][T25769] ? clear_bhb_loop+0x40/0x90 [ 1161.567311][T25769] ? clear_bhb_loop+0x40/0x90 [ 1161.572016][T25769] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1161.578029][T25769] RIP: 0033:0x7f5ed519e1d9 [ 1161.582560][T25769] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1161.602201][T25769] RSP: 002b:00007f5ed5fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1161.610745][T25769] RAX: ffffffffffffffda RBX: 00007f5ed5425fa0 RCX: 00007f5ed519e1d9 [ 1161.619093][T25769] RDX: 0000000000000050 RSI: 00002000000003c0 RDI: 000000000000000a [ 1161.627194][T25769] RBP: 00007f5ed5fc8090 R08: 0000000000000000 R09: 0000000000000000 [ 1161.635188][T25769] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1161.643244][T25769] R13: 00007f5ed5426038 R14: 00007f5ed5425fa0 R15: 00007fff6124d2e8 [ 1161.651280][T25769] [ 1161.855924][T25774] FAULT_INJECTION: forcing a failure. [ 1161.855924][T25774] name failslab, interval 1, probability 0, space 0, times 0 [ 1161.868854][T25774] CPU: 1 PID: 25774 Comm: syz.0.7290 Not tainted syzkaller #0 [ 1161.876372][T25774] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1161.885531][T25771] netlink: 13951 bytes leftover after parsing attributes in process `syz.2.7289'. [ 1161.886486][T25774] Call Trace: [ 1161.886560][T25774] [ 1161.886575][T25774] dump_stack_lvl+0x18c/0x250 [ 1161.886621][T25774] ? show_regs_print_info+0x20/0x20 [ 1161.886652][T25774] ? load_image+0x420/0x420 [ 1161.886678][T25774] ? mark_lock+0x94/0x320 [ 1161.886764][T25774] should_fail_ex+0x394/0x4c0 [ 1161.886821][T25774] should_failslab+0x9/0x20 [ 1161.886849][T25774] slab_pre_alloc_hook+0x59/0x300 [ 1161.935469][T25774] ? mark_lock+0x94/0x320 [ 1161.939837][T25774] kmem_cache_alloc_node+0x5e/0x310 [ 1161.945156][T25774] ? __lock_acquire+0x1431/0x7eb0 [ 1161.950287][T25774] ? __alloc_skb+0x103/0x2c0 [ 1161.954919][T25774] __alloc_skb+0x103/0x2c0 [ 1161.959389][T25774] br_rtr_notify+0x19e/0xa00 [ 1161.964030][T25774] ? br_mdb_notify+0x970/0x970 [ 1161.968813][T25774] ? mark_lock+0x94/0x320 [ 1161.973194][T25774] ? verify_lock_unused+0x140/0x140 [ 1161.978428][T25774] br_multicast_add_router+0x4ca/0x5e0 [ 1161.983937][T25774] ? in_dev_get+0x280/0x280 [ 1161.988479][T25774] ? mark_lock+0x94/0x320 [ 1161.992860][T25774] br_multicast_mark_router+0x3b0/0x5a0 [ 1161.998453][T25774] ? br_multicast_add_router+0x5e0/0x5e0 [ 1162.004103][T25774] ? do_raw_spin_lock+0x11f/0x2b0 [ 1162.009162][T25774] ? __rwlock_init+0x150/0x150 [ 1162.013971][T25774] ? br_multicast_set_port_router+0x17d/0xcf0 [ 1162.020080][T25774] br_multicast_set_port_router+0x3d7/0xcf0 [ 1162.026122][T25774] ? br_multicast_set_router+0x3c0/0x3c0 [ 1162.031823][T25774] ? br_port_flags_change+0x19b/0x1f0 [ 1162.037242][T25774] br_setport+0xe7a/0x1680 [ 1162.041702][T25774] ? br_setlink+0x860/0x860 [ 1162.046331][T25774] ? __rwlock_init+0x150/0x150 [ 1162.051135][T25774] ? br_setlink+0x4df/0x860 [ 1162.055687][T25774] br_setlink+0x4f1/0x860 [ 1162.060061][T25774] ? br_vlan_info+0x460/0x460 [ 1162.064885][T25774] ? trace_contention_end+0x39/0xe0 [ 1162.070134][T25774] ? __mutex_lock+0x30d/0xc80 [ 1162.074946][T25774] ? mutex_is_locked+0x12/0x40 [ 1162.079780][T25774] rtnl_bridge_setlink+0x5b2/0x7d0 [ 1162.084928][T25774] ? mutex_lock_nested+0x20/0x20 [ 1162.089902][T25774] ? rtnl_bridge_dellink+0x6f0/0x6f0 [ 1162.095253][T25774] ? rtnl_bridge_dellink+0x6f0/0x6f0 [ 1162.100562][T25774] rtnetlink_rcv_msg+0x843/0xf90 [ 1162.105656][T25774] ? rtnetlink_rcv_msg+0x220/0xf90 [ 1162.110850][T25774] ? rtnetlink_bind+0x80/0x80 [ 1162.115574][T25774] ? trace_call_bpf+0xc3/0x6c0 [ 1162.120389][T25774] ? trace_call_bpf+0xc3/0x6c0 [ 1162.125187][T25774] ? __lock_acquire+0x7eb0/0x7eb0 [ 1162.130248][T25774] ? __local_bh_enable_ip+0x13a/0x1c0 [ 1162.135667][T25774] ? trace_call_bpf+0xc3/0x6c0 [ 1162.140450][T25774] ? trace_call_bpf+0xc3/0x6c0 [ 1162.145244][T25774] ? trace_call_bpf+0x5e9/0x6c0 [ 1162.150148][T25774] ? trace_call_bpf+0xc3/0x6c0 [ 1162.154973][T25774] ? __dev_queue_xmit+0x272/0x37e0 [ 1162.160219][T25774] ? __dev_queue_xmit+0x1329/0x37e0 [ 1162.165720][T25774] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 1162.172022][T25774] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 1162.177890][T25774] ? perf_trace_lock+0x303/0x3b0 [ 1162.182881][T25774] netlink_rcv_skb+0x235/0x4c0 [ 1162.187675][T25774] ? rtnetlink_bind+0x80/0x80 [ 1162.192382][T25774] ? netlink_ack+0x1160/0x1160 [ 1162.197296][T25774] ? __lock_acquire+0x7eb0/0x7eb0 [ 1162.202465][T25774] ? netlink_deliver_tap+0x2e/0x1b0 [ 1162.207795][T25774] netlink_unicast+0x7b1/0x930 [ 1162.212745][T25774] netlink_sendmsg+0x8d0/0xbf0 [ 1162.217767][T25774] ? netlink_getsockopt+0x590/0x590 [ 1162.223089][T25774] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1162.228685][T25774] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1162.234013][T25774] ? security_socket_sendmsg+0x80/0xa0 [ 1162.239696][T25774] ? netlink_getsockopt+0x590/0x590 [ 1162.245318][T25774] ____sys_sendmsg+0x61b/0x980 [ 1162.250268][T25774] ? __asan_memset+0x22/0x40 [ 1162.254948][T25774] ? __sys_sendmsg_sock+0x30/0x30 [ 1162.260041][T25774] ? __import_iovec+0x5f2/0x850 [ 1162.265059][T25774] ? import_iovec+0x73/0xa0 [ 1162.270001][T25774] ___sys_sendmsg+0x2a6/0x360 [ 1162.274824][T25774] ? __sys_sendmsg+0x2b0/0x2b0 [ 1162.279803][T25774] ? trace_call_bpf+0xc3/0x6c0 [ 1162.284668][T25774] __se_sys_sendmsg+0x1d0/0x2c0 [ 1162.289668][T25774] ? perf_trace_preemptirq_template+0x269/0x330 [ 1162.295966][T25774] ? __x64_sys_sendmsg+0x80/0x80 [ 1162.301086][T25774] ? lockdep_hardirqs_on+0x98/0x150 [ 1162.306326][T25774] do_syscall_64+0x55/0xb0 [ 1162.310771][T25774] ? clear_bhb_loop+0x40/0x90 [ 1162.315474][T25774] ? clear_bhb_loop+0x40/0x90 [ 1162.320184][T25774] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1162.326104][T25774] RIP: 0033:0x7f96a9d9e1d9 [ 1162.330549][T25774] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1162.350798][T25774] RSP: 002b:00007f96aad4f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1162.359623][T25774] RAX: ffffffffffffffda RBX: 00007f96aa025fa0 RCX: 00007f96a9d9e1d9 [ 1162.367662][T25774] RDX: 0000000000098010 RSI: 0000200000000240 RDI: 0000000000000004 [ 1162.375660][T25774] RBP: 00007f96aad4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1162.383677][T25774] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1162.391761][T25774] R13: 00007f96aa026038 R14: 00007f96aa025fa0 R15: 00007ffc0eb31b28 [ 1162.399804][T25774] [ 1162.610110][T25776] validate_nla: 8 callbacks suppressed [ 1162.610132][T25776] netlink: 'syz.1.7291': attribute type 29 has an invalid length. [ 1162.649408][T25776] netlink: 'syz.1.7291': attribute type 29 has an invalid length. [ 1162.670317][T25778] netlink: 'syz.1.7291': attribute type 29 has an invalid length. [ 1162.701379][T25776] netlink: 'syz.1.7291': attribute type 29 has an invalid length. [ 1162.716240][T25776] netlink: 'syz.1.7291': attribute type 29 has an invalid length. [ 1163.290275][T25782] FAULT_INJECTION: forcing a failure. [ 1163.290275][T25782] name failslab, interval 1, probability 0, space 0, times 0 [ 1163.340586][T25782] CPU: 1 PID: 25782 Comm: syz.1.7292 Not tainted syzkaller #0 [ 1163.348113][T25782] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1163.358199][T25782] Call Trace: [ 1163.361496][T25782] [ 1163.364446][T25782] dump_stack_lvl+0x18c/0x250 [ 1163.369175][T25782] ? show_regs_print_info+0x20/0x20 [ 1163.374501][T25782] ? load_image+0x420/0x420 [ 1163.379043][T25782] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1163.385075][T25782] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1163.391269][T25782] should_fail_ex+0x394/0x4c0 [ 1163.395998][T25782] should_failslab+0x9/0x20 [ 1163.400623][T25782] slab_pre_alloc_hook+0x59/0x300 [ 1163.405712][T25782] kmem_cache_alloc+0x5a/0x2c0 [ 1163.410514][T25782] ? slab_build_skb+0x28/0x3e0 [ 1163.415322][T25782] slab_build_skb+0x28/0x3e0 [ 1163.420052][T25782] bpf_prog_test_run_skb+0x38f/0x18f0 [ 1163.425465][T25782] ? __fget_files+0x28/0x460 [ 1163.430092][T25782] ? __fget_files+0x3fc/0x460 [ 1163.434816][T25782] ? cpu_online+0x60/0x60 [ 1163.439183][T25782] bpf_prog_test_run+0x31f/0x390 [ 1163.444160][T25782] __sys_bpf+0x49d/0x890 [ 1163.448448][T25782] ? bpf_link_show_fdinfo+0x560/0x560 [ 1163.453873][T25782] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1163.460075][T25782] __x64_sys_bpf+0x7c/0x90 [ 1163.464537][T25782] do_syscall_64+0x55/0xb0 [ 1163.469078][T25782] ? clear_bhb_loop+0x40/0x90 [ 1163.473804][T25782] ? clear_bhb_loop+0x40/0x90 [ 1163.478520][T25782] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1163.484454][T25782] RIP: 0033:0x7f5ed519e1d9 [ 1163.488901][T25782] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1163.508727][T25782] RSP: 002b:00007f5ed5f86028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1163.517179][T25782] RAX: ffffffffffffffda RBX: 00007f5ed5426180 RCX: 00007f5ed519e1d9 [ 1163.525225][T25782] RDX: 0000000000000048 RSI: 0000200000000080 RDI: 000000000000000a [ 1163.533406][T25782] RBP: 00007f5ed5f86090 R08: 0000000000000000 R09: 0000000000000000 [ 1163.541411][T25782] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1163.549411][T25782] R13: 00007f5ed5426218 R14: 00007f5ed5426180 R15: 00007fff6124d2e8 [ 1163.557607][T25782] [ 1164.469031][T25783] delete_channel: no stack [ 1164.487339][T25787] netlink: 'syz.0.7294': attribute type 2 has an invalid length. [ 1164.500282][T25787] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.7294'. [ 1164.551148][T25788] netlink: 'syz.1.7301': attribute type 3 has an invalid length. [ 1164.572561][T25788] netlink: 'syz.1.7301': attribute type 6 has an invalid length. [ 1164.595198][T25788] netlink: 144448 bytes leftover after parsing attributes in process `syz.1.7301'. [ 1164.922736][T25800] netlink: 'syz.3.7299': attribute type 6 has an invalid length. [ 1164.942142][T25800] netlink: 164 bytes leftover after parsing attributes in process `syz.3.7299'. [ 1165.019345][T25803] netlink: 'syz.0.7300': attribute type 29 has an invalid length. [ 1165.147219][T25805] netlink: 13951 bytes leftover after parsing attributes in process `syz.2.7302'. [ 1165.292367][T25808] FAULT_INJECTION: forcing a failure. [ 1165.292367][T25808] name failslab, interval 1, probability 0, space 0, times 0 [ 1165.367085][T25808] CPU: 1 PID: 25808 Comm: syz.0.7303 Not tainted syzkaller #0 [ 1165.374738][T25808] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1165.384954][T25808] Call Trace: [ 1165.388382][T25808] [ 1165.391358][T25808] dump_stack_lvl+0x18c/0x250 [ 1165.396117][T25808] ? show_regs_print_info+0x20/0x20 [ 1165.401375][T25808] ? load_image+0x420/0x420 [ 1165.405964][T25808] ? verify_lock_unused+0x140/0x140 [ 1165.411308][T25808] ? perf_trace_lock+0x303/0x3b0 [ 1165.416315][T25808] should_fail_ex+0x394/0x4c0 [ 1165.421125][T25808] should_failslab+0x9/0x20 [ 1165.425679][T25808] slab_pre_alloc_hook+0x59/0x300 [ 1165.430758][T25808] kmem_cache_alloc+0x5a/0x2c0 [ 1165.435648][T25808] ? skb_clone+0x1eb/0x370 [ 1165.440110][T25808] skb_clone+0x1eb/0x370 [ 1165.444390][T25808] __netlink_deliver_tap+0x411/0x7f0 [ 1165.449726][T25808] ? netlink_deliver_tap+0x2e/0x1b0 [ 1165.454961][T25808] netlink_deliver_tap+0x19c/0x1b0 [ 1165.460118][T25808] netlink_unicast+0x77b/0x930 [ 1165.464954][T25808] netlink_sendmsg+0x8d0/0xbf0 [ 1165.469782][T25808] ? netlink_getsockopt+0x590/0x590 [ 1165.475206][T25808] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1165.480798][T25808] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1165.486105][T25808] ? security_socket_sendmsg+0x80/0xa0 [ 1165.491594][T25808] ? netlink_getsockopt+0x590/0x590 [ 1165.496825][T25808] ____sys_sendmsg+0x61b/0x980 [ 1165.501629][T25808] ? __asan_memset+0x22/0x40 [ 1165.506246][T25808] ? __sys_sendmsg_sock+0x30/0x30 [ 1165.511292][T25808] ? __import_iovec+0x5f2/0x850 [ 1165.516281][T25808] ? import_iovec+0x73/0xa0 [ 1165.520822][T25808] ___sys_sendmsg+0x2a6/0x360 [ 1165.525554][T25808] ? __sys_sendmsg+0x2b0/0x2b0 [ 1165.530386][T25808] ? __lock_acquire+0x7eb0/0x7eb0 [ 1165.535495][T25808] __se_sys_sendmsg+0x1d0/0x2c0 [ 1165.540379][T25808] ? __x64_sys_sendmsg+0x80/0x80 [ 1165.545380][T25808] ? lockdep_hardirqs_on+0x98/0x150 [ 1165.550613][T25808] do_syscall_64+0x55/0xb0 [ 1165.555049][T25808] ? clear_bhb_loop+0x40/0x90 [ 1165.559749][T25808] ? clear_bhb_loop+0x40/0x90 [ 1165.564968][T25808] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1165.570933][T25808] RIP: 0033:0x7f96a9d9e1d9 [ 1165.575369][T25808] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1165.595002][T25808] RSP: 002b:00007f96aad4f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1165.603532][T25808] RAX: ffffffffffffffda RBX: 00007f96aa025fa0 RCX: 00007f96a9d9e1d9 [ 1165.611547][T25808] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007 [ 1165.619560][T25808] RBP: 00007f96aad4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1165.627563][T25808] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1165.635558][T25808] R13: 00007f96aa026038 R14: 00007f96aa025fa0 R15: 00007ffc0eb31b28 [ 1165.643686][T25808] [ 1166.009574][T25808] netlink: 164 bytes leftover after parsing attributes in process `syz.0.7303'. [ 1166.058540][T25812] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1166.199977][T25817] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7305'. [ 1167.103019][T25834] netlink: 16098 bytes leftover after parsing attributes in process `syz.3.7310'. [ 1167.141516][T25834] hsr0: entered promiscuous mode [ 1167.378055][T25838] FAULT_INJECTION: forcing a failure. [ 1167.378055][T25838] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1167.411041][T25838] CPU: 1 PID: 25838 Comm: syz.2.7312 Not tainted syzkaller #0 [ 1167.418570][T25838] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1167.428742][T25838] Call Trace: [ 1167.432051][T25838] [ 1167.435009][T25838] dump_stack_lvl+0x18c/0x250 [ 1167.439722][T25838] ? show_regs_print_info+0x20/0x20 [ 1167.444954][T25838] ? load_image+0x420/0x420 [ 1167.449493][T25838] ? __might_fault+0xaa/0x120 [ 1167.454194][T25838] ? __lock_acquire+0x7eb0/0x7eb0 [ 1167.459252][T25838] should_fail_ex+0x394/0x4c0 [ 1167.464021][T25838] _copy_from_user+0x2f/0xe0 [ 1167.468641][T25838] br_dev_siocdevprivate+0x119/0x15e0 [ 1167.474057][T25838] ? rcu_is_watching+0x15/0xb0 [ 1167.478870][T25838] ? br_handle_local_finish+0x20/0x20 [ 1167.484272][T25838] ? trace_contention_end+0x39/0xe0 [ 1167.489504][T25838] ? __mutex_lock+0x30d/0xc80 [ 1167.494215][T25838] ? dev_load+0x21/0x1f0 [ 1167.498484][T25838] ? dev_ioctl+0x83c/0x1140 [ 1167.503028][T25838] ? __lock_acquire+0x7eb0/0x7eb0 [ 1167.508137][T25838] ? mutex_lock_nested+0x20/0x20 [ 1167.513097][T25838] ? full_name_hash+0x92/0xe0 [ 1167.517821][T25838] ? dev_ifsioc+0x957/0xc40 [ 1167.522368][T25838] dev_ioctl+0x84c/0x1140 [ 1167.526727][T25838] sock_ioctl+0x74c/0x7e0 [ 1167.531105][T25838] ? sock_poll+0x3e0/0x3e0 [ 1167.535568][T25838] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1167.540537][T25838] ? security_file_ioctl+0x80/0xa0 [ 1167.545677][T25838] ? sock_poll+0x3e0/0x3e0 [ 1167.550126][T25838] __se_sys_ioctl+0xfd/0x170 [ 1167.554755][T25838] do_syscall_64+0x55/0xb0 [ 1167.559200][T25838] ? clear_bhb_loop+0x40/0x90 [ 1167.563906][T25838] ? clear_bhb_loop+0x40/0x90 [ 1167.568699][T25838] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1167.574717][T25838] RIP: 0033:0x7fdd9319e1d9 [ 1167.579246][T25838] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1167.598974][T25838] RSP: 002b:00007fdd94082028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1167.607423][T25838] RAX: ffffffffffffffda RBX: 00007fdd93425fa0 RCX: 00007fdd9319e1d9 [ 1167.615453][T25838] RDX: 0000200000000080 RSI: 00000000000089f0 RDI: 0000000000000004 [ 1167.623465][T25838] RBP: 00007fdd94082090 R08: 0000000000000000 R09: 0000000000000000 [ 1167.631465][T25838] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1167.639478][T25838] R13: 00007fdd93426038 R14: 00007fdd93425fa0 R15: 00007ffdbdd911c8 [ 1167.647489][T25838] [ 1167.750702][T25842] validate_nla: 12 callbacks suppressed [ 1167.750738][T25842] netlink: 'syz.0.7314': attribute type 2 has an invalid length. [ 1167.769684][T25842] netlink: 'syz.0.7314': attribute type 1 has an invalid length. [ 1167.789350][T25842] netlink: 9 bytes leftover after parsing attributes in process `syz.0.7314'. [ 1167.973420][T25849] netlink: 'syz.3.7316': attribute type 29 has an invalid length. [ 1168.006322][T25849] netlink: 'syz.3.7316': attribute type 29 has an invalid length. [ 1168.020167][T25849] netlink: 'syz.3.7316': attribute type 29 has an invalid length. [ 1168.029281][T25849] netlink: 'syz.3.7316': attribute type 29 has an invalid length. [ 1168.040402][T25849] netlink: 'syz.3.7316': attribute type 29 has an invalid length. [ 1168.049488][T25841] delete_channel: no stack [ 1168.155966][T25857] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1168.167531][T25860] netlink: 'syz.2.7328': attribute type 29 has an invalid length. [ 1168.179441][T25860] netlink: 'syz.2.7328': attribute type 29 has an invalid length. [ 1168.190273][T25860] netlink: 'syz.2.7328': attribute type 29 has an invalid length. [ 1168.405612][T25866] netlink: 160 bytes leftover after parsing attributes in process `syz.2.7323'. [ 1169.500926][T25866] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1169.860351][T25881] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1169.882689][T25875] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7326'. [ 1170.051146][T25890] FAULT_INJECTION: forcing a failure. [ 1170.051146][T25890] name failslab, interval 1, probability 0, space 0, times 0 [ 1170.076165][T25890] CPU: 1 PID: 25890 Comm: syz.3.7334 Not tainted syzkaller #0 [ 1170.083697][T25890] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1170.093868][T25890] Call Trace: [ 1170.097169][T25890] [ 1170.100118][T25890] dump_stack_lvl+0x18c/0x250 [ 1170.105000][T25890] ? show_regs_print_info+0x20/0x20 [ 1170.110225][T25890] ? load_image+0x420/0x420 [ 1170.114754][T25890] ? __might_sleep+0xe0/0xe0 [ 1170.119353][T25890] ? __lock_acquire+0x7eb0/0x7eb0 [ 1170.124486][T25890] should_fail_ex+0x394/0x4c0 [ 1170.129180][T25890] should_failslab+0x9/0x20 [ 1170.133695][T25890] slab_pre_alloc_hook+0x59/0x300 [ 1170.138739][T25890] ? kvmalloc_node+0x70/0x180 [ 1170.143520][T25890] ? kvmalloc_node+0x70/0x180 [ 1170.148208][T25890] __kmem_cache_alloc_node+0x53/0x250 [ 1170.153600][T25890] ? kvmalloc_node+0x70/0x180 [ 1170.158289][T25890] __kmalloc_node+0xa6/0x240 [ 1170.162905][T25890] kvmalloc_node+0x70/0x180 [ 1170.167503][T25890] alloc_netdev_mqs+0xa5a/0x1040 [ 1170.172445][T25890] ? synproxy_pernet+0x270/0x270 [ 1170.177441][T25890] vti6_locate+0x5d2/0x770 [ 1170.181958][T25890] ? vti6_parm_from_user+0x250/0x250 [ 1170.187250][T25890] ? __might_fault+0xaa/0x120 [ 1170.191953][T25890] ? __might_fault+0xc6/0x120 [ 1170.196630][T25890] ? __might_fault+0xaa/0x120 [ 1170.201315][T25890] ? vti6_siocdevprivate+0x6cf/0xb80 [ 1170.206611][T25890] vti6_siocdevprivate+0x82b/0xb80 [ 1170.211763][T25890] ? vti6_tnl_xmit+0x19c0/0x19c0 [ 1170.216705][T25890] ? __mutex_lock+0x30d/0xc80 [ 1170.221476][T25890] ? dev_ioctl+0x83c/0x1140 [ 1170.226027][T25890] ? dev_ifsioc+0x957/0xc40 [ 1170.230544][T25890] dev_ioctl+0x84c/0x1140 [ 1170.234884][T25890] sock_ioctl+0x74c/0x7e0 [ 1170.239224][T25890] ? sock_poll+0x3e0/0x3e0 [ 1170.243747][T25890] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1170.248716][T25890] ? security_file_ioctl+0x80/0xa0 [ 1170.253948][T25890] ? sock_poll+0x3e0/0x3e0 [ 1170.258503][T25890] __se_sys_ioctl+0xfd/0x170 [ 1170.263243][T25890] do_syscall_64+0x55/0xb0 [ 1170.267675][T25890] ? clear_bhb_loop+0x40/0x90 [ 1170.272443][T25890] ? clear_bhb_loop+0x40/0x90 [ 1170.277243][T25890] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1170.283152][T25890] RIP: 0033:0x7f25dd59e1d9 [ 1170.287598][T25890] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1170.307392][T25890] RSP: 002b:00007f25de49e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1170.315834][T25890] RAX: ffffffffffffffda RBX: 00007f25dd825fa0 RCX: 00007f25dd59e1d9 [ 1170.323831][T25890] RDX: 0000200000000080 RSI: 00000000000089f1 RDI: 0000000000000004 [ 1170.332073][T25890] RBP: 00007f25de49e090 R08: 0000000000000000 R09: 0000000000000000 [ 1170.340578][T25890] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1170.348659][T25890] R13: 00007f25dd826038 R14: 00007f25dd825fa0 R15: 00007ffe42884368 [ 1170.356655][T25890] [ 1170.992930][T25905] netlink: 160 bytes leftover after parsing attributes in process `syz.1.7338'. [ 1171.258131][T25905] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1172.033377][T21490] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1172.044710][T21490] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1172.053304][T21490] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1172.064726][T21490] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1172.072690][T21490] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1172.081390][T21490] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1172.503258][T25930] chnl_net:caif_netlink_parms(): no params data found [ 1172.601525][T25939] netlink: 13951 bytes leftover after parsing attributes in process `syz.3.7349'. [ 1172.761794][T24301] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1172.973277][T24301] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1173.114958][T25930] bridge0: port 1(bridge_slave_0) entered blocking state [ 1173.122924][T25930] bridge0: port 1(bridge_slave_0) entered disabled state [ 1173.132930][T25930] bridge_slave_0: entered allmulticast mode [ 1173.142356][T25930] bridge_slave_0: entered promiscuous mode [ 1173.220933][T25952] validate_nla: 24 callbacks suppressed [ 1173.220954][T25952] netlink: 'syz.0.7352': attribute type 29 has an invalid length. [ 1173.261761][T24301] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1173.305970][T25930] bridge0: port 2(bridge_slave_1) entered blocking state [ 1173.313197][T25930] bridge0: port 2(bridge_slave_1) entered disabled state [ 1173.323605][T25930] bridge_slave_1: entered allmulticast mode [ 1173.332760][T25930] bridge_slave_1: entered promiscuous mode [ 1173.340651][T25952] netlink: 'syz.0.7352': attribute type 29 has an invalid length. [ 1173.353004][T25953] netlink: 'syz.0.7352': attribute type 29 has an invalid length. [ 1173.377898][T25956] netlink: 'syz.0.7352': attribute type 29 has an invalid length. [ 1173.438450][T24301] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1173.476890][T25952] netlink: 'syz.0.7352': attribute type 29 has an invalid length. [ 1173.574354][T25930] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1173.637692][T25958] netlink: 'syz.3.7354': attribute type 13 has an invalid length. [ 1173.648001][T25958] netlink: 160 bytes leftover after parsing attributes in process `syz.3.7354'. [ 1174.195963][T14257] Bluetooth: hci0: command tx timeout [ 1174.197274][T25958] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1174.279580][T25930] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1174.412713][T25930] team0: Port device team_slave_0 added [ 1176.266223][T14257] Bluetooth: hci0: command tx timeout [ 1176.932507][T25930] team0: Port device team_slave_1 added [ 1177.008448][T25930] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1177.015655][T25930] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1177.095194][T25930] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1177.133324][T25930] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1177.162524][T25930] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1177.193435][T25930] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1177.225012][T25969] FAULT_INJECTION: forcing a failure. [ 1177.225012][T25969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1177.248062][T25969] CPU: 0 PID: 25969 Comm: syz.3.7357 Not tainted syzkaller #0 [ 1177.255674][T25969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1177.265764][T25969] Call Trace: [ 1177.269077][T25969] [ 1177.272046][T25969] dump_stack_lvl+0x18c/0x250 [ 1177.276763][T25969] ? show_regs_print_info+0x20/0x20 [ 1177.282000][T25969] ? load_image+0x420/0x420 [ 1177.286559][T25969] ? __lock_acquire+0x7eb0/0x7eb0 [ 1177.291627][T25969] ? snprintf+0xe9/0x140 [ 1177.295910][T25969] should_fail_ex+0x394/0x4c0 [ 1177.300642][T25969] _copy_to_user+0x2f/0xa0 [ 1177.305107][T25969] simple_read_from_buffer+0xe7/0x150 [ 1177.310535][T25969] proc_fail_nth_read+0x1e8/0x260 [ 1177.315775][T25969] ? proc_fault_inject_write+0x360/0x360 [ 1177.321453][T25969] ? fsnotify_perm+0x271/0x5e0 [ 1177.326353][T25969] ? proc_fault_inject_write+0x360/0x360 [ 1177.332046][T25969] vfs_read+0x298/0x990 [ 1177.336256][T25969] ? kernel_read+0x1e0/0x1e0 [ 1177.340912][T25969] ? __fget_files+0x28/0x460 [ 1177.345877][T25969] ? __fget_files+0x3fc/0x460 [ 1177.350618][T25969] ? __fdget_pos+0x2a3/0x330 [ 1177.355422][T25969] ? ksys_read+0x74/0x260 [ 1177.359867][T25969] ksys_read+0x151/0x260 [ 1177.364125][T25969] ? vfs_write+0x9a0/0x9a0 [ 1177.368563][T25969] ? lockdep_hardirqs_on+0x98/0x150 [ 1177.373789][T25969] do_syscall_64+0x55/0xb0 [ 1177.378314][T25969] ? clear_bhb_loop+0x40/0x90 [ 1177.382987][T25969] ? clear_bhb_loop+0x40/0x90 [ 1177.387677][T25969] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1177.393670][T25969] RIP: 0033:0x7f25dd55ea0e [ 1177.398088][T25969] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1177.417792][T25969] RSP: 002b:00007f25de49dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1177.426213][T25969] RAX: ffffffffffffffda RBX: 00007f25de49e6c0 RCX: 00007f25dd55ea0e [ 1177.434720][T25969] RDX: 000000000000000f RSI: 00007f25de49e0a0 RDI: 0000000000000019 [ 1177.442779][T25969] RBP: 00007f25de49e090 R08: 0000000000000000 R09: 0000000000000000 [ 1177.450956][T25969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1177.458936][T25969] R13: 00007f25dd826038 R14: 00007f25dd825fa0 R15: 00007ffe42884368 [ 1177.466922][T25969] [ 1177.549167][T25930] hsr_slave_0: entered promiscuous mode [ 1177.658751][T25930] hsr_slave_1: entered promiscuous mode [ 1177.719100][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.725982][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.743650][T25930] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1177.754603][T25930] Cannot create hsr debugfs directory [ 1178.278796][T25986] netlink: 'syz.3.7362': attribute type 29 has an invalid length. [ 1178.345557][T14257] Bluetooth: hci0: command tx timeout [ 1178.363538][T25986] netlink: 'syz.3.7362': attribute type 29 has an invalid length. [ 1178.444166][T25988] netlink: 'syz.3.7362': attribute type 29 has an invalid length. [ 1178.609415][T25991] netlink: 'syz.3.7362': attribute type 29 has an invalid length. [ 1178.645570][T25990] netlink: 'syz.1.7361': attribute type 6 has an invalid length. [ 1178.654320][T25990] netlink: 164 bytes leftover after parsing attributes in process `syz.1.7361'. [ 1178.780713][T25986] netlink: 'syz.3.7362': attribute type 29 has an invalid length. [ 1178.895858][T26006] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.7364'. [ 1179.424053][T26012] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7366'. [ 1180.425279][T14257] Bluetooth: hci0: command tx timeout [ 1180.732258][T26037] FAULT_INJECTION: forcing a failure. [ 1180.732258][T26037] name failslab, interval 1, probability 0, space 0, times 0 [ 1180.815423][T26037] CPU: 0 PID: 26037 Comm: syz.3.7371 Not tainted syzkaller #0 [ 1180.823152][T26037] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1180.833263][T26037] Call Trace: [ 1180.836582][T26037] [ 1180.839652][T26037] dump_stack_lvl+0x18c/0x250 [ 1180.844412][T26037] ? show_regs_print_info+0x20/0x20 [ 1180.849681][T26037] ? load_image+0x420/0x420 [ 1180.854351][T26037] ? __might_sleep+0xe0/0xe0 [ 1180.859023][T26037] ? __lock_acquire+0x7eb0/0x7eb0 [ 1180.864216][T26037] should_fail_ex+0x394/0x4c0 [ 1180.868976][T26037] should_failslab+0x9/0x20 [ 1180.873617][T26037] slab_pre_alloc_hook+0x59/0x300 [ 1180.878744][T26037] kmem_cache_alloc+0x5a/0x2c0 [ 1180.883560][T26037] ? getname_flags+0xbb/0x500 [ 1180.888289][T26037] getname_flags+0xbb/0x500 [ 1180.892825][T26037] do_sys_openat2+0xda/0x1d0 [ 1180.897438][T26037] ? perf_trace_preemptirq_template+0x269/0x330 [ 1180.903712][T26037] ? do_sys_open+0xe0/0xe0 [ 1180.908158][T26037] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1180.914254][T26037] ? lock_chain_count+0x20/0x20 [ 1180.919152][T26037] __x64_sys_openat+0x139/0x160 [ 1180.924035][T26037] do_syscall_64+0x55/0xb0 [ 1180.928471][T26037] ? clear_bhb_loop+0x40/0x90 [ 1180.933171][T26037] ? clear_bhb_loop+0x40/0x90 [ 1180.937885][T26037] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1180.943909][T26037] RIP: 0033:0x7f25dd55ea0e [ 1180.948342][T26037] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1180.968067][T26037] RSP: 002b:00007f25de49dec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1180.976637][T26037] RAX: ffffffffffffffda RBX: 00007f25de49e6c0 RCX: 00007f25dd55ea0e [ 1180.984900][T26037] RDX: 0000000000000000 RSI: 00007f25de49df90 RDI: ffffffffffffff9c [ 1180.992891][T26037] RBP: 00007f25de49e090 R08: 0000000000000000 R09: 0000000000000000 [ 1181.000996][T26037] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1181.009020][T26037] R13: 00007f25dd826038 R14: 00007f25dd825fa0 R15: 00007ffe42884368 [ 1181.017337][T26037] [ 1181.416236][T26044] netlink: 'syz.1.7372': attribute type 29 has an invalid length. [ 1181.452191][T26044] netlink: 'syz.1.7372': attribute type 29 has an invalid length. [ 1181.482492][T25930] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1181.513372][T25930] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1181.548068][T26047] netlink: 'syz.1.7372': attribute type 29 has an invalid length. [ 1181.577878][T25930] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1181.590997][T25930] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1181.614543][T26044] netlink: 'syz.1.7372': attribute type 29 has an invalid length. [ 1181.660993][T26052] netlink: 17267 bytes leftover after parsing attributes in process `syz.0.7374'. [ 1181.843648][T24301] bond0: (slave wlan1): Releasing backup interface [ 1182.534645][T24301] hsr_slave_0: left promiscuous mode [ 1182.541126][T24301] hsr_slave_1: left promiscuous mode [ 1182.549420][T24301] batman_adv: batadv0: Interface deactivated: 0 [ 1182.558028][T24301] batman_adv: batadv0: Removing interface: 0 [ 1182.566070][T24301] batman_adv: batadv0: Interface deactivated: veth0_vlan [ 1182.573301][T24301] batman_adv: batadv0: Removing interface: veth0_vlan [ 1182.581674][T24301] bridge0: port 2(team0) entered disabled state [ 1182.603362][T24301] bridge_slave_0: left allmulticast mode [ 1182.610811][T24301] bridge_slave_0: left promiscuous mode [ 1182.617315][T24301] bridge0: port 1(bridge_slave_0) entered disabled state [ 1182.651673][T24301] veth1_macvtap: left promiscuous mode [ 1182.659132][T24301] veth1_vlan: left promiscuous mode [ 1182.664685][T24301] veth0_vlan: left promiscuous mode [ 1182.776494][T26066] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7379'. [ 1184.576750][T24301] bond0 (unregistering): (slave batadv_slave_0): Releasing backup interface [ 1184.701783][T24301] team_slave_1 (unregistering): left promiscuous mode [ 1184.717164][T24301] team_slave_1 (unregistering): left allmulticast mode [ 1184.736588][T24301] team0 (unregistering): Port device team_slave_1 removed [ 1184.835473][T24301] team_slave_0 (unregistering): left promiscuous mode [ 1184.845310][T24301] team_slave_0 (unregistering): left allmulticast mode [ 1184.856532][T24301] team0 (unregistering): Port device team_slave_0 removed [ 1184.932610][T24301] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1185.017417][T24301] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1185.098682][T24301] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1185.578643][T24301] bond0 (unregistering): Released all slaves [ 1185.772638][T25930] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1185.859320][T25930] 8021q: adding VLAN 0 to HW filter on device team0 [ 1185.946074][T26090] bridge0: port 2(bridge_slave_1) entered disabled state [ 1185.953840][T26090] bridge0: port 1(bridge_slave_0) entered disabled state [ 1185.988853][T26093] validate_nla: 2 callbacks suppressed [ 1185.988872][T26093] netlink: 'syz.0.7384': attribute type 29 has an invalid length. [ 1185.992892][T26090] bridge0: entered allmulticast mode [ 1186.087401][T25530] bridge0: port 1(bridge_slave_0) entered blocking state [ 1186.094642][T25530] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1186.105543][T25530] bridge0: port 2(bridge_slave_1) entered blocking state [ 1186.112741][T25530] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1186.135847][T26093] netlink: 'syz.0.7384': attribute type 29 has an invalid length. [ 1186.181982][T26096] netlink: 'syz.0.7384': attribute type 29 has an invalid length. [ 1186.235003][T26097] bridge0: port 2(bridge_slave_1) entered blocking state [ 1186.242259][T26097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1186.249836][T26097] bridge0: port 1(bridge_slave_0) entered blocking state [ 1186.257101][T26097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1186.297115][T26097] bridge0: entered promiscuous mode [ 1186.311866][T26101] netlink: 'syz.0.7384': attribute type 29 has an invalid length. [ 1186.323798][T26093] netlink: 'syz.0.7384': attribute type 29 has an invalid length. [ 1186.428910][T25930] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1187.121755][T25930] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1187.210668][T14257] Bluetooth: hci1: Malformed HCI Event [ 1187.310105][T25930] veth0_vlan: entered promiscuous mode [ 1187.359491][T25930] veth1_vlan: entered promiscuous mode [ 1187.475722][T25930] veth0_macvtap: entered promiscuous mode [ 1187.507941][T25930] veth1_macvtap: entered promiscuous mode [ 1187.609592][T25930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1187.660057][T26131] netlink: 13951 bytes leftover after parsing attributes in process `syz.3.7391'. [ 1187.669965][T25930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1187.697838][T25930] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1187.761235][T25930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1187.803702][T25930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1187.818267][T26135] netlink: 'syz.0.7393': attribute type 29 has an invalid length. [ 1187.835375][T25930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1187.875247][T25930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1187.904790][T25930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1187.935246][T25930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1187.960696][T25930] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1188.002301][T25930] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1188.038103][T25930] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1188.069374][T26135] netlink: 'syz.0.7393': attribute type 29 has an invalid length. [ 1188.107070][T26138] netlink: 'syz.0.7393': attribute type 29 has an invalid length. [ 1188.148285][T25930] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.185981][T25930] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.205238][T25930] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.244412][T25930] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1188.282243][T26140] netlink: 'syz.0.7393': attribute type 29 has an invalid length. [ 1188.315903][T26143] netlink: 'syz.0.7393': attribute type 29 has an invalid length. [ 1188.677253][T25530] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1188.696684][T25530] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1188.847764][ T6437] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1188.931681][T26153] FAULT_INJECTION: forcing a failure. [ 1188.931681][T26153] name failslab, interval 1, probability 0, space 0, times 0 [ 1188.953851][ T6437] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1188.987412][T26153] CPU: 1 PID: 26153 Comm: syz.0.7395 Not tainted syzkaller #0 [ 1188.994943][T26153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1189.005198][T26153] Call Trace: [ 1189.008510][T26153] [ 1189.011472][T26153] dump_stack_lvl+0x18c/0x250 [ 1189.016193][T26153] ? show_regs_print_info+0x20/0x20 [ 1189.021520][T26153] ? load_image+0x420/0x420 [ 1189.026102][T26153] ? __might_sleep+0xe0/0xe0 [ 1189.030735][T26153] ? __lock_acquire+0x7eb0/0x7eb0 [ 1189.035801][T26153] should_fail_ex+0x394/0x4c0 [ 1189.040523][T26153] should_failslab+0x9/0x20 [ 1189.045064][T26153] slab_pre_alloc_hook+0x59/0x300 [ 1189.050133][T26153] ? __get_vm_area_node+0x125/0x370 [ 1189.055366][T26153] __kmem_cache_alloc_node+0x53/0x250 [ 1189.060785][T26153] ? __get_vm_area_node+0x125/0x370 [ 1189.066027][T26153] kmalloc_node_trace+0x26/0xe0 [ 1189.071016][T26153] __get_vm_area_node+0x125/0x370 [ 1189.076088][T26153] __vmalloc_node_range+0x36f/0x1320 [ 1189.081410][T26153] ? netlink_sendmsg+0x602/0xbf0 [ 1189.086385][T26153] ? netlink_insert+0x1094/0x1390 [ 1189.091464][T26153] ? netlink_insert+0x2ba/0x1390 [ 1189.096449][T26153] ? free_vm_area+0x50/0x50 [ 1189.101032][T26153] ? netlink_sendmsg+0x602/0xbf0 [ 1189.106180][T26153] vmalloc+0x79/0x90 [ 1189.110208][T26153] ? netlink_sendmsg+0x602/0xbf0 [ 1189.115218][T26153] netlink_sendmsg+0x602/0xbf0 [ 1189.120031][T26153] ? netlink_getsockopt+0x590/0x590 [ 1189.125384][T26153] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1189.130970][T26153] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1189.136381][T26153] ? security_socket_sendmsg+0x80/0xa0 [ 1189.141876][T26153] ? netlink_getsockopt+0x590/0x590 [ 1189.147116][T26153] ____sys_sendmsg+0x61b/0x980 [ 1189.151927][T26153] ? __asan_memset+0x22/0x40 [ 1189.156567][T26153] ? __sys_sendmsg_sock+0x30/0x30 [ 1189.161626][T26153] ? __import_iovec+0x3fa/0x850 [ 1189.166522][T26153] ? import_iovec+0x73/0xa0 [ 1189.171062][T26153] ___sys_sendmsg+0x2a6/0x360 [ 1189.175970][T26153] ? __sys_sendmsg+0x2b0/0x2b0 [ 1189.180808][T26153] ? ktime_get+0x7f/0x280 [ 1189.185196][T26153] __se_sys_sendmsg+0x1d0/0x2c0 [ 1189.190089][T26153] ? __x64_sys_sendmsg+0x80/0x80 [ 1189.195088][T26153] ? lockdep_hardirqs_on+0x98/0x150 [ 1189.200323][T26153] do_syscall_64+0x55/0xb0 [ 1189.204773][T26153] ? clear_bhb_loop+0x40/0x90 [ 1189.209484][T26153] ? clear_bhb_loop+0x40/0x90 [ 1189.214631][T26153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1189.220578][T26153] RIP: 0033:0x7f96a9d9e1d9 [ 1189.225022][T26153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1189.244745][T26153] RSP: 002b:00007f96aad4f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1189.253200][T26153] RAX: ffffffffffffffda RBX: 00007f96aa025fa0 RCX: 00007f96a9d9e1d9 [ 1189.261303][T26153] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 1189.269400][T26153] RBP: 00007f96aad4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1189.277412][T26153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1189.285475][T26153] R13: 00007f96aa026038 R14: 00007f96aa025fa0 R15: 00007ffc0eb31b28 [ 1189.293488][T26153] [ 1189.330222][T26153] syz.0.7395: vmalloc error: size 213312, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 1189.346377][T26153] CPU: 1 PID: 26153 Comm: syz.0.7395 Not tainted syzkaller #0 [ 1189.353900][T26153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1189.363986][T26153] Call Trace: [ 1189.367282][T26153] [ 1189.370239][T26153] dump_stack_lvl+0x18c/0x250 [ 1189.374928][T26153] ? show_regs_print_info+0x20/0x20 [ 1189.380129][T26153] ? load_image+0x420/0x420 [ 1189.384689][T26153] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1189.391112][T26153] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1189.397726][T26153] warn_alloc+0x246/0x340 [ 1189.402065][T26153] ? __get_vm_area_node+0x125/0x370 [ 1189.407272][T26153] ? zone_watermark_ok_safe+0x230/0x230 [ 1189.412815][T26153] ? rcu_is_watching+0x15/0xb0 [ 1189.417599][T26153] ? __get_vm_area_node+0x356/0x370 [ 1189.422836][T26153] __vmalloc_node_range+0x394/0x1320 [ 1189.428162][T26153] ? netlink_insert+0x1094/0x1390 [ 1189.433221][T26153] ? netlink_insert+0x2ba/0x1390 [ 1189.438195][T26153] ? free_vm_area+0x50/0x50 [ 1189.442720][T26153] ? netlink_sendmsg+0x602/0xbf0 [ 1189.447661][T26153] vmalloc+0x79/0x90 [ 1189.451571][T26153] ? netlink_sendmsg+0x602/0xbf0 [ 1189.456515][T26153] netlink_sendmsg+0x602/0xbf0 [ 1189.461293][T26153] ? netlink_getsockopt+0x590/0x590 [ 1189.466767][T26153] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1189.472330][T26153] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1189.477886][T26153] ? security_socket_sendmsg+0x80/0xa0 [ 1189.483364][T26153] ? netlink_getsockopt+0x590/0x590 [ 1189.488577][T26153] ____sys_sendmsg+0x61b/0x980 [ 1189.493357][T26153] ? __asan_memset+0x22/0x40 [ 1189.497965][T26153] ? __sys_sendmsg_sock+0x30/0x30 [ 1189.503079][T26153] ? __import_iovec+0x3fa/0x850 [ 1189.507984][T26153] ? import_iovec+0x73/0xa0 [ 1189.512499][T26153] ___sys_sendmsg+0x2a6/0x360 [ 1189.517197][T26153] ? __sys_sendmsg+0x2b0/0x2b0 [ 1189.522072][T26153] ? ktime_get+0x7f/0x280 [ 1189.526438][T26153] __se_sys_sendmsg+0x1d0/0x2c0 [ 1189.531298][T26153] ? __x64_sys_sendmsg+0x80/0x80 [ 1189.536254][T26153] ? lockdep_hardirqs_on+0x98/0x150 [ 1189.541630][T26153] do_syscall_64+0x55/0xb0 [ 1189.546184][T26153] ? clear_bhb_loop+0x40/0x90 [ 1189.550953][T26153] ? clear_bhb_loop+0x40/0x90 [ 1189.555722][T26153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1189.561709][T26153] RIP: 0033:0x7f96a9d9e1d9 [ 1189.566129][T26153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1189.586021][T26153] RSP: 002b:00007f96aad4f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1189.594444][T26153] RAX: ffffffffffffffda RBX: 00007f96aa025fa0 RCX: 00007f96a9d9e1d9 [ 1189.602437][T26153] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 1189.610413][T26153] RBP: 00007f96aad4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1189.618419][T26153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1189.626417][T26153] R13: 00007f96aa026038 R14: 00007f96aa025fa0 R15: 00007ffc0eb31b28 [ 1189.634419][T26153] [ 1189.677334][T26153] Mem-Info: [ 1189.680508][T26153] active_anon:15798 inactive_anon:0 isolated_anon:0 [ 1189.680508][T26153] active_file:19156 inactive_file:40399 isolated_file:0 [ 1189.680508][T26153] unevictable:768 dirty:395 writeback:0 [ 1189.680508][T26153] slab_reclaimable:10813 slab_unreclaimable:95890 [ 1189.680508][T26153] mapped:25172 shmem:1361 pagetables:529 [ 1189.680508][T26153] sec_pagetables:0 bounce:0 [ 1189.680508][T26153] kernel_misc_reclaimable:0 [ 1189.680508][T26153] free:1321079 free_pcp:13040 free_cma:0 [ 1189.707702][T26164] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1189.733350][T26164] IPv6: NLM_F_CREATE should be set when creating new route [ 1189.740658][T26164] IPv6: NLM_F_CREATE should be set when creating new route [ 1189.748032][T26164] IPv6: NLM_F_CREATE should be set when creating new route [ 1189.791451][T26153] Node 0 active_anon:63492kB inactive_anon:0kB active_file:76624kB inactive_file:161396kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100788kB dirty:1580kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10464kB pagetables:2216kB sec_pagetables:0kB all_unreclaimable? no [ 1189.828700][T26153] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1189.884247][T26153] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1189.915135][T26153] lowmem_reserve[]: 0 2505 2506 2506 2506 [ 1189.921145][T26153] Node 0 DMA32 free:1373272kB boost:0kB min:34508kB low:43132kB high:51756kB reserved_highatomic:0KB active_anon:63456kB inactive_anon:0kB active_file:76624kB inactive_file:160308kB unevictable:1536kB writepending:1576kB present:3129332kB managed:2569932kB mlocked:0kB bounce:0kB free_pcp:35284kB local_pcp:19008kB free_cma:0kB [ 1189.995497][T26153] lowmem_reserve[]: 0 0 1 1 1 [ 1190.000290][T26153] Node 0 Normal free:4kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:1088kB unevictable:0kB writepending:4kB present:1048576kB managed:1128kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1190.049291][T26153] lowmem_reserve[]: 0 0 0 0 0 [ 1190.085495][T26153] Node 1 Normal free:3895680kB boost:0kB min:55380kB low:69224kB high:83068kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:16804kB local_pcp:7268kB free_cma:0kB [ 1190.150608][T26153] lowmem_reserve[]: 0 0 0 0 0 [ 1190.164729][T26153] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1190.206220][T26153] Node 0 DMA32: 1785*4kB (UM) 797*8kB (UME) 1241*16kB (UE) 203*32kB (ME) 773*64kB (UME) 807*128kB (UME) 442*256kB (UME) 148*512kB (UME) 33*1024kB (UM) 21*2048kB (UME) 223*4096kB (UM) = 1371772kB [ 1190.250331][T26153] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1190.288583][T26153] Node 1 Normal: 228*4kB (UME) 50*8kB (UME) 20*16kB (UME) 39*32kB (UME) 15*64kB (UME) 5*128kB (UM) 2*256kB (UM) 1*512kB (E) 1*1024kB (U) 1*2048kB (U) 949*4096kB (M) = 3895680kB [ 1190.350914][T26153] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1190.375288][T26153] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1190.384739][T26153] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1190.440839][T26153] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1190.474930][T26153] 60918 total pagecache pages [ 1190.513422][T26153] 0 pages in swap cache [ 1190.560314][T26153] Free swap = 124996kB [ 1190.564895][T26153] Total swap = 124996kB [ 1190.605230][T26153] 2097051 pages RAM [ 1190.609126][T26153] 0 pages HighMem/MovableOnly [ 1190.655745][T26153] 421118 pages reserved [ 1190.675968][T26153] 0 pages cma reserved [ 1191.140690][T21490] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1191.163289][T21490] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1191.177448][T21490] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1191.206270][T21490] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1191.221564][T21490] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1191.230533][T21490] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1191.696166][T26200] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7405'. [ 1191.764487][ T6437] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.058657][ T6437] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.134028][T26208] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1192.302691][ T6437] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.515402][ T6437] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1192.710702][T26228] validate_nla: 5 callbacks suppressed [ 1192.710721][T26228] netlink: 'syz.1.7410': attribute type 29 has an invalid length. [ 1192.737304][T26228] netlink: 'syz.1.7410': attribute type 29 has an invalid length. [ 1192.775967][T26230] netlink: 'syz.1.7410': attribute type 29 has an invalid length. [ 1192.896237][T26228] netlink: 'syz.1.7410': attribute type 29 has an invalid length. [ 1193.014293][T26228] netlink: 'syz.1.7410': attribute type 29 has an invalid length. [ 1193.044744][T26190] chnl_net:caif_netlink_parms(): no params data found [ 1193.305448][T21490] Bluetooth: hci2: command tx timeout [ 1194.375787][T26260] can: request_module (can-proto-0) failed. [ 1195.000364][T26280] netlink: 'syz.1.7418': attribute type 29 has an invalid length. [ 1195.395290][T21490] Bluetooth: hci2: command tx timeout [ 1196.703790][T26280] netlink: 'syz.1.7418': attribute type 29 has an invalid length. [ 1197.029198][T26190] bridge0: port 1(bridge_slave_0) entered blocking state [ 1197.052006][T26190] bridge0: port 1(bridge_slave_0) entered disabled state [ 1197.063321][T26190] bridge_slave_0: entered allmulticast mode [ 1197.071304][T26190] bridge_slave_0: entered promiscuous mode [ 1197.374822][T26190] bridge0: port 2(bridge_slave_1) entered blocking state [ 1197.405755][T26190] bridge0: port 2(bridge_slave_1) entered disabled state [ 1197.435375][T26190] bridge_slave_1: entered allmulticast mode [ 1197.442817][T26190] bridge_slave_1: entered promiscuous mode [ 1197.469731][T21490] Bluetooth: hci2: command tx timeout [ 1197.588349][T26190] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1197.611329][T26190] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1197.877185][T26302] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7424'. [ 1198.190534][T26190] team0: Port device team_slave_0 added [ 1198.267220][T26190] team0: Port device team_slave_1 added [ 1198.522921][T26190] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1198.540373][T26190] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1198.664104][T26190] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1198.889991][T26190] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1198.908402][T26328] netlink: 'syz.1.7428': attribute type 29 has an invalid length. [ 1198.917992][T26190] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1198.963932][T26190] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1199.100602][T26328] netlink: 'syz.1.7428': attribute type 29 has an invalid length. [ 1199.114931][T26333] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7429'. [ 1199.191616][T26331] netlink: 'syz.1.7428': attribute type 29 has an invalid length. [ 1199.337761][T26334] netlink: 'syz.1.7428': attribute type 29 has an invalid length. [ 1199.358140][T26336] netlink: 'syz.1.7428': attribute type 29 has an invalid length. [ 1199.531298][T26190] hsr_slave_0: entered promiscuous mode [ 1199.545495][T21490] Bluetooth: hci2: command tx timeout [ 1199.611712][T26190] hsr_slave_1: entered promiscuous mode [ 1199.647849][T26190] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1199.665487][T26190] Cannot create hsr debugfs directory [ 1199.848229][T26340] can: request_module (can-proto-0) failed. [ 1200.255881][T26352] FAULT_INJECTION: forcing a failure. [ 1200.255881][T26352] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1200.283270][T26352] CPU: 0 PID: 26352 Comm: syz.0.7433 Not tainted syzkaller #0 [ 1200.290813][T26352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1200.300900][T26352] Call Trace: [ 1200.304204][T26352] [ 1200.307155][T26352] dump_stack_lvl+0x18c/0x250 [ 1200.311862][T26352] ? show_regs_print_info+0x20/0x20 [ 1200.317085][T26352] ? load_image+0x420/0x420 [ 1200.321706][T26352] ? __might_fault+0xaa/0x120 [ 1200.326413][T26352] ? __lock_acquire+0x7eb0/0x7eb0 [ 1200.331552][T26352] should_fail_ex+0x394/0x4c0 [ 1200.336335][T26352] _copy_from_user+0x2f/0xe0 [ 1200.340957][T26352] __sys_bpf+0x23e/0x890 [ 1200.345208][T26352] ? bpf_link_show_fdinfo+0x560/0x560 [ 1200.350595][T26352] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1200.356765][T26352] __x64_sys_bpf+0x7c/0x90 [ 1200.361205][T26352] do_syscall_64+0x55/0xb0 [ 1200.365891][T26352] ? clear_bhb_loop+0x40/0x90 [ 1200.370777][T26352] ? clear_bhb_loop+0x40/0x90 [ 1200.375475][T26352] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1200.381403][T26352] RIP: 0033:0x7f96a9d9e1d9 [ 1200.385839][T26352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1200.405737][T26352] RSP: 002b:00007f96aad4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1200.414251][T26352] RAX: ffffffffffffffda RBX: 00007f96aa025fa0 RCX: 00007f96a9d9e1d9 [ 1200.422226][T26352] RDX: 0000000000000028 RSI: 0000200000000080 RDI: 000000000000000a [ 1200.430475][T26352] RBP: 00007f96aad4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1200.438557][T26352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1200.446549][T26352] R13: 00007f96aa026038 R14: 00007f96aa025fa0 R15: 00007ffc0eb31b28 [ 1200.454584][T26352] [ 1200.768269][T26362] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7436'. [ 1201.375489][ T6437] hsr_slave_0: left promiscuous mode [ 1201.401340][ T6437] hsr_slave_1: left promiscuous mode [ 1201.422844][T26376] netlink: 'syz.2.7439': attribute type 29 has an invalid length. [ 1201.451499][ T6437] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1201.465723][ T6437] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1201.494091][ T6437] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1201.505428][ T6437] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1201.522669][ T6437] batman_adv: batadv0: Interface deactivated: veth0_vlan [ 1201.531850][ T6437] batman_adv: batadv0: Removing interface: veth0_vlan [ 1201.551238][ T6437] batman_adv: batadv0: Interface deactivated: vlan1 [ 1201.568647][ T6437] batman_adv: batadv0: Removing interface: vlan1 [ 1201.588417][ T6437] bridge0: port 2(team0) entered disabled state [ 1201.642117][ T6437] bridge_slave_0: left allmulticast mode [ 1201.660959][ T6437] bridge_slave_0: left promiscuous mode [ 1201.710647][ T6437] bridge0: port 1(bridge_slave_0) entered disabled state [ 1201.813362][ T6437] veth1_macvtap: left promiscuous mode [ 1201.819631][ T6437] veth1_vlan: left promiscuous mode [ 1201.829049][ T6437] veth0_vlan: left promiscuous mode [ 1202.200720][T26389] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7442'. [ 1203.108118][ T6437] team_slave_1 (unregistering): left promiscuous mode [ 1203.115603][ T6437] team_slave_1 (unregistering): left allmulticast mode [ 1203.129207][ T6437] team0 (unregistering): Port device team_slave_1 removed [ 1203.179638][ T6437] team_slave_0 (unregistering): left promiscuous mode [ 1203.189894][ T6437] team_slave_0 (unregistering): left allmulticast mode [ 1203.199531][ T6437] team0 (unregistering): Port device team_slave_0 removed [ 1203.702774][T26376] netlink: 'syz.2.7439': attribute type 29 has an invalid length. [ 1203.838493][T26394] netlink: 'syz.1.7443': attribute type 29 has an invalid length. [ 1203.991562][T26394] netlink: 'syz.1.7443': attribute type 29 has an invalid length. [ 1204.010834][T26398] netlink: 'syz.1.7443': attribute type 29 has an invalid length. [ 1204.020866][T26400] netlink: 'syz.1.7443': attribute type 29 has an invalid length. [ 1204.029071][T26402] netlink: 'syz.1.7443': attribute type 29 has an invalid length. [ 1204.291076][T26405] netlink: 'syz.1.7453': attribute type 29 has an invalid length. [ 1204.316108][T26405] netlink: 'syz.1.7453': attribute type 29 has an invalid length. [ 1204.365368][T26405] netlink: 'syz.1.7453': attribute type 29 has an invalid length. [ 1204.470857][T26405] netlink: 'syz.1.7453': attribute type 29 has an invalid length. [ 1204.487092][T26414] netlink: 'syz.1.7453': attribute type 29 has an invalid length. [ 1204.541437][T26190] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1204.608484][T26190] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1204.647441][T26190] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1204.694676][T26190] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1204.732840][T26418] syzkaller0: entered promiscuous mode [ 1204.771826][T26418] syzkaller0: entered allmulticast mode [ 1204.889073][T26427] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7450'. [ 1205.130098][T26434] netlink: 'syz.2.7452': attribute type 29 has an invalid length. [ 1205.301805][T26190] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1205.403518][T26190] 8021q: adding VLAN 0 to HW filter on device team0 [ 1205.453305][T25532] bridge0: port 1(bridge_slave_0) entered blocking state [ 1205.460593][T25532] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1205.552631][T25529] bridge0: port 2(bridge_slave_1) entered blocking state [ 1205.560185][T25529] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1206.214277][T26452] netlink: 13951 bytes leftover after parsing attributes in process `syz.2.7457'. [ 1206.552092][T26190] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1206.859172][T26190] veth0_vlan: entered promiscuous mode [ 1206.899311][T26190] veth1_vlan: entered promiscuous mode [ 1207.011121][T26190] veth0_macvtap: entered promiscuous mode [ 1207.029781][T26190] veth1_macvtap: entered promiscuous mode [ 1207.074016][T26190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1207.092665][T26190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1207.123232][T26190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1207.134355][T26190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1207.147465][T26190] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1207.169588][T26190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1207.183214][T26190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1207.194468][T26190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1207.205571][T26190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1207.216224][T26190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1207.227622][T26190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1207.238003][T26190] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1207.248863][T26190] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1207.261350][T26190] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1207.281542][T26190] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.298027][T26190] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.310911][T26190] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.323807][T26190] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1207.432464][T24301] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1207.453649][T24301] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1207.500720][T24301] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1207.518066][T24301] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1207.936267][T26485] syzkaller0: entered promiscuous mode [ 1207.943274][T26485] syzkaller0: entered allmulticast mode [ 1208.870968][T26501] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7473'. [ 1209.331529][T26513] validate_nla: 14 callbacks suppressed [ 1209.331550][T26513] netlink: 'syz.0.7476': attribute type 29 has an invalid length. [ 1209.412931][T26513] netlink: 'syz.0.7476': attribute type 29 has an invalid length. [ 1209.476913][T26517] netlink: 13951 bytes leftover after parsing attributes in process `syz.2.7463'. [ 1209.490086][T26518] netlink: 'syz.0.7476': attribute type 29 has an invalid length. [ 1209.567205][T26513] netlink: 'syz.0.7476': attribute type 29 has an invalid length. [ 1209.598158][T26513] netlink: 'syz.0.7476': attribute type 29 has an invalid length. [ 1209.599221][T26515] netlink: 13951 bytes leftover after parsing attributes in process `syz.3.7465'. [ 1210.499758][T26530] netlink: 'syz.1.7467': attribute type 29 has an invalid length. [ 1210.515595][T26530] netlink: 'syz.1.7467': attribute type 29 has an invalid length. [ 1210.531561][T26530] netlink: 'syz.1.7467': attribute type 29 has an invalid length. [ 1210.540186][T26530] netlink: 'syz.1.7467': attribute type 29 has an invalid length. [ 1210.556575][T26530] netlink: 'syz.1.7467': attribute type 29 has an invalid length. [ 1210.780950][T26543] bridge_slave_1: left allmulticast mode [ 1210.795966][T26543] bridge_slave_1: left promiscuous mode [ 1210.802816][T26543] bridge0: port 2(bridge_slave_1) entered disabled state [ 1211.116667][T26551] syzkaller0: entered promiscuous mode [ 1211.131283][T26551] syzkaller0: entered allmulticast mode [ 1211.276691][T26558] netlink: 13951 bytes leftover after parsing attributes in process `syz.3.7481'. [ 1212.327997][T26564] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7482'. [ 1213.688222][T26591] FAULT_INJECTION: forcing a failure. [ 1213.688222][T26591] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1213.716757][T26591] CPU: 0 PID: 26591 Comm: syz.0.7493 Not tainted syzkaller #0 [ 1213.724379][T26591] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1213.734459][T26591] Call Trace: [ 1213.737747][T26591] [ 1213.740703][T26591] dump_stack_lvl+0x18c/0x250 [ 1213.745390][T26591] ? show_regs_print_info+0x20/0x20 [ 1213.750592][T26591] ? load_image+0x420/0x420 [ 1213.755104][T26591] ? __might_fault+0xaa/0x120 [ 1213.759797][T26591] ? __lock_acquire+0x7eb0/0x7eb0 [ 1213.764872][T26591] should_fail_ex+0x394/0x4c0 [ 1213.769656][T26591] _copy_from_user+0x2f/0xe0 [ 1213.774253][T26591] __sys_bpf+0x23e/0x890 [ 1213.778594][T26591] ? bpf_link_show_fdinfo+0x560/0x560 [ 1213.784068][T26591] ? lock_chain_count+0x20/0x20 [ 1213.788933][T26591] __x64_sys_bpf+0x7c/0x90 [ 1213.793370][T26591] do_syscall_64+0x55/0xb0 [ 1213.797789][T26591] ? clear_bhb_loop+0x40/0x90 [ 1213.802505][T26591] ? clear_bhb_loop+0x40/0x90 [ 1213.807200][T26591] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1213.813277][T26591] RIP: 0033:0x7f96a9d9e1d9 [ 1213.817704][T26591] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1213.837436][T26591] RSP: 002b:00007f96aad4f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1213.845858][T26591] RAX: ffffffffffffffda RBX: 00007f96aa025fa0 RCX: 00007f96a9d9e1d9 [ 1213.853979][T26591] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 1213.861952][T26591] RBP: 00007f96aad4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1213.869920][T26591] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1213.878171][T26591] R13: 00007f96aa026038 R14: 00007f96aa025fa0 R15: 00007ffc0eb31b28 [ 1213.886275][T26591] [ 1214.154930][T26602] syzkaller0: entered promiscuous mode [ 1214.162094][T26602] syzkaller0: entered allmulticast mode [ 1214.337068][T26605] validate_nla: 19 callbacks suppressed [ 1214.337085][T26605] netlink: 'syz.0.7507': attribute type 29 has an invalid length. [ 1214.415684][T26605] netlink: 'syz.0.7507': attribute type 29 has an invalid length. [ 1214.525078][T26607] netlink: 13951 bytes leftover after parsing attributes in process `syz.2.7499'. [ 1215.014260][T26617] netlink: 13951 bytes leftover after parsing attributes in process `syz.3.7503'. [ 1215.425346][T26622] netlink: 'syz.0.7504': attribute type 5 has an invalid length. [ 1215.472034][T26622] netlink: 156 bytes leftover after parsing attributes in process `syz.0.7504'. [ 1215.917664][T26632] FAULT_INJECTION: forcing a failure. [ 1215.917664][T26632] name failslab, interval 1, probability 0, space 0, times 0 [ 1215.930571][T26632] CPU: 1 PID: 26632 Comm: syz.1.7506 Not tainted syzkaller #0 [ 1215.938160][T26632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1215.948511][T26632] Call Trace: [ 1215.951917][T26632] [ 1215.955027][T26632] dump_stack_lvl+0x18c/0x250 [ 1215.959761][T26632] ? show_regs_print_info+0x20/0x20 [ 1215.965088][T26632] ? load_image+0x420/0x420 [ 1215.969624][T26632] ? verify_lock_unused+0x140/0x140 [ 1215.974953][T26632] should_fail_ex+0x394/0x4c0 [ 1215.979673][T26632] should_failslab+0x9/0x20 [ 1215.984215][T26632] slab_pre_alloc_hook+0x59/0x300 [ 1215.989369][T26632] kmem_cache_alloc+0x5a/0x2c0 [ 1215.994173][T26632] ? skb_clone+0x1eb/0x370 [ 1215.998634][T26632] skb_clone+0x1eb/0x370 [ 1216.002994][T26632] __netlink_deliver_tap+0x411/0x7f0 [ 1216.008422][T26632] ? netlink_deliver_tap+0x2e/0x1b0 [ 1216.013748][T26632] netlink_deliver_tap+0x19c/0x1b0 [ 1216.019024][T26632] netlink_unicast+0x77b/0x930 [ 1216.023804][T26632] netlink_sendmsg+0x8d0/0xbf0 [ 1216.028588][T26632] ? netlink_getsockopt+0x590/0x590 [ 1216.033806][T26632] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1216.039414][T26632] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1216.044845][T26632] ? security_socket_sendmsg+0x80/0xa0 [ 1216.050484][T26632] ? netlink_getsockopt+0x590/0x590 [ 1216.055698][T26632] ____sys_sendmsg+0x61b/0x980 [ 1216.060619][T26632] ? __asan_memset+0x22/0x40 [ 1216.065270][T26632] ? __sys_sendmsg_sock+0x30/0x30 [ 1216.070484][T26632] ? __import_iovec+0x5f2/0x850 [ 1216.075440][T26632] ? import_iovec+0x73/0xa0 [ 1216.080308][T26632] ___sys_sendmsg+0x2a6/0x360 [ 1216.085011][T26632] ? get_pid_task+0x20/0x1e0 [ 1216.089611][T26632] ? __sys_sendmsg+0x2b0/0x2b0 [ 1216.094409][T26632] ? __lock_acquire+0x7eb0/0x7eb0 [ 1216.099551][T26632] __se_sys_sendmsg+0x1d0/0x2c0 [ 1216.104598][T26632] ? __x64_sys_sendmsg+0x80/0x80 [ 1216.109753][T26632] ? lockdep_hardirqs_on+0x98/0x150 [ 1216.114974][T26632] do_syscall_64+0x55/0xb0 [ 1216.119397][T26632] ? clear_bhb_loop+0x40/0x90 [ 1216.124079][T26632] ? clear_bhb_loop+0x40/0x90 [ 1216.128850][T26632] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1216.135013][T26632] RIP: 0033:0x7f5ed519e1d9 [ 1216.139616][T26632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1216.159317][T26632] RSP: 002b:00007f5ed5fc8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1216.167830][T26632] RAX: ffffffffffffffda RBX: 00007f5ed5425fa0 RCX: 00007f5ed519e1d9 [ 1216.175820][T26632] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000003 [ 1216.183806][T26632] RBP: 00007f5ed5fc8090 R08: 0000000000000000 R09: 0000000000000000 [ 1216.191780][T26632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1216.199799][T26632] R13: 00007f5ed5426038 R14: 00007f5ed5425fa0 R15: 00007fff6124d2e8 [ 1216.207888][T26632] [ 1216.231439][T26632] netlink: 'syz.1.7506': attribute type 10 has an invalid length. [ 1216.253450][T26632] bridge_slave_1: left allmulticast mode [ 1216.284527][T26632] bridge_slave_1: left promiscuous mode [ 1216.300879][T26632] bridge0: port 2(bridge_slave_1) entered disabled state [ 1216.367549][T26639] netlink: 'syz.0.7511': attribute type 29 has an invalid length. [ 1216.385641][T26639] netlink: 'syz.0.7511': attribute type 29 has an invalid length. [ 1216.406913][T26639] netlink: 'syz.0.7511': attribute type 29 has an invalid length. [ 1216.424241][T26639] netlink: 'syz.0.7511': attribute type 29 has an invalid length. [ 1216.452692][T26639] netlink: 'syz.0.7511': attribute type 29 has an invalid length. [ 1216.527566][T26642] netlink: 55631 bytes leftover after parsing attributes in process `syz.3.7512'. [ 1216.551595][T26642] netlink: 6320 bytes leftover after parsing attributes in process `syz.3.7512'. [ 1216.575236][T26642] tc_dump_action: action bad kind [ 1217.351287][T26660] netlink: 13951 bytes leftover after parsing attributes in process `syz.1.7518'. [ 1218.218197][T26670] netlink: 'syz.3.7522': attribute type 10 has an invalid length. [ 1218.234832][T26670] veth1_macvtap: left promiscuous mode [ 1219.726693][T26702] netlink: 13951 bytes leftover after parsing attributes in process `syz.0.7533'. [ 1219.862406][T26708] validate_nla: 10 callbacks suppressed [ 1219.862429][T26708] netlink: 'syz.1.7535': attribute type 29 has an invalid length. [ 1219.926792][T26708] netlink: 'syz.1.7535': attribute type 29 has an invalid length. [ 1220.014896][T26710] netlink: 'syz.1.7535': attribute type 29 has an invalid length. [ 1220.066243][T26711] netlink: 'syz.1.7535': attribute type 29 has an invalid length. [ 1220.096550][T26708] netlink: 'syz.1.7535': attribute type 29 has an invalid length. [ 1220.171451][T26713] FAULT_INJECTION: forcing a failure. [ 1220.171451][T26713] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1220.257560][T26713] CPU: 1 PID: 26713 Comm: syz.3.7536 Not tainted syzkaller #0 [ 1220.265120][T26713] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1220.275237][T26713] Call Trace: [ 1220.278568][T26713] [ 1220.281566][T26713] dump_stack_lvl+0x18c/0x250 [ 1220.286448][T26713] ? show_regs_print_info+0x20/0x20 [ 1220.291752][T26713] ? load_image+0x420/0x420 [ 1220.296346][T26713] ? __might_fault+0xaa/0x120 [ 1220.301138][T26713] ? __lock_acquire+0x7eb0/0x7eb0 [ 1220.306359][T26713] ? __virt_addr_valid+0x10c/0x380 [ 1220.311586][T26713] should_fail_ex+0x394/0x4c0 [ 1220.316445][T26713] _copy_from_user+0x2f/0xe0 [ 1220.321405][T26713] ioctl_standard_iw_point+0x5f8/0xd50 [ 1220.327088][T26713] ? cfg80211_wext_giwauth+0x10/0x10 [ 1220.332474][T26713] ? iw_handler_get_iwstats+0x110/0x110 [ 1220.338277][T26713] ? wext_ioctl_dispatch+0x106/0x650 [ 1220.343807][T26713] ? mutex_lock_nested+0x20/0x20 [ 1220.348816][T26713] ? apparmor_capable+0x137/0x1a0 [ 1220.353942][T26713] ioctl_standard_call+0xae/0x250 [ 1220.359050][T26713] ? cfg80211_wext_giwauth+0x10/0x10 [ 1220.364392][T26713] ? cfg80211_wext_giwauth+0x10/0x10 [ 1220.369747][T26713] wext_ioctl_dispatch+0x51a/0x650 [ 1220.374932][T26713] ? __lock_acquire+0x7eb0/0x7eb0 [ 1220.380025][T26713] ? wext_ioctl_dispatch+0x650/0x650 [ 1220.385379][T26713] ? iw_handler_get_private+0x1f0/0x1f0 [ 1220.390991][T26713] ? wext_handle_ioctl+0x1e0/0x1e0 [ 1220.396676][T26713] ? __might_fault+0xaa/0x120 [ 1220.401479][T26713] ? __might_fault+0xc6/0x120 [ 1220.406226][T26713] ? __might_fault+0xaa/0x120 [ 1220.410966][T26713] wext_handle_ioctl+0x118/0x1e0 [ 1220.416173][T26713] ? call_commit_handler+0xf0/0xf0 [ 1220.421363][T26713] sock_ioctl+0x15d/0x7e0 [ 1220.425738][T26713] ? sock_poll+0x3e0/0x3e0 [ 1220.430206][T26713] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1220.435199][T26713] ? security_file_ioctl+0x80/0xa0 [ 1220.440343][T26713] ? sock_poll+0x3e0/0x3e0 [ 1220.444769][T26713] __se_sys_ioctl+0xfd/0x170 [ 1220.449384][T26713] do_syscall_64+0x55/0xb0 [ 1220.453928][T26713] ? clear_bhb_loop+0x40/0x90 [ 1220.458637][T26713] ? clear_bhb_loop+0x40/0x90 [ 1220.463353][T26713] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1220.469285][T26713] RIP: 0033:0x7f3813b9e1d9 [ 1220.473739][T26713] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1220.493381][T26713] RSP: 002b:00007f38149f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1220.502021][T26713] RAX: ffffffffffffffda RBX: 00007f3813e25fa0 RCX: 00007f3813b9e1d9 [ 1220.510039][T26713] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 1220.518049][T26713] RBP: 00007f38149f0090 R08: 0000000000000000 R09: 0000000000000000 [ 1220.526138][T26713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1220.534145][T26713] R13: 00007f3813e26038 R14: 00007f3813e25fa0 R15: 00007ffef1086768 [ 1220.542254][T26713] [ 1220.681766][T26726] netlink: 'syz.1.7541': attribute type 29 has an invalid length. [ 1220.708547][T26726] netlink: 'syz.1.7541': attribute type 29 has an invalid length. [ 1220.744474][T26726] netlink: 'syz.1.7541': attribute type 29 has an invalid length. [ 1220.758796][T26726] netlink: 'syz.1.7541': attribute type 29 has an invalid length. [ 1220.776996][T26726] netlink: 'syz.1.7541': attribute type 29 has an invalid length. [ 1221.915030][T21490] Bluetooth: hci0: ISO packet for unknown connection handle 2622 [ 1222.279837][T26749] netlink: 184116 bytes leftover after parsing attributes in process `syz.2.7553'. [ 1223.770752][T26773] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.7562'. [ 1223.849216][T26775] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.7562'. [ 1224.124888][T26780] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7563'. [ 1224.137847][T26780] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7563'. [ 1224.876526][T26794] validate_nla: 35 callbacks suppressed [ 1224.876547][T26794] netlink: 'syz.0.7576': attribute type 29 has an invalid length. [ 1224.895548][T26794] netlink: 'syz.0.7576': attribute type 29 has an invalid length. [ 1224.909946][T26794] netlink: 'syz.0.7576': attribute type 29 has an invalid length. [ 1224.919101][T26794] netlink: 'syz.0.7576': attribute type 29 has an invalid length. [ 1224.928897][T26794] netlink: 'syz.0.7576': attribute type 29 has an invalid length. [ 1224.962380][T26795] netlink: 'syz.2.7568': attribute type 29 has an invalid length. [ 1224.976176][T26795] netlink: 'syz.2.7568': attribute type 29 has an invalid length. [ 1225.000678][T26795] netlink: 'syz.2.7568': attribute type 29 has an invalid length. [ 1225.037674][T26795] netlink: 'syz.2.7568': attribute type 29 has an invalid length. [ 1225.059241][T26795] netlink: 'syz.2.7568': attribute type 29 has an invalid length. [ 1225.382702][T26810] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.7577'. [ 1226.251823][T26833] FAULT_INJECTION: forcing a failure. [ 1226.251823][T26833] name failslab, interval 1, probability 0, space 0, times 0 [ 1226.281420][T26833] CPU: 1 PID: 26833 Comm: syz.1.7586 Not tainted syzkaller #0 [ 1226.288986][T26833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1226.299189][T26833] Call Trace: [ 1226.302516][T26833] [ 1226.305497][T26833] dump_stack_lvl+0x18c/0x250 [ 1226.310259][T26833] ? show_regs_print_info+0x20/0x20 [ 1226.315515][T26833] ? load_image+0x420/0x420 [ 1226.320091][T26833] ? __might_sleep+0xe0/0xe0 [ 1226.324745][T26833] ? __lock_acquire+0x7eb0/0x7eb0 [ 1226.329841][T26833] ? perf_swevent_get_recursion_context+0xde/0x150 [ 1226.336500][T26833] should_fail_ex+0x394/0x4c0 [ 1226.341316][T26833] should_failslab+0x9/0x20 [ 1226.345870][T26833] slab_pre_alloc_hook+0x59/0x300 [ 1226.350932][T26833] kmem_cache_alloc_node+0x5e/0x310 [ 1226.356336][T26833] ? __alloc_skb+0x103/0x2c0 [ 1226.360977][T26833] __alloc_skb+0x103/0x2c0 [ 1226.365434][T26833] alloc_skb_with_frags+0xcd/0x7a0 [ 1226.370669][T26833] ? trace_call_bpf+0xc3/0x6c0 [ 1226.375661][T26833] ? __lock_acquire+0x7eb0/0x7eb0 [ 1226.380925][T26833] sock_alloc_send_pskb+0x883/0x9a0 [ 1226.386408][T26833] ? sock_kzfree_s+0x50/0x50 [ 1226.391083][T26833] tun_get_user+0xa44/0x3d30 [ 1226.396058][T26833] ? trace_event_raw_event_lock+0x240/0x240 [ 1226.402338][T26833] ? aa_file_perm+0x3e3/0xee0 [ 1226.407056][T26833] ? rcu_read_unlock+0xa0/0xa0 [ 1226.412002][T26833] ? tun_get+0x1c/0x2e0 [ 1226.416200][T26833] ? __lock_acquire+0x7eb0/0x7eb0 [ 1226.421787][T26833] ? tun_get+0x1c/0x2e0 [ 1226.425994][T26833] tun_chr_write_iter+0x119/0x200 [ 1226.431066][T26833] vfs_write+0x474/0x9a0 [ 1226.435359][T26833] ? file_end_write+0x250/0x250 [ 1226.440343][T26833] ? __fget_files+0x3fc/0x460 [ 1226.445124][T26833] ? __fdget_pos+0x1d8/0x330 [ 1226.450061][T26833] ? ksys_write+0x74/0x260 [ 1226.454561][T26833] ksys_write+0x151/0x260 [ 1226.458960][T26833] ? __ia32_sys_read+0x90/0x90 [ 1226.463960][T26833] ? lockdep_hardirqs_on+0x98/0x150 [ 1226.469191][T26833] do_syscall_64+0x55/0xb0 [ 1226.473647][T26833] ? clear_bhb_loop+0x40/0x90 [ 1226.478443][T26833] ? clear_bhb_loop+0x40/0x90 [ 1226.483246][T26833] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1226.489196][T26833] RIP: 0033:0x7f5ed519e1d9 [ 1226.493729][T26833] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1226.513448][T26833] RSP: 002b:00007f5ed5fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1226.521900][T26833] RAX: ffffffffffffffda RBX: 00007f5ed5425fa0 RCX: 00007f5ed519e1d9 [ 1226.529997][T26833] RDX: 000000000000fdef RSI: 0000200000000300 RDI: 00000000000000c8 [ 1226.538012][T26833] RBP: 00007f5ed5fc8090 R08: 0000000000000000 R09: 0000000000000000 [ 1226.546179][T26833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1226.554169][T26833] R13: 00007f5ed5426038 R14: 00007f5ed5425fa0 R15: 00007fff6124d2e8 [ 1226.562218][T26833] [ 1229.369254][T26880] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.7604'. [ 1229.599991][T26882] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.7604'. [ 1230.235163][T26892] validate_nla: 38 callbacks suppressed [ 1230.235181][T26892] netlink: 'syz.3.7608': attribute type 29 has an invalid length. [ 1230.296711][T26892] netlink: 'syz.3.7608': attribute type 29 has an invalid length. [ 1230.318140][T26895] netlink: 'syz.3.7608': attribute type 29 has an invalid length. [ 1230.341020][T26892] netlink: 'syz.3.7608': attribute type 29 has an invalid length. [ 1230.376946][T26892] netlink: 'syz.3.7608': attribute type 29 has an invalid length. [ 1230.936609][T26904] netlink: 'syz.3.7612': attribute type 29 has an invalid length. [ 1230.961741][T26904] netlink: 'syz.3.7612': attribute type 29 has an invalid length. [ 1230.994334][T26905] netlink: 'syz.3.7612': attribute type 29 has an invalid length. [ 1231.034598][T26904] netlink: 'syz.3.7612': attribute type 29 has an invalid length. [ 1231.068837][T26907] FAULT_INJECTION: forcing a failure. [ 1231.068837][T26907] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1231.076037][T26904] netlink: 'syz.3.7612': attribute type 29 has an invalid length. [ 1231.094996][T26907] CPU: 0 PID: 26907 Comm: syz.1.7613 Not tainted syzkaller #0 [ 1231.102516][T26907] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1231.112665][T26907] Call Trace: [ 1231.115976][T26907] [ 1231.118986][T26907] dump_stack_lvl+0x18c/0x250 [ 1231.123698][T26907] ? show_regs_print_info+0x20/0x20 [ 1231.129014][T26907] ? load_image+0x420/0x420 [ 1231.133544][T26907] ? __might_fault+0xaa/0x120 [ 1231.138289][T26907] ? __lock_acquire+0x7eb0/0x7eb0 [ 1231.143325][T26907] ? __virt_addr_valid+0x10c/0x380 [ 1231.148454][T26907] should_fail_ex+0x394/0x4c0 [ 1231.153211][T26907] _copy_from_user+0x2f/0xe0 [ 1231.157911][T26907] xfrm_user_policy+0x1f1/0x740 [ 1231.162902][T26907] ? xfrm_unregister_translator+0x70/0x70 [ 1231.168728][T26907] ? bpf_lsm_capable+0x9/0x10 [ 1231.173498][T26907] ? security_capable+0x89/0xb0 [ 1231.178368][T26907] do_ipv6_setsockopt+0xed0/0x3290 [ 1231.183520][T26907] ? sk_dst_reset+0xa0/0xa0 [ 1231.188048][T26907] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 1231.193880][T26907] ? perf_trace_preemptirq_template+0x269/0x330 [ 1231.200228][T26907] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1231.206321][T26907] ? lock_chain_count+0x20/0x20 [ 1231.211363][T26907] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1231.217703][T26907] ? lockdep_hardirqs_on+0x98/0x150 [ 1231.222911][T26907] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1231.229175][T26907] ipv6_setsockopt+0x59/0x190 [ 1231.233964][T26907] ? sock_common_recvmsg+0x190/0x190 [ 1231.239359][T26907] do_sock_setsockopt+0x175/0x1a0 [ 1231.244421][T26907] ? __fdget+0x180/0x210 [ 1231.248775][T26907] __x64_sys_setsockopt+0x182/0x200 [ 1231.254525][T26907] do_syscall_64+0x55/0xb0 [ 1231.258949][T26907] ? clear_bhb_loop+0x40/0x90 [ 1231.263716][T26907] ? clear_bhb_loop+0x40/0x90 [ 1231.268411][T26907] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1231.274430][T26907] RIP: 0033:0x7f5ed519e1d9 [ 1231.278866][T26907] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1231.298841][T26907] RSP: 002b:00007f5ed5fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1231.307445][T26907] RAX: ffffffffffffffda RBX: 00007f5ed5425fa0 RCX: 00007f5ed519e1d9 [ 1231.315427][T26907] RDX: 0000000000000023 RSI: 0000000000000029 RDI: 0000000000000005 [ 1231.323687][T26907] RBP: 00007f5ed5fc8090 R08: 00000000000000cf R09: 0000000000000000 [ 1231.331749][T26907] R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000001 [ 1231.339732][T26907] R13: 00007f5ed5426038 R14: 00007f5ed5425fa0 R15: 00007fff6124d2e8 [ 1231.347728][T26907] [ 1232.203939][T26923] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7620'. [ 1232.419621][T26924] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7620'. [ 1237.273761][T26963] validate_nla: 7 callbacks suppressed [ 1237.273779][T26963] netlink: 'syz.1.7634': attribute type 29 has an invalid length. [ 1237.290529][T26965] netlink: 'syz.3.7633': attribute type 9 has an invalid length. [ 1237.301234][T26963] netlink: 'syz.1.7634': attribute type 29 has an invalid length. [ 1237.307770][T26965] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7633'. [ 1237.386610][T26963] netlink: 'syz.1.7634': attribute type 29 has an invalid length. [ 1237.397742][T26970] netlink: 'syz.3.7633': attribute type 9 has an invalid length. [ 1237.407848][T26963] netlink: 'syz.1.7634': attribute type 29 has an invalid length. [ 1237.417031][T26963] netlink: 'syz.1.7634': attribute type 29 has an invalid length. [ 1237.426920][T26970] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7633'. [ 1238.126757][T26981] netlink: 49920 bytes leftover after parsing attributes in process `syz.2.7640'. [ 1238.164151][T26981] netlink: 188 bytes leftover after parsing attributes in process `syz.2.7640'. [ 1238.183353][T26983] netlink: 105120 bytes leftover after parsing attributes in process `syz.1.7641'. [ 1238.229537][T26983] netlink: 16126 bytes leftover after parsing attributes in process `syz.1.7641'. [ 1238.755395][T26987] syzkaller0: entered promiscuous mode [ 1238.765306][T26987] syzkaller0: entered allmulticast mode [ 1239.199973][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1239.209239][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.317640][T26998] netlink: 'syz.1.7646': attribute type 29 has an invalid length. [ 1239.326432][T26998] netlink: 'syz.1.7646': attribute type 29 has an invalid length. [ 1239.349607][T26998] netlink: 'syz.1.7646': attribute type 29 has an invalid length. [ 1240.568820][T27016] FAULT_INJECTION: forcing a failure. [ 1240.568820][T27016] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1240.682642][T27016] CPU: 1 PID: 27016 Comm: syz.2.7656 Not tainted syzkaller #0 [ 1240.690236][T27016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1240.700460][T27016] Call Trace: [ 1240.703794][T27016] [ 1240.707040][T27016] dump_stack_lvl+0x18c/0x250 [ 1240.711790][T27016] ? show_regs_print_info+0x20/0x20 [ 1240.717049][T27016] ? load_image+0x420/0x420 [ 1240.721624][T27016] ? __might_fault+0xaa/0x120 [ 1240.726388][T27016] ? __lock_acquire+0x7eb0/0x7eb0 [ 1240.731579][T27016] should_fail_ex+0x394/0x4c0 [ 1240.736607][T27016] _copy_from_user+0x2f/0xe0 [ 1240.741472][T27016] ___sys_recvmsg+0x174/0x590 [ 1240.746327][T27016] ? __sys_recvmsg+0x2a0/0x2a0 [ 1240.751197][T27016] ? ksys_write+0x1d2/0x260 [ 1240.755913][T27016] ? __fget_files+0x3fc/0x460 [ 1240.760889][T27016] __x64_sys_recvmsg+0x21e/0x2f0 [ 1240.766080][T27016] ? ___sys_recvmsg+0x590/0x590 [ 1240.771055][T27016] ? lockdep_hardirqs_on+0x98/0x150 [ 1240.776337][T27016] do_syscall_64+0x55/0xb0 [ 1240.780807][T27016] ? clear_bhb_loop+0x40/0x90 [ 1240.785551][T27016] ? clear_bhb_loop+0x40/0x90 [ 1240.790293][T27016] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1240.796247][T27016] RIP: 0033:0x7f8947b9e1d9 [ 1240.800762][T27016] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1240.820698][T27016] RSP: 002b:00007f8948b41028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1240.829265][T27016] RAX: ffffffffffffffda RBX: 00007f8947e25fa0 RCX: 00007f8947b9e1d9 [ 1240.837375][T27016] RDX: 00000000000000a0 RSI: 0000200000000380 RDI: 0000000000000003 [ 1240.845406][T27016] RBP: 00007f8948b41090 R08: 0000000000000000 R09: 0000000000000000 [ 1240.853440][T27016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1240.861483][T27016] R13: 00007f8947e26038 R14: 00007f8947e25fa0 R15: 00007fff3b07a798 [ 1240.869569][T27016] [ 1243.413631][T27063] bridge0: port 3(batadv0) entered blocking state [ 1243.435193][T27063] FAULT_INJECTION: forcing a failure. [ 1243.435193][T27063] name failslab, interval 1, probability 0, space 0, times 0 [ 1243.465828][T27063] CPU: 1 PID: 27063 Comm: syz.3.7674 Not tainted syzkaller #0 [ 1243.473368][T27063] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1243.483483][T27063] Call Trace: [ 1243.486773][T27063] [ 1243.489708][T27063] dump_stack_lvl+0x18c/0x250 [ 1243.494387][T27063] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1243.500567][T27063] ? show_regs_print_info+0x20/0x20 [ 1243.505766][T27063] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1243.511955][T27063] should_fail_ex+0x394/0x4c0 [ 1243.516653][T27063] should_failslab+0x9/0x20 [ 1243.521345][T27063] slab_pre_alloc_hook+0x59/0x300 [ 1243.526366][T27063] ? printk_sprint+0x460/0x460 [ 1243.531131][T27063] ? switchdev_deferred_enqueue+0x2d/0x240 [ 1243.537034][T27063] ? switchdev_deferred_enqueue+0x2d/0x240 [ 1243.542869][T27063] __kmem_cache_alloc_node+0x53/0x250 [ 1243.548301][T27063] ? do_raw_spin_unlock+0x121/0x230 [ 1243.553520][T27063] ? switchdev_deferred_enqueue+0x2d/0x240 [ 1243.559338][T27063] ? switchdev_deferred_enqueue+0x240/0x240 [ 1243.565237][T27063] __kmalloc+0xa7/0x240 [ 1243.569442][T27063] switchdev_deferred_enqueue+0x2d/0x240 [ 1243.575095][T27063] switchdev_port_attr_set+0xff/0x2e0 [ 1243.580573][T27063] ? load_image+0x420/0x420 [ 1243.585197][T27063] ? switchdev_deferred_process+0x290/0x290 [ 1243.591093][T27063] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1243.596992][T27063] ? _raw_spin_unlock+0x40/0x40 [ 1243.601909][T27063] __set_ageing_time+0xde/0x170 [ 1243.606779][T27063] ? br_set_max_age+0x110/0x110 [ 1243.611672][T27063] ? br_become_designated_port+0x20/0x250 [ 1243.617398][T27063] br_init_port+0x131/0x200 [ 1243.621942][T27063] new_nbp+0x2f3/0x430 [ 1243.626021][T27063] br_add_if+0x280/0xee0 [ 1243.630272][T27063] ? bpf_lsm_capable+0x9/0x10 [ 1243.634951][T27063] ? security_capable+0x89/0xb0 [ 1243.639818][T27063] br_ioctl_stub+0x730/0xd50 [ 1243.644416][T27063] ? rcu_is_watching+0x15/0xb0 [ 1243.649195][T27063] ? rcu_read_unlock+0xa0/0xa0 [ 1243.653963][T27063] ? trace_contention_end+0x39/0xe0 [ 1243.659162][T27063] ? __mutex_lock+0x30d/0xc80 [ 1243.663996][T27063] ? mutex_lock_nested+0x20/0x20 [ 1243.668960][T27063] ? rcu_read_unlock+0xa0/0xa0 [ 1243.673730][T27063] sock_ioctl+0x4d7/0x7e0 [ 1243.678072][T27063] ? sock_poll+0x3e0/0x3e0 [ 1243.682607][T27063] ? bpf_lsm_file_ioctl+0x9/0x10 [ 1243.687563][T27063] ? security_file_ioctl+0x80/0xa0 [ 1243.692771][T27063] ? sock_poll+0x3e0/0x3e0 [ 1243.697228][T27063] __se_sys_ioctl+0xfd/0x170 [ 1243.701941][T27063] do_syscall_64+0x55/0xb0 [ 1243.706357][T27063] ? clear_bhb_loop+0x40/0x90 [ 1243.711067][T27063] ? clear_bhb_loop+0x40/0x90 [ 1243.715748][T27063] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1243.721656][T27063] RIP: 0033:0x7f3813b9e1d9 [ 1243.726331][T27063] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1243.746055][T27063] RSP: 002b:00007f38149f0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1243.754512][T27063] RAX: ffffffffffffffda RBX: 00007f3813e25fa0 RCX: 00007f3813b9e1d9 [ 1243.762696][T27063] RDX: 0000200000000040 RSI: 00000000000089a2 RDI: 0000000000000003 [ 1243.770672][T27063] RBP: 00007f38149f0090 R08: 0000000000000000 R09: 0000000000000000 [ 1243.778903][T27063] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1243.786964][T27063] R13: 00007f3813e26038 R14: 00007f3813e25fa0 R15: 00007ffef1086768 [ 1243.795078][T27063] [ 1243.822627][T27063] batadv0: failed to offload ageing time [ 1243.842115][T27066] validate_nla: 12 callbacks suppressed [ 1243.842135][T27066] netlink: 'syz.2.7676': attribute type 29 has an invalid length. [ 1243.856006][T27063] bridge0: port 3(batadv0) entered disabled state [ 1243.862640][T27063] batadv0: entered allmulticast mode [ 1243.875997][T27063] batadv0: entered promiscuous mode [ 1243.881921][T27063] bridge0: port 3(batadv0) entered blocking state [ 1243.888728][T27063] bridge0: port 3(batadv0) entered forwarding state [ 1243.927013][T27066] netlink: 'syz.2.7676': attribute type 29 has an invalid length. [ 1243.942016][T27067] netlink: 'syz.2.7676': attribute type 29 has an invalid length. [ 1243.987340][T27066] netlink: 'syz.2.7676': attribute type 29 has an invalid length. [ 1244.010852][T27066] netlink: 'syz.2.7676': attribute type 29 has an invalid length. [ 1244.178481][T27072] netlink: 'syz.3.7686': attribute type 29 has an invalid length. [ 1244.195588][T27072] netlink: 'syz.3.7686': attribute type 29 has an invalid length. [ 1244.215354][T27072] netlink: 'syz.3.7686': attribute type 29 has an invalid length. [ 1244.235202][T27072] netlink: 'syz.3.7686': attribute type 29 has an invalid length. [ 1244.252037][T27072] netlink: 'syz.3.7686': attribute type 29 has an invalid length. [ 1244.331608][T25529] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1244.341294][T25529] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1244.360593][T21490] Bluetooth: hci3: ISO packet for unknown connection handle 2622 [ 1244.545697][T27083] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1244.568463][T27083] team0: Port device bond0 added [ 1245.330025][T27097] mac80211_hwsim hwsim69 wlan0: entered promiscuous mode [ 1245.355283][T27097] mac80211_hwsim hwsim69 wlan0: entered allmulticast mode [ 1246.971459][T27138] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1247.022665][T27138] team0: Port device bond0 added [ 1247.400327][T27145] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7704'. [ 1248.995512][T27177] validate_nla: 20 callbacks suppressed [ 1248.995532][T27177] netlink: 'syz.3.7715': attribute type 4 has an invalid length. [ 1249.400488][T27185] netlink: 'syz.1.7718': attribute type 4 has an invalid length. [ 1249.598776][T14257] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1249.611057][T14257] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1249.622731][T14257] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1249.636542][T14257] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1249.645323][T14257] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1249.653247][T14257] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1249.747532][ T6437] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1249.758144][T27196] netlink: 'syz.1.7721': attribute type 29 has an invalid length. [ 1249.779832][T27196] netlink: 'syz.1.7721': attribute type 29 has an invalid length. [ 1249.819447][T27199] netlink: 'syz.1.7721': attribute type 29 has an invalid length. [ 1249.854756][ T6437] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1249.884674][T27196] netlink: 'syz.1.7721': attribute type 29 has an invalid length. [ 1249.893063][T27199] netlink: 'syz.1.7721': attribute type 29 has an invalid length. [ 1249.966841][ T6437] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1250.003139][T27203] netlink: 'syz.3.7723': attribute type 10 has an invalid length. [ 1250.031647][T27203] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1250.051345][T27202] netlink: 'syz.1.7730': attribute type 29 has an invalid length. [ 1250.054647][T27203] team0: Port device bond0 added [ 1250.102221][ T6437] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1250.121647][T27202] netlink: 'syz.1.7730': attribute type 29 has an invalid length. [ 1250.165323][T27205] netlink: 172 bytes leftover after parsing attributes in process `syz.2.7724'. [ 1250.182827][T27208] netlink: 168864 bytes leftover after parsing attributes in process `syz.2.7724'. [ 1250.371341][T27205] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1250.379011][T27205] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1250.393858][T27205] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1250.412468][T27205] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1250.489309][T27211] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1250.496622][T27211] IPv6: NLM_F_CREATE should be set when creating new route [ 1250.503924][T27211] IPv6: NLM_F_CREATE should be set when creating new route [ 1250.511278][T27211] IPv6: NLM_F_CREATE should be set when creating new route [ 1250.749203][T27191] chnl_net:caif_netlink_parms(): no params data found [ 1251.432187][T27191] bridge0: port 1(bridge_slave_0) entered blocking state [ 1251.472833][T27191] bridge0: port 1(bridge_slave_0) entered disabled state [ 1251.487661][T27191] bridge_slave_0: entered allmulticast mode [ 1251.519769][T27191] bridge_slave_0: entered promiscuous mode [ 1251.620853][T27191] bridge0: port 2(bridge_slave_1) entered blocking state [ 1251.635970][T27191] bridge0: port 2(bridge_slave_1) entered disabled state [ 1251.654570][T27191] bridge_slave_1: entered allmulticast mode [ 1251.664084][T27191] bridge_slave_1: entered promiscuous mode [ 1251.705894][T14257] Bluetooth: hci1: command tx timeout [ 1251.878945][T27191] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1251.880245][T27257] FAULT_INJECTION: forcing a failure. [ 1251.880245][T27257] name failslab, interval 1, probability 0, space 0, times 0 [ 1251.903466][T27257] CPU: 0 PID: 27257 Comm: syz.1.7735 Not tainted syzkaller #0 [ 1251.910987][T27257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1251.921080][T27257] Call Trace: [ 1251.923015][T27191] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1251.924369][T27257] [ 1251.936451][T27257] dump_stack_lvl+0x18c/0x250 [ 1251.941188][T27257] ? show_regs_print_info+0x20/0x20 [ 1251.946437][T27257] ? load_image+0x420/0x420 [ 1251.951006][T27257] ? __might_sleep+0xe0/0xe0 [ 1251.955825][T27257] ? __lock_acquire+0x7eb0/0x7eb0 [ 1251.960899][T27257] ? perf_trace_buf_alloc+0x290/0x290 [ 1251.966302][T27257] should_fail_ex+0x394/0x4c0 [ 1251.971132][T27257] should_failslab+0x9/0x20 [ 1251.975662][T27257] slab_pre_alloc_hook+0x59/0x300 [ 1251.980698][T27257] ? __get_vm_area_node+0x125/0x370 [ 1251.985913][T27257] __kmem_cache_alloc_node+0x53/0x250 [ 1251.991474][T27257] ? __get_vm_area_node+0x125/0x370 [ 1251.996772][T27257] kmalloc_node_trace+0x26/0xe0 [ 1252.001665][T27257] __get_vm_area_node+0x125/0x370 [ 1252.006833][T27257] __vmalloc_node_range+0x36f/0x1320 [ 1252.012132][T27257] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.017810][T27257] ? aa_get_newest_label+0xfd/0x5c0 [ 1252.023200][T27257] ? free_vm_area+0x50/0x50 [ 1252.027723][T27257] ? end_current_label_crit_section+0x170/0x170 [ 1252.034162][T27257] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.039725][T27257] __vmalloc+0x7a/0x90 [ 1252.043816][T27257] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.049380][T27257] bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.054775][T27257] bpf_prog_alloc+0x3d/0x1a0 [ 1252.059818][T27257] bpf_prog_load+0x6b2/0x1610 [ 1252.064529][T27257] ? map_freeze+0x420/0x420 [ 1252.069056][T27257] ? __might_fault+0xaa/0x120 [ 1252.073867][T27257] ? __lock_acquire+0x7eb0/0x7eb0 [ 1252.079354][T27257] ? file_end_write+0x159/0x250 [ 1252.084232][T27257] ? __might_fault+0xaa/0x120 [ 1252.088921][T27257] ? __might_fault+0xc6/0x120 [ 1252.093626][T27257] ? __might_fault+0xaa/0x120 [ 1252.098310][T27257] ? bpf_lsm_bpf+0x9/0x10 [ 1252.102713][T27257] ? security_bpf+0x7e/0xa0 [ 1252.107237][T27257] __sys_bpf+0x5ba/0x890 [ 1252.111493][T27257] ? bpf_link_show_fdinfo+0x560/0x560 [ 1252.116980][T27257] ? lock_chain_count+0x20/0x20 [ 1252.121852][T27257] __x64_sys_bpf+0x7c/0x90 [ 1252.126314][T27257] do_syscall_64+0x55/0xb0 [ 1252.130740][T27257] ? clear_bhb_loop+0x40/0x90 [ 1252.135511][T27257] ? clear_bhb_loop+0x40/0x90 [ 1252.140232][T27257] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1252.146142][T27257] RIP: 0033:0x7f5ed519e1d9 [ 1252.150564][T27257] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1252.170279][T27257] RSP: 002b:00007f5ed5fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1252.178706][T27257] RAX: ffffffffffffffda RBX: 00007f5ed5425fa0 RCX: 00007f5ed519e1d9 [ 1252.186707][T27257] RDX: 0000000000000094 RSI: 00002000000017c0 RDI: 0000000000000005 [ 1252.194783][T27257] RBP: 00007f5ed5fc8090 R08: 0000000000000000 R09: 0000000000000000 [ 1252.202768][T27257] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1252.210752][T27257] R13: 00007f5ed5426038 R14: 00007f5ed5425fa0 R15: 00007fff6124d2e8 [ 1252.218789][T27257] [ 1252.236887][T27257] syz.1.7735: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz1,mems_allowed=0-1 [ 1252.286408][T27257] CPU: 1 PID: 27257 Comm: syz.1.7735 Not tainted syzkaller #0 [ 1252.293944][T27257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1252.304080][T27257] Call Trace: [ 1252.307409][T27257] [ 1252.310383][T27257] dump_stack_lvl+0x18c/0x250 [ 1252.315111][T27257] ? show_regs_print_info+0x20/0x20 [ 1252.320363][T27257] ? load_image+0x420/0x420 [ 1252.324924][T27257] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1252.331386][T27257] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1252.338030][T27257] warn_alloc+0x246/0x340 [ 1252.342407][T27257] ? __get_vm_area_node+0x125/0x370 [ 1252.347669][T27257] ? zone_watermark_ok_safe+0x230/0x230 [ 1252.353264][T27257] ? rcu_is_watching+0x15/0xb0 [ 1252.358094][T27257] ? __get_vm_area_node+0x356/0x370 [ 1252.363365][T27257] __vmalloc_node_range+0x394/0x1320 [ 1252.368732][T27257] ? aa_get_newest_label+0xfd/0x5c0 [ 1252.373951][T27257] ? free_vm_area+0x50/0x50 [ 1252.378470][T27257] ? end_current_label_crit_section+0x170/0x170 [ 1252.384736][T27257] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.390316][T27257] __vmalloc+0x7a/0x90 [ 1252.394429][T27257] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.400009][T27257] bpf_prog_alloc_no_stats+0x46/0x430 [ 1252.405407][T27257] bpf_prog_alloc+0x3d/0x1a0 [ 1252.410040][T27257] bpf_prog_load+0x6b2/0x1610 [ 1252.414750][T27257] ? map_freeze+0x420/0x420 [ 1252.419287][T27257] ? __might_fault+0xaa/0x120 [ 1252.423989][T27257] ? __lock_acquire+0x7eb0/0x7eb0 [ 1252.429048][T27257] ? file_end_write+0x159/0x250 [ 1252.433913][T27257] ? __might_fault+0xaa/0x120 [ 1252.438595][T27257] ? __might_fault+0xc6/0x120 [ 1252.443282][T27257] ? __might_fault+0xaa/0x120 [ 1252.447979][T27257] ? bpf_lsm_bpf+0x9/0x10 [ 1252.452373][T27257] ? security_bpf+0x7e/0xa0 [ 1252.456904][T27257] __sys_bpf+0x5ba/0x890 [ 1252.461179][T27257] ? bpf_link_show_fdinfo+0x560/0x560 [ 1252.466763][T27257] ? lock_chain_count+0x20/0x20 [ 1252.471642][T27257] __x64_sys_bpf+0x7c/0x90 [ 1252.476081][T27257] do_syscall_64+0x55/0xb0 [ 1252.480555][T27257] ? clear_bhb_loop+0x40/0x90 [ 1252.485239][T27257] ? clear_bhb_loop+0x40/0x90 [ 1252.490013][T27257] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1252.495922][T27257] RIP: 0033:0x7f5ed519e1d9 [ 1252.500364][T27257] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1252.519994][T27257] RSP: 002b:00007f5ed5fc8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1252.528882][T27257] RAX: ffffffffffffffda RBX: 00007f5ed5425fa0 RCX: 00007f5ed519e1d9 [ 1252.536909][T27257] RDX: 0000000000000094 RSI: 00002000000017c0 RDI: 0000000000000005 [ 1252.544978][T27257] RBP: 00007f5ed5fc8090 R08: 0000000000000000 R09: 0000000000000000 [ 1252.553032][T27257] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1252.561035][T27257] R13: 00007f5ed5426038 R14: 00007f5ed5425fa0 R15: 00007fff6124d2e8 [ 1252.569046][T27257] [ 1252.643783][T27191] team0: Port device team_slave_0 added [ 1252.688825][T27191] team0: Port device team_slave_1 added [ 1252.714753][T27260] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7736'. [ 1252.716029][T27257] Mem-Info: [ 1252.751253][T27257] active_anon:16328 inactive_anon:0 isolated_anon:0 [ 1252.751253][T27257] active_file:19156 inactive_file:40427 isolated_file:0 [ 1252.751253][T27257] unevictable:768 dirty:135 writeback:25 [ 1252.751253][T27257] slab_reclaimable:10956 slab_unreclaimable:96992 [ 1252.751253][T27257] mapped:25172 shmem:1367 pagetables:559 [ 1252.751253][T27257] sec_pagetables:0 bounce:0 [ 1252.751253][T27257] kernel_misc_reclaimable:0 [ 1252.751253][T27257] free:1324403 free_pcp:6832 free_cma:0 [ 1252.829501][T27257] Node 0 active_anon:65312kB inactive_anon:0kB active_file:76624kB inactive_file:161508kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100688kB dirty:540kB writeback:0kB shmem:3932kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10696kB pagetables:2236kB sec_pagetables:0kB all_unreclaimable? no [ 1252.868208][T27257] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1252.900395][T27257] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1252.930086][T27263] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.7736'. [ 1252.969884][T27257] lowmem_reserve[]: 0 2505 2506 2506 2506 [ 1252.985146][T27257] Node 0 DMA32 free:1386196kB boost:0kB min:34508kB low:43132kB high:51756kB reserved_highatomic:0KB active_anon:64076kB inactive_anon:0kB active_file:76624kB inactive_file:160420kB unevictable:1536kB writepending:540kB present:3129332kB managed:2569932kB mlocked:0kB bounce:0kB free_pcp:11980kB local_pcp:6860kB free_cma:0kB [ 1253.025901][T27191] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1253.034196][T27191] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1253.064194][T27257] lowmem_reserve[]: 0 0 1 1 1 [ 1253.074024][T27257] Node 0 Normal free:4kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:1088kB unevictable:0kB writepending:0kB present:1048576kB managed:1128kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1253.079113][T27191] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1253.130206][T27257] lowmem_reserve[]: 0 0 0 0 0 [ 1253.141561][T27257] Node 1 Normal free:3895680kB boost:0kB min:55380kB low:69224kB high:83068kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:16804kB local_pcp:9536kB free_cma:0kB [ 1253.172364][T27257] lowmem_reserve[]: 0 0 0 0 0 [ 1253.177874][T27257] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1253.199665][T27257] Node 0 DMA32: 1636*4kB (UME) 467*8kB (UME) 323*16kB (UME) 876*32kB (UME) 896*64kB (UME) 800*128kB (UME) 444*256kB (UME) 154*512kB (UME) 33*1024kB (UM) 21*2048kB (UME) 223*4096kB (UM) = 1385944kB [ 1253.228977][T27191] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1253.242320][T27257] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1253.257378][T27191] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1253.283351][T27257] Node 1 Normal: 228*4kB (UME) 50*8kB (UME) 20*16kB (UME) 39*32kB (UME) 15*64kB (UME) 5*128kB (UM) 2*256kB (UM) 1*512kB (E) 1*1024kB (U) 1*2048kB (U) 949*4096kB (M) = 3895680kB [ 1253.294981][T27191] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1253.314894][T27257] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1253.343695][T27263] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7736'. [ 1253.353789][T27257] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1253.395404][T27257] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1253.405012][T27257] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1253.433844][T27257] 60950 total pagecache pages [ 1253.446383][T27257] 0 pages in swap cache [ 1253.465785][T27257] Free swap = 124996kB [ 1253.479430][T27257] Total swap = 124996kB [ 1253.483889][T27257] 2097051 pages RAM [ 1253.492655][T27257] 0 pages HighMem/MovableOnly [ 1253.501588][T27257] 421118 pages reserved [ 1253.510858][T27257] 0 pages cma reserved [ 1253.512245][T27191] hsr_slave_0: entered promiscuous mode [ 1253.541010][T27191] hsr_slave_1: entered promiscuous mode [ 1253.785515][T14257] Bluetooth: hci1: command tx timeout [ 1254.046933][ T6437] team0: left allmulticast mode [ 1254.052340][ T6437] team_slave_0: left allmulticast mode [ 1254.089124][ T6437] team_slave_1: left allmulticast mode [ 1254.094965][ T6437] bridge0: left allmulticast mode [ 1254.117482][ T6437] team0: left promiscuous mode [ 1254.122335][ T6437] team_slave_0: left promiscuous mode [ 1254.145436][ T6437] team_slave_1: left promiscuous mode [ 1254.151272][ T6437] bridge0: left promiscuous mode [ 1254.164330][ T6437] : port 1(team0) entered disabled state [ 1254.220674][ T6437] hsr_slave_0: left promiscuous mode [ 1254.230720][ T6437] hsr_slave_1: left promiscuous mode [ 1254.243470][ T6437] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1254.251903][ T6437] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1254.267576][ T6437] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1254.278545][ T6437] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1254.307427][T27293] validate_nla: 12 callbacks suppressed [ 1254.307446][T27293] netlink: 'syz.3.7742': attribute type 29 has an invalid length. [ 1254.326804][ T6437] batadv0: left allmulticast mode [ 1254.333061][ T6437] batadv0: left promiscuous mode [ 1254.341030][ T6437] bridge0: port 2(batadv0) entered disabled state [ 1254.358069][ T6437] bridge_slave_0: left allmulticast mode [ 1254.364143][ T6437] bridge_slave_0: left promiscuous mode [ 1254.370919][ T6437] bridge0: port 1(bridge_slave_0) entered disabled state [ 1254.433621][ T6437] veth1_macvtap: left promiscuous mode [ 1254.440221][ T6437] veth1_vlan: left promiscuous mode [ 1254.446378][ T6437] veth0_vlan: left promiscuous mode [ 1255.615371][ T6437] team0 (unregistering): Port device team_slave_1 removed [ 1255.663993][ T6437] team0 (unregistering): Port device team_slave_0 removed [ 1255.875272][T14257] Bluetooth: hci1: command tx timeout [ 1256.079370][ T6437] team0 (unregistering): Port device bridge0 removed [ 1256.181235][T27293] netlink: 'syz.3.7742': attribute type 29 has an invalid length. [ 1256.371748][T27299] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1256.379105][T27299] IPv6: NLM_F_CREATE should be set when creating new route [ 1256.386540][T27299] IPv6: NLM_F_CREATE should be set when creating new route [ 1256.393816][T27299] IPv6: NLM_F_CREATE should be set when creating new route [ 1257.268607][T27304] mac80211_hwsim hwsim72 wlan0: entered promiscuous mode [ 1257.282143][T27304] mac80211_hwsim hwsim72 wlan0: entered allmulticast mode [ 1257.954483][T14257] Bluetooth: hci1: command tx timeout [ 1257.997695][T27191] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1258.054357][T27191] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1258.078789][T27191] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1258.114661][T27191] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1258.299954][T27191] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1258.322644][T27191] 8021q: adding VLAN 0 to HW filter on device team0 [ 1258.342170][ T6591] bridge0: port 1(bridge_slave_0) entered blocking state [ 1258.349383][ T6591] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1258.384229][ T6437] bridge0: port 2(bridge_slave_1) entered blocking state [ 1258.391457][ T6437] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1258.670327][T27191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1258.777695][T27191] veth0_vlan: entered promiscuous mode [ 1258.822442][T27191] veth1_vlan: entered promiscuous mode [ 1258.926814][T27191] veth0_macvtap: entered promiscuous mode [ 1258.967878][T27191] veth1_macvtap: entered promiscuous mode [ 1259.000634][T27364] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1259.007971][T27364] IPv6: NLM_F_CREATE should be set when creating new route [ 1259.033409][T27191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1259.096604][T27191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.129636][T27191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1259.159630][T27191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.188079][T27191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1259.239316][T27191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1259.276249][T27191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.307667][T27191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1259.335552][T27191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.345852][T27191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1259.356522][T27191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1259.368377][T27191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1259.406564][T27191] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1259.425306][T27191] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1259.434050][T27191] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1259.454989][T27191] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1259.602561][T25532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1259.633755][T25532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1259.701023][ T6586] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1259.738970][ T6586] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1260.611349][T27414] bridge0: port 2(veth1_to_team) entered blocking state [ 1260.634541][T27414] bridge0: port 2(veth1_to_team) entered disabled state [ 1260.657731][T27414] veth1_to_team: entered allmulticast mode [ 1260.692149][T27414] veth1_to_team: entered promiscuous mode [ 1260.729449][T27414] bridge0: port 2(veth1_to_team) entered blocking state [ 1260.737338][T27414] bridge0: port 2(veth1_to_team) entered forwarding state [ 1261.513963][T27435] syzkaller0: entered promiscuous mode [ 1261.530740][T27435] syzkaller0: entered allmulticast mode [ 1264.510613][T27476] syz_tun: entered allmulticast mode [ 1264.663296][T27478] syzkaller0: entered promiscuous mode [ 1264.670107][T27478] syzkaller0: entered allmulticast mode [ 1269.691859][T27489] bridge0: port 4(veth1_to_team) entered blocking state [ 1269.699886][T27489] bridge0: port 4(veth1_to_team) entered disabled state [ 1269.708568][T27489] veth1_to_team: entered allmulticast mode [ 1269.724110][T27489] veth1_to_team: entered promiscuous mode [ 1269.730719][T27489] bridge0: port 4(veth1_to_team) entered blocking state [ 1269.737889][T27489] bridge0: port 4(veth1_to_team) entered forwarding state [ 1269.759443][T27495] sit0: entered allmulticast mode [ 1269.764865][T27496] sit0: entered promiscuous mode [ 1269.921809][T27502] mac80211_hwsim hwsim83 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1271.385833][T27529] bridge0: port 3(veth1_to_team) entered blocking state [ 1271.396015][T27529] bridge0: port 3(veth1_to_team) entered disabled state [ 1271.416160][T27529] veth1_to_team: entered allmulticast mode [ 1271.434612][T27529] veth1_to_team: entered promiscuous mode [ 1271.451168][T27529] bridge0: port 3(veth1_to_team) entered blocking state [ 1271.458671][T27529] bridge0: port 3(veth1_to_team) entered forwarding state [ 1271.945224][T21490] Bluetooth: hci3: command 0x0406 tx timeout [ 1273.005737][T27569] 2: renamed from team_slave_1 (while UP) [ 1273.017777][T27566] bridge0: port 2(veth1_to_team) entered blocking state [ 1273.030768][T27566] bridge0: port 2(veth1_to_team) entered disabled state [ 1273.039352][T27566] veth1_to_team: entered allmulticast mode [ 1273.058253][T27566] veth1_to_team: entered promiscuous mode [ 1273.077331][T27566] bridge0: port 2(veth1_to_team) entered blocking state [ 1273.084763][T27566] bridge0: port 2(veth1_to_team) entered forwarding state [ 1273.191783][T27570] syzkaller0: entered promiscuous mode [ 1273.198905][T27570] syzkaller0: entered allmulticast mode [ 1276.149265][T27587] syzkaller0: entered promiscuous mode [ 1276.154809][T27587] syzkaller0: entered allmulticast mode [ 1278.588104][T27613] mac80211_hwsim hwsim75 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1279.479226][T27632] syzkaller0: entered promiscuous mode [ 1279.484768][T27632] syzkaller0: entered allmulticast mode [ 1281.930960][T27647] mac80211_hwsim hwsim73 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1282.258813][T27670] mac80211_hwsim hwsim72 wlan0: left promiscuous mode [ 1282.270865][T27670] mac80211_hwsim hwsim72 wlan0: left allmulticast mode [ 1283.964272][T27693] wg2: entered promiscuous mode [ 1283.985170][T27693] wg2: entered allmulticast mode [ 1286.096539][T27773] syzkaller0: entered promiscuous mode [ 1286.102232][T27773] syzkaller0: entered allmulticast mode [ 1290.281304][T27793] syzkaller0: entered promiscuous mode [ 1290.287279][T27793] syzkaller0: entered allmulticast mode [ 1293.431432][T27830] syzkaller0: entered promiscuous mode [ 1293.443889][T27830] syzkaller0: entered allmulticast mode [ 1296.314350][T27845] syz_tun: entered allmulticast mode [ 1296.912034][T27875] syz_tun: entered allmulticast mode [ 1297.114378][T27878] syzkaller0: entered promiscuous mode [ 1297.124157][T27878] syzkaller0: entered allmulticast mode [ 1297.545440][T21490] Bluetooth: hci0: command 0x0406 tx timeout [ 1300.589166][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.598538][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1303.637152][T27958] wg2: entered promiscuous mode [ 1303.643204][T27958] wg2: entered allmulticast mode [ 1304.591852][T27981] wg2: entered promiscuous mode [ 1304.600144][T27981] wg2: entered allmulticast mode [ 1304.717458][T27989] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1304.736393][T27989] syzkaller0: entered promiscuous mode [ 1304.741974][T27989] syzkaller0: entered allmulticast mode [ 1305.276013][T27936] ------------[ cut here ]------------ [ 1305.281792][T27936] WARNING: CPU: 0 PID: 27936 at kernel/events/core.c:6808 perf_pending_task+0x357/0x480 [ 1305.291790][T27936] Modules linked in: [ 1305.295737][T27936] CPU: 0 PID: 27936 Comm: syz.2.7957 Not tainted syzkaller #0 [ 1305.303386][T27936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1305.313597][T27936] RIP: 0010:perf_pending_task+0x357/0x480 [ 1305.319517][T27936] Code: e8 0e 75 d5 ff 84 db 75 10 e8 75 72 d5 ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 65 72 d5 ff e8 e0 7e 4e ff eb e9 e8 59 72 d5 ff <0f> 0b 49 bd 00 00 00 00 00 fc ff df 43 80 3c 2f 00 0f 85 0a ff ff [ 1305.339488][T27936] RSP: 0018:ffffc9000b97f9c8 EFLAGS: 00010293 [ 1305.345630][T27936] RAX: ffffffff81b21e57 RBX: ffff88806356a2e0 RCX: ffff888026c21e00 [ 1305.353636][T27936] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1305.361758][T27936] RBP: ffff88806356a0a0 R08: ffffffff8f6c5aef R09: 1ffffffff1ed8b5d [ 1305.369801][T27936] R10: dffffc0000000000 R11: fffffbfff1ed8b5e R12: ffff888026c21e00 [ 1305.378198][T27936] R13: ffff88805e78ed30 R14: 0000000000000000 R15: 1ffff1100c6ad414 [ 1305.386560][T27936] FS: 0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000 [ 1305.395679][T27936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1305.402331][T27936] CR2: 00007fb77889236f CR3: 0000000041749000 CR4: 00000000003506f0 [ 1305.410477][T27936] DR0: 0000000000000000 DR1: 0000000000000008 DR2: 0000000000000008 [ 1305.418588][T27936] DR3: 0000000000000008 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1305.426711][T27936] Call Trace: [ 1305.430008][T27936] [ 1305.433045][T27936] task_work_run+0x1d4/0x260 [ 1305.437789][T27936] ? task_work_cancel+0x220/0x220 [ 1305.442860][T27936] do_exit+0x986/0x2530 [ 1305.447114][T27936] ? put_task_struct+0xc0/0xc0 [ 1305.451917][T27936] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1305.458221][T27936] ? get_signal+0x100e/0x1390 [ 1305.462927][T27936] ? lock_chain_count+0x20/0x20 [ 1305.467864][T27936] ? _raw_spin_lock_irq+0xbb/0xf0 [ 1305.472941][T27936] do_group_exit+0x22d/0x2f0 [ 1305.477654][T27936] ? lockdep_hardirqs_on+0x98/0x150 [ 1305.482926][T27936] get_signal+0x12a6/0x1390 [ 1305.487671][T27936] arch_do_signal_or_restart+0xc2/0x7b0 [ 1305.493294][T27936] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1305.499280][T27936] ? get_sigframe_size+0x20/0x20 [ 1305.504269][T27936] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1305.510522][T27936] ? exit_to_user_mode_loop+0x3b/0x110 [ 1305.516075][T27936] exit_to_user_mode_loop+0x70/0x110 [ 1305.521490][T27936] exit_to_user_mode_prepare+0xee/0x180 [ 1305.527125][T27936] syscall_exit_to_user_mode+0x1a/0x50 [ 1305.532622][T27936] do_syscall_64+0x61/0xb0 [ 1305.537324][T27936] ? clear_bhb_loop+0x40/0x90 [ 1305.542035][T27936] ? clear_bhb_loop+0x40/0x90 [ 1305.547135][T27936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1305.553155][T27936] RIP: 0033:0x7f8947b9e1d9 [ 1305.557779][T27936] Code: Unable to access opcode bytes at 0x7f8947b9e1af. [ 1305.564824][T27936] RSP: 002b:00007f8948b410e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1305.573343][T27936] RAX: fffffffffffffe00 RBX: 00007f8947e25fa8 RCX: 00007f8947b9e1d9 [ 1305.581414][T27936] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8947e25fa8 [ 1305.589894][T27936] RBP: 00007f8947e25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1305.597977][T27936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1305.606015][T27936] R13: 00007f8947e26038 R14: 00007fff3b07a6b0 R15: 00007fff3b07a798 [ 1305.614035][T27936] [ 1305.617145][T27936] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1305.624444][T27936] CPU: 0 PID: 27936 Comm: syz.2.7957 Not tainted syzkaller #0 [ 1305.632281][T27936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 1305.642422][T27936] Call Trace: [ 1305.645760][T27936] [ 1305.648719][T27936] dump_stack_lvl+0x18c/0x250 [ 1305.653520][T27936] ? show_regs_print_info+0x20/0x20 [ 1305.658751][T27936] ? load_image+0x420/0x420 [ 1305.663298][T27936] panic+0x2ca/0x720 [ 1305.667227][T27936] ? bpf_jit_dump+0xd0/0xd0 [ 1305.671867][T27936] __warn+0x2e0/0x470 [ 1305.675875][T27936] ? perf_pending_task+0x357/0x480 [ 1305.681104][T27936] ? perf_pending_task+0x357/0x480 [ 1305.686240][T27936] report_bug+0x2be/0x4f0 [ 1305.690684][T27936] ? perf_pending_task+0x357/0x480 [ 1305.695822][T27936] ? perf_pending_task+0x357/0x480 [ 1305.700962][T27936] ? perf_pending_task+0x359/0x480 [ 1305.706108][T27936] handle_bug+0xcf/0x120 [ 1305.710388][T27936] exc_invalid_op+0x1a/0x50 [ 1305.714932][T27936] asm_exc_invalid_op+0x1a/0x20 [ 1305.719817][T27936] RIP: 0010:perf_pending_task+0x357/0x480 [ 1305.725569][T27936] Code: e8 0e 75 d5 ff 84 db 75 10 e8 75 72 d5 ff 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 65 72 d5 ff e8 e0 7e 4e ff eb e9 e8 59 72 d5 ff <0f> 0b 49 bd 00 00 00 00 00 fc ff df 43 80 3c 2f 00 0f 85 0a ff ff [ 1305.745206][T27936] RSP: 0018:ffffc9000b97f9c8 EFLAGS: 00010293 [ 1305.751311][T27936] RAX: ffffffff81b21e57 RBX: ffff88806356a2e0 RCX: ffff888026c21e00 [ 1305.759293][T27936] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 1305.767265][T27936] RBP: ffff88806356a0a0 R08: ffffffff8f6c5aef R09: 1ffffffff1ed8b5d [ 1305.775255][T27936] R10: dffffc0000000000 R11: fffffbfff1ed8b5e R12: ffff888026c21e00 [ 1305.783352][T27936] R13: ffff88805e78ed30 R14: 0000000000000000 R15: 1ffff1100c6ad414 [ 1305.791337][T27936] ? perf_pending_task+0x357/0x480 [ 1305.796466][T27936] ? perf_pending_task+0x357/0x480 [ 1305.801700][T27936] task_work_run+0x1d4/0x260 [ 1305.806838][T27936] ? task_work_cancel+0x220/0x220 [ 1305.811897][T27936] do_exit+0x986/0x2530 [ 1305.816288][T27936] ? put_task_struct+0xc0/0xc0 [ 1305.821084][T27936] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 1305.827066][T27936] ? get_signal+0x100e/0x1390 [ 1305.831776][T27936] ? lock_chain_count+0x20/0x20 [ 1305.836636][T27936] ? _raw_spin_lock_irq+0xbb/0xf0 [ 1305.841775][T27936] do_group_exit+0x22d/0x2f0 [ 1305.846415][T27936] ? lockdep_hardirqs_on+0x98/0x150 [ 1305.851729][T27936] get_signal+0x12a6/0x1390 [ 1305.856262][T27936] arch_do_signal_or_restart+0xc2/0x7b0 [ 1305.861834][T27936] ? __ia32_sys_get_robust_list+0x110/0x110 [ 1305.867813][T27936] ? get_sigframe_size+0x20/0x20 [ 1305.872773][T27936] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1305.878940][T27936] ? exit_to_user_mode_loop+0x3b/0x110 [ 1305.884503][T27936] exit_to_user_mode_loop+0x70/0x110 [ 1305.889794][T27936] exit_to_user_mode_prepare+0xee/0x180 [ 1305.895339][T27936] syscall_exit_to_user_mode+0x1a/0x50 [ 1305.900803][T27936] do_syscall_64+0x61/0xb0 [ 1305.905308][T27936] ? clear_bhb_loop+0x40/0x90 [ 1305.909983][T27936] ? clear_bhb_loop+0x40/0x90 [ 1305.914749][T27936] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1305.920739][T27936] RIP: 0033:0x7f8947b9e1d9 [ 1305.925160][T27936] Code: Unable to access opcode bytes at 0x7f8947b9e1af. [ 1305.932434][T27936] RSP: 002b:00007f8948b410e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1305.940845][T27936] RAX: fffffffffffffe00 RBX: 00007f8947e25fa8 RCX: 00007f8947b9e1d9 [ 1305.948869][T27936] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8947e25fa8 [ 1305.956927][T27936] RBP: 00007f8947e25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1305.964896][T27936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1305.972863][T27936] R13: 00007f8947e26038 R14: 00007fff3b07a6b0 R15: 00007fff3b07a798 [ 1305.980847][T27936] [ 1305.984221][T27936] Kernel Offset: disabled [ 1305.988544][T27936] Rebooting in 86400 seconds..