last executing test programs: 19.537559561s ago: executing program 1 (id=2412): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001860000000000000e9ff000004000000181200", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000001800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="120000002400000008000000"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r0, 0x58, &(0x7f00000001c0)}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r1, 0x0, 0x8001) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) socketpair$unix(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x4, 0xc8}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)={0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)="31de76fb398bc62d058b8a96924594f5476a0824be53f7a5949f80614c42391e4b80412938c955d34d37eb96ba7849c3eb823bb36724bd6f6d0219cfe5c884afcd2bdea5acf9c877c03dcdbbb3e47417b6707c27d4c5c1db1924071f6b6f23c7d199c799c9b0c41101e625fcdb7bbfd12a3eeeef4540a5698f058aaf6a141e5d333929b92a7f64e925bf0ef424c3ef29fcd5fd4721c547fde6abe4d47048b64511693624b0d786711abe4a66e250fcbfe95ac9037e58f331b26b6ed0d08e5c73ba4c49", 0xc3}], 0x1}, 0x0) 19.1466727s ago: executing program 1 (id=2418): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x5, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000001000008500000008000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x96ad92a433913de9}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r2}, 0xc) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020039000b05d25a806f8c6394f90424fc602f00000008000700feff000037153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x5}, 0x50) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, 0x0, 0x804) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={0x0}, 0x404, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r6 = socket$kcm(0x22, 0x2, 0x21) write$cgroup_subtree(r6, &(0x7f00000006c0)={[{0x2b, 'net_cls'}]}, 0x9) socket$kcm(0xa, 0x2, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1f, 0x10, &(0x7f0000000040)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xc8ae}, {{0x18, 0x1, 0x1, 0x0, r7}}, {}, [@call={0x85, 0x0, 0x0, 0x50}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000840)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x38, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000540)=0xffffffffffffffff, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x10, &(0x7f0000000400)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffeff, 0x0, 0x0, 0x0, 0xed}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000480)='GPL\x00', 0x0, 0x68, &(0x7f00000004c0)=""/104, 0x41100, 0x48, '\x00', 0x0, @fallback=0x28, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000580)={0x3, 0xf, 0x8, 0x758}, 0x10, 0xffffffffffffffff, r0, 0x1, 0x0, &(0x7f00000005c0)=[{0x1, 0x4, 0x6, 0x8}], 0x10, 0x6}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r4}, &(0x7f0000000340), &(0x7f0000000380)=r0}, 0x20) 18.70899645s ago: executing program 1 (id=2421): r0 = socket$kcm(0x10, 0x2, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001bc0)=ANY=[@ANYBLOB="0700000002000000060000000900000008080100", @ANYRES32=0x1, @ANYBLOB='\t\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000010000000400"/24, @ANYRES32, @ANYBLOB="7cda0043cdfed79c44e448814bd7c5ee41000adc9d00128ed84cc990b629b6ddd2d556740f6ee4b0fbe1e5c3e82544fc625156f4677ec738b3792b1dacddf2"], 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000300)={0x1, 0x58, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$kcm(0x2, 0x1, 0x84) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001140)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r5, 0x84, 0x7d, &(0x7f0000000000)=r6, 0x8) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000016c0)={0x1e, 0x2e, &(0x7f00000003c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x80000001}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@cb_func={0x18, 0x2, 0x4, 0x0, 0xfffffffffffffff8}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, @jmp={0x5, 0x1, 0x9, 0x7, 0x3, 0x0, 0x1}, @map_fd={0x18, 0x8, 0x1, 0x0, 0x1}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @map_val={0x18, 0x6, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x9}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000540)='syzkaller\x00', 0x7fffffff, 0x1000, &(0x7f0000000580)=""/4096, 0x41100, 0x8, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x8, &(0x7f0000001580)={0x0, 0x1}, 0x8, 0x10, &(0x7f00000015c0)={0x1, 0xa, 0xff, 0x7fffffff}, 0x10, 0x0, 0xffffffffffffffff, 0x6, &(0x7f0000001600)=[0xffffffffffffffff, 0x1, 0x1], &(0x7f0000001640)=[{0x5, 0x1, 0x3, 0x2}, {0x1, 0x2, 0x10}, {0x0, 0x5, 0x7, 0x4}, {0x0, 0x5, 0x3, 0x9}, {0x1, 0x5, 0x8, 0x6}, {0x0, 0x4, 0xc, 0xa}]}, 0x94) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="08000000040000000400000004"], 0x48) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0xffffffff, 0x3800, 0x7, 0x11, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0xfffffffc}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080), &(0x7f00000002c0), 0x10000, r9, 0x0, 0x1c000000007400}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000fcffffff7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000025000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001780)={0xffffffffffffffff, 0x1, 0x10}, 0xc) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001840)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000017c0), &(0x7f0000001800)}, 0x20) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r11, @ANYBLOB="0000000000000000b7080000230000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES16=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1002}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001e00)={r12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r13 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001880)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x50) r14 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001940)=@o_path={&(0x7f0000001900)='./file0\x00', 0x0, 0x10, r0}, 0x18) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r16 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x12, 0xa, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r16, 0xffffffffffffffff}, &(0x7f0000000580)=0x2, &(0x7f00000005c0)=r15}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000a40)={r17, &(0x7f0000000a00)}, 0x20) r18 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001d40)={&(0x7f0000001c80)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x3, [@int={0x10, 0x0, 0x0, 0x1, 0x0, 0x78, 0x0, 0x5}, @decl_tag={0x3, 0x0, 0x0, 0x11, 0x4, 0x4}]}, {0x0, [0x0]}}, &(0x7f0000001cc0)=""/100, 0x3b, 0x64, 0x0, 0x4, 0x10000}, 0x28) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001d80)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0xe0f, '\x00', r2, r18, 0x4, 0x1, 0x4}, 0x50) r19 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001980)={0x0, 0x2, 0x1c}, 0xc) r20 = bpf$MAP_CREATE(0x0, &(0x7f00000019c0)=ANY=[@ANYBLOB="1e000000000000000002000013054e1c00000000", @ANYRES32, @ANYBLOB="0f00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000003000000040000000b00"/28], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001ac0)={{0x1, 0xffffffffffffffff}, &(0x7f0000001a40), &(0x7f0000001a80)='%pI4 \x00'}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001e80)=@bpf_tracing={0x1a, 0x9, &(0x7f0000000140)=@framed={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x81}, [@map_fd={0x18, 0xa, 0x1, 0x0, r1}, @map_idx={0x18, 0x4, 0x5, 0x0, 0xc}, @cb_func={0x18, 0x2, 0x4, 0x0, 0xfffffffffffffff8}]}, &(0x7f00000001c0)='GPL\x00', 0x40, 0x7c, &(0x7f0000000200)=""/124, 0x41000, 0x1, '\x00', r2, 0x0, r6, 0x8, &(0x7f0000000340)={0x7, 0x3}, 0x8, 0x10, &(0x7f0000000380)={0x2, 0x3, 0x6, 0xd388}, 0x10, 0x1754, r7, 0x5, &(0x7f0000001b00)=[r8, r13, r10, r13, r14, r17, r19, 0xffffffffffffffff, r20, r21], &(0x7f0000001b40)=[{0x1, 0x4, 0x10, 0x6}, {0x1, 0x2, 0x4, 0xc}, {0x2, 0x3, 0x2}, {0x5, 0x2, 0xa, 0x8}, {0x5, 0x3, 0x7, 0x8}], 0x10, 0x2}, 0x94) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020032000b35d25a806f8c6394f90224fc602f0009000a740200053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 17.426579018s ago: executing program 1 (id=2428): perf_event_open(&(0x7f0000000fc0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x400, 0xfe123, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24000000, 0x0, @perf_config_ext={0xd, 0x7}, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3, 0x1}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001860000000000000e9ff"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0x58, &(0x7f00000001c0)}, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r0, 0x0, 0x8001) close(0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x4, 0xc8}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000d40)={0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000080)="31de76fb398bc62d058b8a96924594f5476a0824be53f7a5949f80614c42391e4b80412938c955d34d37eb96ba7849c3eb823bb36724bd6f6d0219cfe5c884afcd2bdea5acf9c877c03dcdbbb3e47417b6707c27d4c5c1db1924071f6b6f23c7d199c799c9b0c41101e625fcdb7bbfd12a3eeeef4540a5698f058aaf6a141e5d333929b92a7f64e925bf0ef424c3ef29fcd5fd4721c547fde6abe4d47048b64511693624b0d786711abe4a66e250fcbfe95ac9037e58f331b26b6ed0d08e5c73ba4c49", 0xc3}], 0x1, &(0x7f00000001c0)=[@ip_tos_int={{0x14}}, @ip_ttl={{0x14}}, @ip_ttl={{0x14}}, @ip_tos_u8={{0x11}}, @ip_tos_u8={{0x11, 0x2}}, @ip_retopts={{0x24, 0x0, 0x7, {[@lsrr={0x83, 0x3}, @generic={0x0, 0xf, "206a77bdd1a004129054e7704a"}]}}}], 0xa0}, 0x0) 17.152942694s ago: executing program 1 (id=2431): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x4480}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) r1 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0xf, &(0x7f00000002c0), 0x161) sendmsg$inet(r1, &(0x7f0000000a00)={0x0, 0x0, 0x0}, 0x4008040) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000001c0)=r2, 0x4) r3 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x200, 0x20, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x9, 0x3}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r0) r4 = syz_clone(0x20800000, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000005c0)=r4, 0x12) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000040)=0x1, 0x12) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009400000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffd}, 0x39) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, 0x0, 0x0) 16.733229084s ago: executing program 1 (id=2434): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0600000004000000040000000f"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='\n\x00'], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) r3 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x800000, 0x3fff8001}, 0x0, 0x32, 0x43e1bd74, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x5, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) r5 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r5, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670007e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) r6 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$kcm(0x2, 0x3, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r6, 0x40042408, 0xffffffffffffffff) close(r2) socket$kcm(0x28, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000900)={&(0x7f0000000800)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000600000003000000000000040447cae600edffff602e"], 0x0, 0x2a, 0x0, 0x1, 0x1}, 0x28) sendmsg$inet(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x3406c096) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8000) syz_clone(0x41064400, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="905d429b000000000000000000000000001006"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r8, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="020b0700fc670000e4a17c45c8d260c9", 0x33fe0}], 0x1}, 0x0) close(r7) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000081000000bfa300000000000007030000f1feffff720af0fef8ffffff71a4f4fe0000000071102800000000001d400500000000004704000001ed00000f030000000000006f44000000000000730a00fe000000007203000000000006b500f3ffffff00009500000000000000023bc065b58111c6dfa041b63af4a3912435f18564a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccc99069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad24b89b6a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c87852730a3bd7ac923fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca4856ff03b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec860cde7c79f7b4d4e24c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b450100000001000000393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00400000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd599c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb80610eb37bd2d40ebdfed687f0b093e68f10b72146a0b749ee2105e2da94a288146abbbaf7c0b24fe0000000000000000f1a4f4de6a8d12dc9e71a20cbd412898586843b534d36e21379a8a06133c1babde9e5bd5b6afc5f684aada43ee560e800f58cb33b8483f6518abde7c86bd5d389c1b3c40fdd4bebe4adf87b1025ff57eb50984cc5bad9ea1c15484ea627c3c1501d612ed65939266e7332966f03e0376076e7c5dfe25f367dda7f69db89829b360dd2f59cbaad10f13e269eca792725bbacb96aa0a5c426ca76f84322661"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffa3}, 0x48) r9 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r9, &(0x7f0000000180)}, 0x20) 7.164422889s ago: executing program 3 (id=2464): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000400000008"], 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0d000000040000000400000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000880), 0xde9, r1}, 0x38) 6.939728614s ago: executing program 3 (id=2466): bpf$MAP_CREATE(0x0, 0x0, 0x48) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x17, 0x0, &(0x7f0000000100)="bbff03316844268cb89e14f0080045e0ffff0012400163", 0x0, 0x23, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x9}, 0x50) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x36) 4.0021251s ago: executing program 2 (id=2484): bpf$PROG_LOAD(0x5, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x40000002) perf_event_open(&(0x7f0000000180)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x17a845ef}, 0x0, 0x7, 0x0, 0x1, 0x0, 0x6, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) r0 = perf_event_open(&(0x7f0000000000)={0x5, 0x4a, 0x5f, 0xfe, 0x4, 0x4, 0x0, 0x3, 0x80000, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x2, @perf_bp={0x0, 0x1}, 0x110200, 0xd, 0x9, 0x7, 0x7, 0x7, 0x0, 0x0, 0xfffffffd, 0x0, 0x10}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) syz_clone(0xa00000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_clone(0xa00000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x7) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) 3.968313231s ago: executing program 3 (id=2485): syz_clone(0x20100000, 0x0, 0x0, 0x0, 0x0, 0x0) 3.720693346s ago: executing program 3 (id=2488): r0 = perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x22a0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xa}, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000000)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x24, 0x12506, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x8}, 0x7602}, 0x0, 0xffffffffffffffff, r0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="b4000000000000006111100000000000c6000000000000009500000000000000208a17289f5cb173e472a32f2a0be752ddd9f8aa995a9de13ed38485d9148811d7f61b0e6c66ba8ad8f8a70d3c217303026a9e4b3dbd5f883b6fd71eaf9431b47920125506b03f01c5c56b105eb0e95aaa69ce270a78cc057c7b56fc652a91e4225dc832d639ebb5a742f0fcb02588a9e9ef442b39beef7f637324998912bf85ea7129c802c9c298945a04b98c3b5c5776f581edc7113f5090f764c30fa6b1be45309f0d32ea3c391323755d26fd7e7d28d7e2112a227f00bd6b61d2ef11e2752fb864382c9dae7bcf1997b2083874096eda61d1547732903d64d3d0b908000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000002880)=@generic={0x0, r1}, 0x18) 3.588911299s ago: executing program 2 (id=2489): r0 = syz_clone(0x48400, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs$namespace(r0, 0x0) 3.10042708s ago: executing program 2 (id=2490): mkdir(&(0x7f0000000000)='./cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x3) 2.824581146s ago: executing program 2 (id=2491): bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, @perf_bp={0x0}, 0x100403, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="06000000040000001810000089"], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=""/103, &(0x7f0000000600), &(0x7f0000000500), 0x80, r2, 0x0, 0x7}, 0x38) 2.520246883s ago: executing program 2 (id=2494): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0) close(r0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8914, &(0x7f0000000080)) perf_event_open(&(0x7f0000001480)={0x2, 0x80, 0x82, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, @perf_config_ext={0x7, 0xf6}, 0x0, 0x0, 0x0, 0x8, 0x0, 0xe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(r0, &(0x7f0000000140)=0x666, 0x12) write$cgroup_pid(r0, &(0x7f0000000440), 0x12) 2.260903189s ago: executing program 0 (id=2496): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="10000000040000000800000005"], 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r0}, &(0x7f0000000080), &(0x7f0000000240)=r1}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x53f, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x8}, 0x50) 2.092385402s ago: executing program 0 (id=2497): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xa, 0x1, 0x4, 0x8}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 2.040723864s ago: executing program 0 (id=2498): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_clone(0x4200, &(0x7f0000002f00), 0x0, 0x0, 0x0, 0x0) sendmsg$unix(r0, &(0x7f00000040c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000004040)=[@cred={{0x1c, 0x1, 0x2, {r1, 0x0, 0xee00}}}], 0x20}, 0x20000000) 1.931249466s ago: executing program 0 (id=2499): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x6}, 0x66) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0c000000040000000400000009"], 0x48) 1.78782498s ago: executing program 0 (id=2500): openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x8, 0x2000000000000216, &(0x7f0000000440)=ANY=[], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) openat$tun(0xffffffffffffff9c, 0x0, 0x101900, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0x1}, 0x0, &(0x7f0000000040)}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1\x00'}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004430000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="02"], 0x48) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x3d) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8946, &(0x7f0000000080)) 478.198119ms ago: executing program 3 (id=2501): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000000)={'bridge_slave_1\x00', @random="010000201000"}) 60.415288ms ago: executing program 0 (id=2502): bpf$PROG_LOAD(0x5, &(0x7f0000000c40)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000fdffffde18000000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000feffffbf0000000000040000851000000200000004000000230000009500000000000000"], 0x0, 0xfffffffe, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r0}, 0xc) bpf$PROG_LOAD(0x5, 0x0, 0x0) 348.14µs ago: executing program 3 (id=2503): r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_open_procfs$namespace(0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10003, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x401, 0x6}, 0x0, 0xf, 0x0, 0x0, 0x0, 0x3ff, 0x3, 0x0, 0x0, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={0xffffffffffffffff, 0x0, &(0x7f0000000040)=""/73}, 0x20) bpf$PROG_BIND_MAP(0x23, &(0x7f00000002c0)={r0}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xb, 0x5, 0xbb, 0xffffffff, 0x2200, 0x1, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x5}, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x50) 0s ago: executing program 2 (id=2504): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x50, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x104046, 0x0, 0x0, 0x9}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000014c0)={0x2, 0x80, 0xe5, 0x6, 0x0, 0x0, 0x0, 0x6, 0x400, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, @perf_config_ext={0x7fffffff, 0x6}, 0x105424, 0x2, 0x0, 0x0, 0x71a, 0x8, 0x9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b70200001a000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b70600007fffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e95d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946e0ebc622003b538dfd8e012e79578e51bc5f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b803000000661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7b148ba532e6ea09c346dfebd38608b32a0080005d9a956773a90a0f4e62d86d00000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e14861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16b089f37b3591a15c0a9be6eb18208404c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b74cd36e7487afa447e2edfae4fa34274ab1ee31cc0cc461605390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f50714600fb6241c6e955031795b2c2f56411e48455b5a8b9988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeedd005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe00000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bc32052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb77000000c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d488afdc0e1700000000000000000000000000000000000000000000000000000520526f21de11c56d59f35d367632952a93466ae595c6aacda690d192a070886df42b27098773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e80339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5100000000100000007a56224e49d9ea955a5f0dec1b3ccd52364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b8382000000006936b7e4746e92dea6c5d1d33d84d96b3572de50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000a5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f3390343c12aa51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3819b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe7f445fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fca4d97a0ae75ccf11e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35e9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137ff17320adda5867947257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a927de6f4c09f4b742e037381c85d2ec7bb2a8152f0d6a99a0370e0cbd65744eb2efd7b65f04aa7e72588757b9612bb4253a63bb303c0c68a07f115d104f2007237a4f771416741bfd63fdfe3ae6f8bea755d8b723853bbae137dc1c3cf40db74a4c1c219d8ddec8f91dae2cdea1353fe062830fa1d233296ec9d8317872257e154665485e7f31cdbfbf435517faf93015b57417d84b8bc8662e097d5ba55d02d48e150695ffae3a676555b10da11751865126d19336116a1e58ab727dda6b343cc97f9479136a66f552abf8fe3d134f6d69df1cffe6740f90735f66ca54fd87800b4bda4db5e68aaccf44d24e09f8a769e3ae7bf246673f15e3d1adae4384bdb7cd30a33e30466b421feb96006c810fd3830a1c75af2580727ffc604d2b04f476acc21419fad9b1bae210baf3551b8dea8879e13859bde08b85c8086e4b7f1fd568042ad5396d3179c71b1dc43291e450ce9b8d7d80fcb44966d7ad4691a378700000000000000000000000000631ffc86fe0c8124536afbfc6300ee2c00000000000000000000000000000000000000000083a5765d06da91165d24bc316607e2d69344aa1c07ff7cd7bc3d17f122478b6e81077782b9c298edc2546045feff90e7aa7da88d2489fb000a4aa838f911c1a8693055e979e033b7707df75b93cf5b8d25242741a88f2d54a7107375b25911aa11efa3a4f87fc14f180e353615b3cb9a5cf5ea843014a277c3694a5a83266f73ef039dd739187923715548d58ff43be997e3570000000000000000009afb8e2221e1959e7421ac6d99c6902c0c73edb2e19eda0306aee0264f0dbe06b7848f9dda251fc662e1f65e96c80baf18e52beb9b606134b58474efcf1a11f2c06839ddba8a98ded151f45254007a0863b39547aed5baadafb7fc222ff9d12dd941460416cc6b987ec77329928d99e3d0ce03d16feb27bea30b7acf895e1bfedcb1d45754435aaf642ea992"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0x18, 0x6000002c, &(0x7f0000000100)="b9ff03316844268cb89e14f0080065e0050200000000000277fbac141416e000030a44079f03b180006000000000845013f2325f003901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014c0000c0adc043084617d7ecf41effff38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d7da058f6efa6d1f5f7ff400"/254, 0x0, 0xfe, 0x60000000, 0x0, 0xfffffffe}, 0x2c) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x26500, 0x0) kernel console output (not intermixed with test programs): length. [ 245.862589][ T8076] netlink: 'syz.1.660': attribute type 3 has an invalid length. [ 245.870940][ T8076] netlink: 132 bytes leftover after parsing attributes in process `syz.1.660'. [ 245.976998][ T8072] team0: Port device geneve1 added [ 246.071649][ T8076] netlink: 'syz.1.660': attribute type 33 has an invalid length. [ 246.092624][ T8076] netlink: 152 bytes leftover after parsing attributes in process `syz.1.660'. [ 246.804481][ T8101] netlink: 60 bytes leftover after parsing attributes in process `syz.1.665'. [ 246.837086][ T8101] netlink: 60 bytes leftover after parsing attributes in process `syz.1.665'. [ 246.850532][ T8098] netlink: 60 bytes leftover after parsing attributes in process `syz.1.665'. [ 246.865801][ T8101] netlink: 60 bytes leftover after parsing attributes in process `syz.1.665'. [ 247.326172][ T8109] netlink: 'syz.0.669': attribute type 10 has an invalid length. [ 247.974120][ T8129] netlink: 'syz.2.675': attribute type 10 has an invalid length. [ 248.289683][ T8129] team0: Port device geneve1 added [ 248.451742][ T8150] netlink: 196 bytes leftover after parsing attributes in process `syz.3.682'. [ 248.555406][ T8146] netlink: 'syz.1.680': attribute type 10 has an invalid length. [ 250.126487][ T8180] netlink: 'syz.2.693': attribute type 10 has an invalid length. [ 250.172441][ T8190] netlink: 'syz.3.695': attribute type 11 has an invalid length. [ 250.640213][ T8207] FAULT_INJECTION: forcing a failure. [ 250.640213][ T8207] name failslab, interval 1, probability 0, space 0, times 0 [ 250.664755][ T8207] CPU: 1 PID: 8207 Comm: syz.1.700 Not tainted syzkaller #0 [ 250.672179][ T8207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 250.682283][ T8207] Call Trace: [ 250.685663][ T8207] [ 250.688642][ T8207] dump_stack_lvl+0x18c/0x250 [ 250.693407][ T8207] ? show_regs_print_info+0x20/0x20 [ 250.698685][ T8207] ? load_image+0x420/0x420 [ 250.703269][ T8207] ? __might_sleep+0xe0/0xe0 [ 250.707924][ T8207] ? __lock_acquire+0x7d80/0x7d80 [ 250.713018][ T8207] should_fail_ex+0x394/0x4c0 [ 250.717798][ T8207] should_failslab+0x9/0x20 [ 250.722369][ T8207] slab_pre_alloc_hook+0x59/0x300 [ 250.727459][ T8207] ? apparmor_sk_alloc_security+0x77/0x100 [ 250.733343][ T8207] __kmem_cache_alloc_node+0x53/0x250 [ 250.738787][ T8207] ? apparmor_sk_alloc_security+0x77/0x100 [ 250.744669][ T8207] kmalloc_trace+0x2a/0xe0 [ 250.749156][ T8207] apparmor_sk_alloc_security+0x77/0x100 [ 250.754861][ T8207] security_sk_alloc+0x6e/0xa0 [ 250.759706][ T8207] sk_prot_alloc+0x101/0x210 [ 250.764348][ T8207] ? sk_alloc+0x24/0x350 [ 250.768630][ T8207] sk_alloc+0x3a/0x350 [ 250.772766][ T8207] ? bpf_ctx_init+0x154/0x190 [ 250.777475][ T8207] bpf_prog_test_run_skb+0x371/0x18f0 [ 250.782890][ T8207] ? __fget_files+0x28/0x460 [ 250.787517][ T8207] ? __fget_files+0x3fc/0x460 [ 250.792234][ T8207] ? cpu_online+0x60/0x60 [ 250.796619][ T8207] bpf_prog_test_run+0x31f/0x390 [ 250.801610][ T8207] __sys_bpf+0x49d/0x890 [ 250.805890][ T8207] ? bpf_link_show_fdinfo+0x390/0x390 [ 250.811313][ T8207] ? lock_chain_count+0x20/0x20 [ 250.816202][ T8207] __x64_sys_bpf+0x7c/0x90 [ 250.820669][ T8207] do_syscall_64+0x55/0xb0 [ 250.825122][ T8207] ? clear_bhb_loop+0x40/0x90 [ 250.829826][ T8207] ? clear_bhb_loop+0x40/0x90 [ 250.834535][ T8207] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 250.841004][ T8207] RIP: 0033:0x7f4bcfb9de99 [ 250.845451][ T8207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 250.865201][ T8207] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 250.873658][ T8207] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 250.881659][ T8207] RDX: 0000000000000050 RSI: 0000200000000180 RDI: 000000000000000a [ 250.889759][ T8207] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 250.897765][ T8207] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 250.905765][ T8207] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 250.913810][ T8207] [ 251.956873][ T8233] netlink: 'syz.0.706': attribute type 21 has an invalid length. [ 251.973896][ T8233] netlink: 128 bytes leftover after parsing attributes in process `syz.0.706'. [ 252.012532][ T8233] netlink: 3 bytes leftover after parsing attributes in process `syz.0.706'. [ 252.024711][ T8227] netlink: 'syz.2.705': attribute type 10 has an invalid length. [ 252.549774][ T8239] netlink: 'syz.0.709': attribute type 29 has an invalid length. [ 252.639598][ T8239] netlink: 'syz.0.709': attribute type 3 has an invalid length. [ 252.659739][ T8239] netlink: 132 bytes leftover after parsing attributes in process `syz.0.709'. [ 252.748777][ T8245] netlink: 'syz.0.709': attribute type 33 has an invalid length. [ 252.791392][ T8245] netlink: 152 bytes leftover after parsing attributes in process `syz.0.709'. [ 253.563428][ T8273] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.720'. [ 253.599523][ T8273] netlink: 4548 bytes leftover after parsing attributes in process `syz.0.720'. [ 253.613108][ T8273] netlink: 'syz.0.720': attribute type 1 has an invalid length. [ 254.297772][ T8279] netlink: 'syz.3.721': attribute type 10 has an invalid length. [ 255.100814][ T8295] netlink: 'syz.3.726': attribute type 29 has an invalid length. [ 255.130187][ T8295] netlink: 'syz.3.726': attribute type 3 has an invalid length. [ 255.149772][ T8295] netlink: 132 bytes leftover after parsing attributes in process `syz.3.726'. [ 255.285133][ T8295] netlink: 'syz.3.726': attribute type 33 has an invalid length. [ 255.293338][ T8295] netlink: 152 bytes leftover after parsing attributes in process `syz.3.726'. [ 256.012028][ T8307] netlink: 'syz.0.732': attribute type 10 has an invalid length. [ 256.032794][ T8307] netlink: 40 bytes leftover after parsing attributes in process `syz.0.732'. [ 256.069279][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.076791][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.288224][ T8314] netlink: 'syz.1.734': attribute type 10 has an invalid length. [ 257.415679][ T8334] netlink: 152 bytes leftover after parsing attributes in process `syz.0.739'. [ 257.472803][ T8334] FAULT_INJECTION: forcing a failure. [ 257.472803][ T8334] name failslab, interval 1, probability 0, space 0, times 0 [ 257.560045][ T8334] CPU: 1 PID: 8334 Comm: syz.0.739 Not tainted syzkaller #0 [ 257.567429][ T8334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 257.577635][ T8334] Call Trace: [ 257.580966][ T8334] [ 257.583944][ T8334] dump_stack_lvl+0x18c/0x250 [ 257.588697][ T8334] ? show_regs_print_info+0x20/0x20 [ 257.593984][ T8334] ? load_image+0x420/0x420 [ 257.598584][ T8334] ? __might_sleep+0xe0/0xe0 [ 257.603233][ T8334] ? __lock_acquire+0x7d80/0x7d80 [ 257.608322][ T8334] should_fail_ex+0x394/0x4c0 [ 257.613077][ T8334] should_failslab+0x9/0x20 [ 257.617907][ T8334] slab_pre_alloc_hook+0x59/0x300 [ 257.622998][ T8334] ? vprintk_emit+0x53d/0x610 [ 257.627740][ T8334] ? do_setlink+0x6b9/0x3f40 [ 257.632387][ T8334] ? do_setlink+0x6b9/0x3f40 [ 257.637045][ T8334] __kmem_cache_alloc_node+0x53/0x250 [ 257.642485][ T8334] ? do_setlink+0x6b9/0x3f40 [ 257.647215][ T8334] __kmalloc+0xa7/0x240 [ 257.651430][ T8334] do_setlink+0x6b9/0x3f40 [ 257.655909][ T8334] ? load_image+0x420/0x420 [ 257.660477][ T8334] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 257.666721][ T8334] ? stack_trace_save+0xaa/0x100 [ 257.671778][ T8334] ? rcu_is_watching+0x15/0xb0 [ 257.676667][ T8334] ? do_trace_netlink_extack+0x7e/0x1a0 [ 257.682266][ T8334] ? __nla_validate+0x50/0x50 [ 257.687013][ T8334] ? validate_linkmsg+0x719/0x910 [ 257.692085][ T8334] rtnl_newlink+0x1848/0x2170 [ 257.696812][ T8334] ? rtnl_newlink+0x451/0x2170 [ 257.701618][ T8334] ? rtnl_setlink+0x4e0/0x4e0 [ 257.706330][ T8334] ? trace_raw_output_contention_end+0xd0/0xd0 [ 257.712549][ T8334] ? rcu_is_watching+0x15/0xb0 [ 257.717355][ T8334] ? trace_contention_end+0x39/0xe0 [ 257.722585][ T8334] ? __mutex_lock+0x30d/0xc80 [ 257.727313][ T8334] ? rtnl_setlink+0x4e0/0x4e0 [ 257.732030][ T8334] rtnetlink_rcv_msg+0x843/0xf90 [ 257.736999][ T8334] ? rtnetlink_rcv_msg+0x220/0xf90 [ 257.742149][ T8334] ? rtnetlink_bind+0x80/0x80 [ 257.746861][ T8334] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 257.752962][ T8334] ? __dev_queue_xmit+0x275/0x3630 [ 257.758116][ T8334] ? lock_chain_count+0x20/0x20 [ 257.763006][ T8334] ? __local_bh_enable_ip+0x13a/0x1c0 [ 257.768417][ T8334] ? lockdep_hardirqs_on+0x98/0x150 [ 257.773694][ T8334] ? __local_bh_enable_ip+0x13a/0x1c0 [ 257.779093][ T8334] ? _local_bh_enable+0xa0/0xa0 [ 257.783985][ T8334] ? __dev_queue_xmit+0x275/0x3630 [ 257.789133][ T8334] ? __dev_queue_xmit+0x1bc2/0x3630 [ 257.794362][ T8334] ? __dev_queue_xmit+0x275/0x3630 [ 257.799558][ T8334] ? perf_trace_lock+0xfc/0x3b0 [ 257.804635][ T8334] netlink_rcv_skb+0x235/0x4c0 [ 257.809447][ T8334] ? rtnetlink_bind+0x80/0x80 [ 257.814163][ T8334] ? netlink_ack+0x1160/0x1160 [ 257.818971][ T8334] ? __lock_acquire+0x7d80/0x7d80 [ 257.824055][ T8334] ? netlink_deliver_tap+0x2e/0x1b0 [ 257.829297][ T8334] netlink_unicast+0x7b1/0x930 [ 257.834112][ T8334] netlink_sendmsg+0x8d0/0xbf0 [ 257.838930][ T8334] ? netlink_getsockopt+0x590/0x590 [ 257.844169][ T8334] ? apparmor_socket_sendmsg+0x8e/0x330 [ 257.849791][ T8334] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 257.855114][ T8334] ? security_socket_sendmsg+0x80/0xa0 [ 257.860606][ T8334] ? netlink_getsockopt+0x590/0x590 [ 257.865847][ T8334] ____sys_sendmsg+0x61b/0x980 [ 257.870773][ T8334] ? __asan_memset+0x22/0x40 [ 257.875397][ T8334] ? __sys_sendmsg_sock+0x30/0x30 [ 257.880456][ T8334] ? __import_iovec+0x3fa/0x850 [ 257.885351][ T8334] ? import_iovec+0x73/0xa0 [ 257.889892][ T8334] ___sys_sendmsg+0x2a6/0x360 [ 257.894615][ T8334] ? __sys_sendmsg+0x2b0/0x2b0 [ 257.899432][ T8334] ? __lock_acquire+0x7d80/0x7d80 [ 257.904526][ T8334] __se_sys_sendmsg+0x1d0/0x2c0 [ 257.909420][ T8334] ? __x64_sys_sendmsg+0x80/0x80 [ 257.914408][ T8334] ? lockdep_hardirqs_on+0x98/0x150 [ 257.919643][ T8334] do_syscall_64+0x55/0xb0 [ 257.924111][ T8334] ? clear_bhb_loop+0x40/0x90 [ 257.928835][ T8334] ? clear_bhb_loop+0x40/0x90 [ 257.933581][ T8334] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 257.939529][ T8334] RIP: 0033:0x7f943079de99 [ 257.943976][ T8334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.963615][ T8334] RSP: 002b:00007f943163c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 257.972062][ T8334] RAX: ffffffffffffffda RBX: 00007f9430a25fa0 RCX: 00007f943079de99 [ 257.980061][ T8334] RDX: 0000000008000000 RSI: 0000200000000940 RDI: 0000000000000003 [ 257.988063][ T8334] RBP: 00007f943163c090 R08: 0000000000000000 R09: 0000000000000000 [ 257.996066][ T8334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 258.004061][ T8334] R13: 00007f9430a26038 R14: 00007f9430a25fa0 R15: 00007ffcb308c8d8 [ 258.012096][ T8334] [ 258.283023][ T8346] validate_nla: 2 callbacks suppressed [ 258.283062][ T8346] netlink: 'syz.2.745': attribute type 10 has an invalid length. [ 258.306245][ T8344] netlink: 'syz.3.744': attribute type 10 has an invalid length. [ 258.317491][ T8344] netlink: 40 bytes leftover after parsing attributes in process `syz.3.744'. [ 259.735837][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 264.816944][ T8375] netlink: 'syz.3.751': attribute type 10 has an invalid length. [ 265.193726][ T8392] netlink: 'syz.3.756': attribute type 10 has an invalid length. [ 265.215515][ T8392] netlink: 40 bytes leftover after parsing attributes in process `syz.3.756'. [ 265.240151][ T8395] netlink: 'syz.1.757': attribute type 10 has an invalid length. [ 266.443901][ T8420] netlink: 'syz.1.765': attribute type 10 has an invalid length. [ 266.753804][ T8432] netlink: 'syz.3.769': attribute type 21 has an invalid length. [ 266.773414][ T8432] netlink: 156 bytes leftover after parsing attributes in process `syz.3.769'. [ 266.973792][ T8437] netlink: 'syz.2.771': attribute type 10 has an invalid length. [ 266.998035][ T8434] netlink: 'syz.1.770': attribute type 10 has an invalid length. [ 267.016355][ T8434] netlink: 40 bytes leftover after parsing attributes in process `syz.1.770'. [ 268.220249][ T8478] netlink: 'syz.1.783': attribute type 21 has an invalid length. [ 268.235686][ T8478] netlink: 156 bytes leftover after parsing attributes in process `syz.1.783'. [ 268.249453][ T8475] netlink: 'syz.0.784': attribute type 10 has an invalid length. [ 271.514503][ T8494] netlink: 9275 bytes leftover after parsing attributes in process `syz.0.789'. [ 271.655982][ T8502] netlink: 'syz.1.791': attribute type 29 has an invalid length. [ 271.729747][ T8502] netlink: 'syz.1.791': attribute type 29 has an invalid length. [ 272.700076][ T8518] netlink: 'syz.2.796': attribute type 10 has an invalid length. [ 274.694508][ T8552] netlink: 'syz.1.806': attribute type 10 has an invalid length. [ 276.049634][ T8576] netlink: 'syz.3.811': attribute type 29 has an invalid length. [ 276.176754][ T8576] netlink: 'syz.3.811': attribute type 29 has an invalid length. [ 276.424033][ T8581] netlink: 9275 bytes leftover after parsing attributes in process `syz.1.815'. [ 277.139696][ T8593] netlink: 'syz.2.817': attribute type 10 has an invalid length. [ 277.507860][ T8602] netlink: 'syz.3.818': attribute type 10 has an invalid length. [ 277.542802][ T8602] netlink: 40 bytes leftover after parsing attributes in process `syz.3.818'. [ 281.164166][ T8630] netlink: 'syz.2.828': attribute type 10 has an invalid length. [ 284.387993][ T8669] netlink: 'syz.3.838': attribute type 10 has an invalid length. [ 284.818315][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 286.508611][ T8699] netlink: 'syz.1.849': attribute type 10 has an invalid length. [ 288.013065][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 289.526569][ T8741] netlink: 'syz.0.861': attribute type 10 has an invalid length. [ 291.831797][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 294.125795][ T8772] netlink: 'syz.0.874': attribute type 10 has an invalid length. [ 294.511978][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 295.890803][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 299.470538][ T8809] netlink: 'syz.3.886': attribute type 10 has an invalid length. [ 300.109625][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 302.610311][ T8859] netlink: 'syz.1.901': attribute type 10 has an invalid length. [ 303.735293][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 303.996639][ T8876] netlink: 'syz.2.905': attribute type 29 has an invalid length. [ 304.074616][ T8876] netlink: 'syz.2.905': attribute type 29 has an invalid length. [ 304.103796][ T8879] netlink: 'syz.2.905': attribute type 29 has an invalid length. [ 304.161250][ T8876] netlink: 'syz.2.905': attribute type 29 has an invalid length. [ 305.161623][ T8900] netlink: 'syz.3.914': attribute type 10 has an invalid length. [ 309.353622][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 309.418821][ T8929] netlink: 'syz.1.925': attribute type 10 has an invalid length. [ 309.691303][ T8933] FAULT_INJECTION: forcing a failure. [ 309.691303][ T8933] name failslab, interval 1, probability 0, space 0, times 0 [ 309.704415][ T8933] CPU: 1 PID: 8933 Comm: syz.3.926 Not tainted syzkaller #0 [ 309.711756][ T8933] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 309.721921][ T8933] Call Trace: [ 309.725270][ T8933] [ 309.728253][ T8933] dump_stack_lvl+0x18c/0x250 [ 309.733173][ T8933] ? show_regs_print_info+0x20/0x20 [ 309.738441][ T8933] ? load_image+0x420/0x420 [ 309.743006][ T8933] ? mod_objcg_state+0x521/0x8c0 [ 309.747977][ T8933] ? verify_lock_unused+0x140/0x140 [ 309.753300][ T8933] should_fail_ex+0x394/0x4c0 [ 309.758014][ T8933] should_failslab+0x9/0x20 [ 309.762578][ T8933] slab_pre_alloc_hook+0x59/0x300 [ 309.767666][ T8933] ? percpu_ref_put+0x12/0x100 [ 309.772474][ T8933] ? nsim_fib_event_nb+0x187/0x1040 [ 309.777702][ T8933] __kmem_cache_alloc_node+0x53/0x250 [ 309.783112][ T8933] ? nsim_fib_event_nb+0x187/0x1040 [ 309.788340][ T8933] kmalloc_trace+0x2a/0xe0 [ 309.792797][ T8933] nsim_fib_event_nb+0x187/0x1040 [ 309.797853][ T8933] ? read_lock_is_recursive+0x20/0x20 [ 309.803267][ T8933] notifier_call_chain+0x18f/0x380 [ 309.808421][ T8933] ? atomic_notifier_call_chain+0x26/0x180 [ 309.814264][ T8933] atomic_notifier_call_chain+0xda/0x180 [ 309.819942][ T8933] call_fib_notifiers+0x31/0x60 [ 309.824829][ T8933] fib6_add+0x1ba1/0x49d0 [ 309.829222][ T8933] ? fib6_update_sernum_stub+0x1e0/0x1e0 [ 309.834903][ T8933] ? __rwlock_init+0x150/0x150 [ 309.839705][ T8933] ? ip6_route_add+0x75/0x160 [ 309.844420][ T8933] ip6_route_add+0x8a/0x160 [ 309.848985][ T8933] ipv6_route_ioctl+0x3af/0x500 [ 309.853943][ T8933] ? rt6_purge_dflt_routers+0xb20/0xb20 [ 309.859830][ T8933] ? __might_fault+0xaa/0x120 [ 309.864546][ T8933] ? __might_fault+0xc6/0x120 [ 309.869251][ T8933] ? __might_fault+0xaa/0x120 [ 309.873968][ T8933] inet6_ioctl+0x247/0x2d0 [ 309.878419][ T8933] ? inet6_getname+0x670/0x670 [ 309.883251][ T8933] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 309.888752][ T8933] sock_do_ioctl+0xfc/0x310 [ 309.893360][ T8933] ? sock_show_fdinfo+0xb0/0xb0 [ 309.898687][ T8933] sock_ioctl+0x5be/0x7e0 [ 309.903142][ T8933] ? sock_poll+0x3e0/0x3e0 [ 309.907602][ T8933] ? bpf_lsm_file_ioctl+0x9/0x10 [ 309.912579][ T8933] ? security_file_ioctl+0x80/0xa0 [ 309.917734][ T8933] ? sock_poll+0x3e0/0x3e0 [ 309.922190][ T8933] __se_sys_ioctl+0xfd/0x170 [ 309.926816][ T8933] do_syscall_64+0x55/0xb0 [ 309.931269][ T8933] ? clear_bhb_loop+0x40/0x90 [ 309.935975][ T8933] ? clear_bhb_loop+0x40/0x90 [ 309.940683][ T8933] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 309.946620][ T8933] RIP: 0033:0x7fa3a4b9de99 [ 309.951065][ T8933] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 309.970913][ T8933] RSP: 002b:00007fa3a5a75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 309.979356][ T8933] RAX: ffffffffffffffda RBX: 00007fa3a4e25fa0 RCX: 00007fa3a4b9de99 [ 309.987375][ T8933] RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000007 [ 309.995376][ T8933] RBP: 00007fa3a5a75090 R08: 0000000000000000 R09: 0000000000000000 [ 310.003396][ T8933] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 310.011414][ T8933] R13: 00007fa3a4e26038 R14: 00007fa3a4e25fa0 R15: 00007ffd87d637a8 [ 310.019435][ T8933] [ 310.280342][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 313.454835][ T8952] netlink: 'syz.3.935': attribute type 10 has an invalid length. [ 314.104072][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 315.436974][ T8975] netlink: 'syz.1.940': attribute type 10 has an invalid length. [ 315.452847][ T8975] netlink: 40 bytes leftover after parsing attributes in process `syz.1.940'. [ 315.554197][ T8970] syzkaller0: entered promiscuous mode [ 315.559785][ T8970] syzkaller0: entered allmulticast mode [ 316.499662][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 317.123302][ T8994] netlink: 'syz.3.946': attribute type 10 has an invalid length. [ 317.523740][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.530195][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.881272][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 318.112400][ T9016] netlink: 'syz.3.951': attribute type 10 has an invalid length. [ 318.143747][ T9016] netlink: 40 bytes leftover after parsing attributes in process `syz.3.951'. [ 319.459995][ T9033] netlink: 'syz.0.957': attribute type 10 has an invalid length. [ 319.626416][ T9040] netlink: 'syz.3.958': attribute type 10 has an invalid length. [ 320.088705][ T9050] netlink: 60 bytes leftover after parsing attributes in process `syz.2.961'. [ 320.251277][ T9050] netlink: 60 bytes leftover after parsing attributes in process `syz.2.961'. [ 320.298811][ T9048] netlink: 60 bytes leftover after parsing attributes in process `syz.2.961'. [ 320.352786][ T9052] netlink: 60 bytes leftover after parsing attributes in process `syz.2.961'. [ 320.402333][ T9053] netlink: 60 bytes leftover after parsing attributes in process `syz.2.961'. [ 321.211742][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 322.527768][ T9070] netlink: 'syz.2.968': attribute type 10 has an invalid length. [ 323.242890][ T9085] netlink: 'syz.2.972': attribute type 25 has an invalid length. [ 323.301618][ T9085] netlink: 'syz.2.972': attribute type 29 has an invalid length. [ 323.432585][ T9081] netlink: 'syz.2.972': attribute type 22 has an invalid length. [ 323.470870][ T9081] netlink: 4 bytes leftover after parsing attributes in process `syz.2.972'. [ 324.864744][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 327.850262][ T9110] netlink: 'syz.0.981': attribute type 5 has an invalid length. [ 327.913895][ T9110] syz.0.981 uses obsolete (PF_INET,SOCK_PACKET) [ 328.035507][ T9113] netlink: 'syz.1.982': attribute type 46 has an invalid length. [ 328.071976][ T9110] netlink: 'syz.0.981': attribute type 25 has an invalid length. [ 328.091437][ T9110] netlink: 'syz.0.981': attribute type 28 has an invalid length. [ 328.452659][ T9114] netlink: 'syz.2.980': attribute type 10 has an invalid length. [ 330.881260][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 333.380134][ T9154] netlink: 'syz.2.992': attribute type 25 has an invalid length. [ 333.404639][ T9154] netlink: 'syz.2.992': attribute type 29 has an invalid length. [ 333.450927][ T9155] netlink: 'syz.2.992': attribute type 22 has an invalid length. [ 333.512463][ T9155] netlink: 4 bytes leftover after parsing attributes in process `syz.2.992'. [ 333.842883][ T9161] netlink: 'syz.1.994': attribute type 10 has an invalid length. [ 334.745360][ T9175] netlink: 'syz.1.999': attribute type 10 has an invalid length. [ 334.774753][ T9175] netlink: 40 bytes leftover after parsing attributes in process `syz.1.999'. [ 336.186050][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 336.244795][ T9198] netlink: 'syz.3.1006': attribute type 10 has an invalid length. [ 340.212932][ T9217] netlink: 'syz.0.1009': attribute type 10 has an invalid length. [ 340.220923][ T9217] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1009'. [ 340.777967][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 341.072010][ T9237] netlink: 'syz.0.1019': attribute type 10 has an invalid length. [ 341.896926][ T9255] netlink: 'syz.3.1024': attribute type 3 has an invalid length. [ 341.922494][ T9255] netlink: 'syz.3.1024': attribute type 1 has an invalid length. [ 341.969779][ T9255] netlink: 60387 bytes leftover after parsing attributes in process `syz.3.1024'. [ 345.077483][ T9260] netlink: 'syz.0.1029': attribute type 10 has an invalid length. [ 345.271384][ T9265] netlink: 'syz.3.1027': attribute type 10 has an invalid length. [ 345.298243][ T9265] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1027'. [ 345.321330][ T9268] netlink: 'syz.2.1030': attribute type 3 has an invalid length. [ 345.355601][ T9268] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.1030'. [ 345.805325][ T9276] bridge_slave_1: left allmulticast mode [ 345.812895][ T9276] bridge_slave_1: left promiscuous mode [ 345.822148][ T9276] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.941984][ T9276] bridge_slave_0: left allmulticast mode [ 345.969343][ T9276] bridge_slave_0: left promiscuous mode [ 345.988755][ T9276] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.492820][ T9276] bond0: (slave bridge0): Releasing backup interface [ 347.713659][ T9292] netlink: 'syz.0.1039': attribute type 10 has an invalid length. [ 347.962030][ T9299] netlink: 'syz.2.1041': attribute type 10 has an invalid length. [ 347.994459][ T9299] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1041'. [ 349.008467][ T9325] FAULT_INJECTION: forcing a failure. [ 349.008467][ T9325] name failslab, interval 1, probability 0, space 0, times 0 [ 349.021692][ T9325] CPU: 1 PID: 9325 Comm: syz.1.1049 Not tainted syzkaller #0 [ 349.029127][ T9325] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 349.039234][ T9325] Call Trace: [ 349.042567][ T9325] [ 349.045569][ T9325] dump_stack_lvl+0x18c/0x250 [ 349.050677][ T9325] ? lock_chain_count+0x20/0x20 [ 349.055653][ T9325] ? show_regs_print_info+0x20/0x20 [ 349.060930][ T9325] ? load_image+0x420/0x420 [ 349.065554][ T9325] should_fail_ex+0x394/0x4c0 [ 349.070355][ T9325] should_failslab+0x9/0x20 [ 349.074941][ T9325] slab_pre_alloc_hook+0x59/0x300 [ 349.080078][ T9325] kmem_cache_alloc+0x5a/0x2c0 [ 349.084994][ T9325] ? __inet_hash_connect+0x808/0x1870 [ 349.090499][ T9325] __inet_hash_connect+0x808/0x1870 [ 349.095762][ T9325] ? inet_hash_connect+0x130/0x130 [ 349.100953][ T9325] ? inet_bhash2_reset_saddr+0x80/0x80 [ 349.106497][ T9325] tcp_v4_connect+0xc55/0x18a0 [ 349.111363][ T9325] ? lockdep_hardirqs_on+0x98/0x150 [ 349.116683][ T9325] ? tcp_twsk_unique+0x970/0x970 [ 349.121696][ T9325] ? mptcp_token_new_connect+0x4b9/0x620 [ 349.127523][ T9325] mptcp_connect+0x403/0x5e0 [ 349.132174][ T9325] __inet_stream_connect+0x254/0xdf0 [ 349.137841][ T9325] ? inet_dgram_connect+0x340/0x340 [ 349.143128][ T9325] tcp_sendmsg_fastopen+0x3af/0x5f0 [ 349.148403][ T9325] mptcp_sendmsg_fastopen+0x121/0x4c0 [ 349.153848][ T9325] mptcp_sendmsg+0x144c/0x1670 [ 349.158672][ T9325] ? aa_sk_perm+0x83c/0x970 [ 349.163277][ T9325] ? aa_sk_perm+0x83c/0x970 [ 349.167846][ T9325] ? aa_af_perm+0x330/0x330 [ 349.172403][ T9325] ? tomoyo_socket_sendmsg_permission+0x1e1/0x2f0 [ 349.178891][ T9325] ? mptcp_shutdown+0x80/0x80 [ 349.183638][ T9325] ? sock_rps_record_flow+0x19/0x3f0 [ 349.189000][ T9325] ? inet_sendmsg+0xce/0x2a0 [ 349.193662][ T9325] ? inet_send_prepare+0x250/0x250 [ 349.198854][ T9325] ____sys_sendmsg+0x61b/0x980 [ 349.203824][ T9325] ? __asan_memset+0x22/0x40 [ 349.208663][ T9325] ? __sys_sendmsg_sock+0x30/0x30 [ 349.213753][ T9325] ? __import_iovec+0x3fa/0x850 [ 349.218695][ T9325] ? import_iovec+0x73/0xa0 [ 349.223267][ T9325] ___sys_sendmsg+0x2a6/0x360 [ 349.228012][ T9325] ? get_pid_task+0x20/0x1e0 [ 349.232811][ T9325] ? __sys_sendmsg+0x2b0/0x2b0 [ 349.237671][ T9325] ? __lock_acquire+0x7d80/0x7d80 [ 349.242883][ T9325] __se_sys_sendmsg+0x1d0/0x2c0 [ 349.247985][ T9325] ? __x64_sys_sendmsg+0x80/0x80 [ 349.253009][ T9325] ? lockdep_hardirqs_on+0x98/0x150 [ 349.258283][ T9325] do_syscall_64+0x55/0xb0 [ 349.262797][ T9325] ? clear_bhb_loop+0x40/0x90 [ 349.267678][ T9325] ? clear_bhb_loop+0x40/0x90 [ 349.272420][ T9325] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 349.278488][ T9325] RIP: 0033:0x7f4bcfb9de99 [ 349.282965][ T9325] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 349.302743][ T9325] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 349.311227][ T9325] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 349.319257][ T9325] RDX: 000000003406c096 RSI: 0000200000000240 RDI: 0000000000000003 [ 349.327371][ T9325] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 349.335789][ T9325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 349.343808][ T9325] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 349.351858][ T9325] [ 351.852646][ T9334] netlink: 'syz.1.1051': attribute type 10 has an invalid length. [ 352.435301][ T9340] bridge_slave_1: left allmulticast mode [ 352.445031][ T9340] bridge_slave_1: left promiscuous mode [ 352.481763][ T9340] bridge0: port 2(bridge_slave_1) entered disabled state [ 352.677615][ T9340] bridge_slave_0: left allmulticast mode [ 352.694954][ T9340] bridge_slave_0: left promiscuous mode [ 352.726186][ T9340] bridge0: port 1(bridge_slave_0) entered disabled state [ 352.998776][ T9340] bond0: (slave bridge0): Releasing backup interface [ 353.051935][ T9338] netlink: 'syz.2.1053': attribute type 10 has an invalid length. [ 353.072379][ T9338] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1053'. [ 353.684392][ T9363] netlink: 'syz.1.1060': attribute type 10 has an invalid length. [ 353.790964][ T9368] tap0: tun_chr_ioctl cmd 2147767520 [ 353.799171][ T9376] FAULT_INJECTION: forcing a failure. [ 353.799171][ T9376] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 353.808413][ T9368] tap0: tun_chr_ioctl cmd 2147767511 [ 353.819293][ T9376] CPU: 1 PID: 9376 Comm: syz.2.1063 Not tainted syzkaller #0 [ 353.826760][ T9376] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 353.836877][ T9376] Call Trace: [ 353.840202][ T9376] [ 353.843176][ T9376] dump_stack_lvl+0x18c/0x250 [ 353.847921][ T9376] ? show_regs_print_info+0x20/0x20 [ 353.853197][ T9376] ? load_image+0x420/0x420 [ 353.857783][ T9376] ? __might_fault+0xaa/0x120 [ 353.862521][ T9376] ? __lock_acquire+0x7d80/0x7d80 [ 353.867615][ T9376] should_fail_ex+0x394/0x4c0 [ 353.872364][ T9376] _copy_to_user+0x2f/0xa0 [ 353.876887][ T9376] finalize_log+0xe4/0x160 [ 353.881419][ T9376] ? btf_parse_struct_metas+0xde0/0xde0 [ 353.887020][ T9376] ? btf_check_type_tags+0x674/0x680 [ 353.892585][ T9376] btf_new_fd+0x757/0x9e0 [ 353.897159][ T9376] ? bpf_btf_show_fdinfo+0x80/0x80 [ 353.902316][ T9376] ? capable+0x88/0xe0 [ 353.906422][ T9376] __sys_bpf+0x670/0x890 [ 353.910711][ T9376] ? bpf_link_show_fdinfo+0x390/0x390 [ 353.916133][ T9376] ? lock_chain_count+0x20/0x20 [ 353.921125][ T9376] __x64_sys_bpf+0x7c/0x90 [ 353.925582][ T9376] do_syscall_64+0x55/0xb0 [ 353.930073][ T9376] ? clear_bhb_loop+0x40/0x90 [ 353.934795][ T9376] ? clear_bhb_loop+0x40/0x90 [ 353.939610][ T9376] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 353.945548][ T9376] RIP: 0033:0x7fe6dab9de99 [ 353.950080][ T9376] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 353.969715][ T9376] RSP: 002b:00007fe6dbae0028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 353.978168][ T9376] RAX: ffffffffffffffda RBX: 00007fe6dae25fa0 RCX: 00007fe6dab9de99 [ 353.986167][ T9376] RDX: 0000000000000020 RSI: 0000200000001300 RDI: 0000000000000012 [ 353.994180][ T9376] RBP: 00007fe6dbae0090 R08: 0000000000000000 R09: 0000000000000000 [ 354.002272][ T9376] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 354.010277][ T9376] R13: 00007fe6dae26038 R14: 00007fe6dae25fa0 R15: 00007ffe3664dc28 [ 354.018382][ T9376] [ 354.943910][ T9397] bridge_slave_0: left allmulticast mode [ 354.958727][ T9397] bridge_slave_0: left promiscuous mode [ 354.975259][ T9397] bridge0: port 1(bridge_slave_0) entered disabled state [ 355.172216][ T9397] bond0: (slave bridge0): Releasing backup interface [ 355.312536][ T9396] netlink: 'syz.1.1069': attribute type 10 has an invalid length. [ 355.320586][ T9396] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1069'. [ 359.214305][ T9430] netlink: 'syz.3.1079': attribute type 10 has an invalid length. [ 359.258280][ T9432] netlink: 'syz.1.1080': attribute type 10 has an invalid length. [ 359.266760][ T9432] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1080'. [ 359.468170][ T9438] bridge_slave_0: left allmulticast mode [ 359.492917][ T9438] bridge_slave_0: left promiscuous mode [ 359.509055][ T9438] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.716014][ T9438] bond0: (slave bridge0): Releasing backup interface [ 360.743005][ T9466] netlink: 76 bytes leftover after parsing attributes in process `syz.3.1091'. [ 360.789821][ T9466] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1091'. [ 360.857505][ T9464] netlink: 'syz.2.1090': attribute type 10 has an invalid length. [ 360.876320][ T9464] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1090'. [ 361.245242][ T9478] tap0: tun_chr_ioctl cmd 2147767520 [ 361.274559][ T9478] tap0: tun_chr_ioctl cmd 2147767511 [ 361.681976][ T9489] FAULT_INJECTION: forcing a failure. [ 361.681976][ T9489] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 361.717608][ T9489] CPU: 0 PID: 9489 Comm: syz.1.1099 Not tainted syzkaller #0 [ 361.725068][ T9489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 361.735205][ T9489] Call Trace: [ 361.738559][ T9489] [ 361.741535][ T9489] dump_stack_lvl+0x18c/0x250 [ 361.746319][ T9489] ? show_regs_print_info+0x20/0x20 [ 361.751589][ T9489] ? load_image+0x420/0x420 [ 361.756165][ T9489] ? __might_fault+0xaa/0x120 [ 361.760910][ T9489] ? __lock_acquire+0x7d80/0x7d80 [ 361.766003][ T9489] ? trace_call_bpf+0xc3/0x6c0 [ 361.770899][ T9489] should_fail_ex+0x394/0x4c0 [ 361.775649][ T9489] _copy_from_user+0x2f/0xe0 [ 361.780303][ T9489] ___sys_sendmsg+0x1c7/0x360 [ 361.785058][ T9489] ? __sys_sendmsg+0x2b0/0x2b0 [ 361.789946][ T9489] __se_sys_sendmsg+0x1d0/0x2c0 [ 361.794863][ T9489] ? __x64_sys_sendmsg+0x80/0x80 [ 361.799879][ T9489] ? syscall_enter_from_user_mode+0x2e/0x80 [ 361.805841][ T9489] do_syscall_64+0x55/0xb0 [ 361.810329][ T9489] ? clear_bhb_loop+0x40/0x90 [ 361.815064][ T9489] ? clear_bhb_loop+0x40/0x90 [ 361.819799][ T9489] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 361.825762][ T9489] RIP: 0033:0x7f4bcfb9de99 [ 361.830234][ T9489] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 361.850014][ T9489] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 361.858465][ T9489] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 361.866574][ T9489] RDX: 00000000000080d1 RSI: 0000200000000140 RDI: 0000000000000005 [ 361.874580][ T9489] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 361.882582][ T9489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 361.890578][ T9489] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 361.898593][ T9489] [ 362.370618][ T9502] netlink: 'syz.0.1103': attribute type 10 has an invalid length. [ 362.391004][ T9502] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1103'. [ 363.087911][ T9518] netlink: 'syz.0.1115': attribute type 10 has an invalid length. [ 363.106385][ T9518] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1115'. [ 364.955548][ T9552] netlink: 'syz.0.1119': attribute type 10 has an invalid length. [ 364.974771][ T9552] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1119'. [ 367.009598][ T9599] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1135'. [ 367.023234][ T9593] netlink: 'syz.1.1133': attribute type 10 has an invalid length. [ 367.040476][ T9593] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1133'. [ 367.068974][ T9599] netlink: 132 bytes leftover after parsing attributes in process `syz.2.1135'. [ 367.677553][ T9618] tap0: tun_chr_ioctl cmd 2147767520 [ 367.712067][ T9618] tap0: tun_chr_ioctl cmd 2147767511 [ 368.776408][ T9630] netlink: 'syz.0.1146': attribute type 10 has an invalid length. [ 368.800289][ T9630] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1146'. [ 369.184428][ T9641] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1150'. [ 369.308831][ T9641] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1150'. [ 369.673053][ T9654] tap0: tun_chr_ioctl cmd 2147767520 [ 369.694334][ T9654] tap0: tun_chr_ioctl cmd 2147767511 [ 370.191016][ T9667] netlink: 'syz.1.1158': attribute type 10 has an invalid length. [ 370.199577][ T9667] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1158'. [ 370.901142][ T9689] netlink: 'syz.0.1168': attribute type 21 has an invalid length. [ 370.918362][ T9689] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1168'. [ 370.933721][ T9689] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1168'. [ 371.371531][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 371.702755][ T9704] tap0: tun_chr_ioctl cmd 2147767520 [ 371.733825][ T9704] tap0: tun_chr_ioctl cmd 2147767511 [ 371.907696][ T9707] netlink: 'syz.2.1172': attribute type 10 has an invalid length. [ 371.941489][ T9707] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1172'. [ 375.700235][ T9735] tap0: tun_chr_ioctl cmd 2147767520 [ 376.012433][ T9737] netlink: 'syz.3.1182': attribute type 10 has an invalid length. [ 376.044067][ T9737] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1182'. [ 377.075038][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 378.956493][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.972487][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 380.443363][ T9778] tap0: tun_chr_ioctl cmd 2147767520 [ 380.706292][ T9782] netlink: 'syz.1.1193': attribute type 10 has an invalid length. [ 380.745999][ T9782] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1193'. [ 382.808273][ T9812] netlink: 3076 bytes leftover after parsing attributes in process `syz.3.1202'. [ 382.892545][ T9812] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.1202'. [ 382.979070][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 383.194497][ T9813] netlink: 128 bytes leftover after parsing attributes in process `syz.3.1202'. [ 383.229364][ T9813] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 383.692809][ T9817] netlink: 'syz.2.1203': attribute type 10 has an invalid length. [ 383.722700][ T9817] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1203'. [ 385.404348][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 385.714270][ T9848] tap0: tun_chr_ioctl cmd 2147767520 [ 386.407870][ T9856] netlink: 'syz.2.1215': attribute type 10 has an invalid length. [ 386.419206][ T9856] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1215'. [ 386.810776][ T9865] netlink: 'syz.1.1218': attribute type 13 has an invalid length. [ 386.826007][ T9865] netlink: 172 bytes leftover after parsing attributes in process `syz.1.1218'. [ 387.036507][ T9872] netlink: 'syz.0.1221': attribute type 27 has an invalid length. [ 387.082466][ T9872] netlink: 'syz.0.1221': attribute type 3 has an invalid length. [ 387.121203][ T9872] netlink: 132 bytes leftover after parsing attributes in process `syz.0.1221'. [ 388.688313][ T9865] erspan0: refused to change device tx_queue_len [ 390.471188][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 392.219744][ T9902] netlink: 'syz.3.1228': attribute type 10 has an invalid length. [ 392.317749][ T9902] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1228'. [ 394.163686][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 397.162843][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 397.325848][ T9948] netlink: 'syz.3.1241': attribute type 10 has an invalid length. [ 397.364368][ T9948] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1241'. [ 401.432927][ T9984] tap0: tun_chr_ioctl cmd 2147767520 [ 401.444239][ T9984] tap0: tun_chr_ioctl cmd 2147767511 [ 402.614391][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 403.833039][T10011] netlink: 55631 bytes leftover after parsing attributes in process `syz.0.1263'. [ 403.929947][T10011] netlink: 6332 bytes leftover after parsing attributes in process `syz.0.1263'. [ 406.872142][T10022] netlink: 'syz.0.1266': attribute type 10 has an invalid length. [ 407.307019][T10029] netlink: 'syz.0.1266': attribute type 9 has an invalid length. [ 407.343046][T10029] netlink: 181676 bytes leftover after parsing attributes in process `syz.0.1266'. [ 407.417146][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 409.799886][T10022] veth1_macvtap: left promiscuous mode [ 409.972770][T10028] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 409.980294][T10028] IPv6: NLM_F_CREATE should be set when creating new route [ 409.987693][T10028] IPv6: NLM_F_CREATE should be set when creating new route [ 409.995028][T10028] IPv6: NLM_F_CREATE should be set when creating new route [ 410.378394][T10041] netlink: 'syz.2.1272': attribute type 10 has an invalid length. [ 410.395170][T10041] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1272'. [ 414.738037][T10076] netlink: 'syz.0.1283': attribute type 10 has an invalid length. [ 414.758716][T10076] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1283'. [ 414.948540][T10085] tap0: tun_chr_ioctl cmd 2147767511 [ 415.101749][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 416.405142][T10110] netlink: 'syz.0.1296': attribute type 10 has an invalid length. [ 416.434385][T10110] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1296'. [ 417.514170][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 418.126893][T10131] tap0: tun_chr_ioctl cmd 2147767511 [ 418.842551][T10150] netlink: 'syz.2.1307': attribute type 10 has an invalid length. [ 418.875091][T10150] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1307'. [ 419.958053][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 423.590905][T10198] netlink: 'syz.2.1320': attribute type 10 has an invalid length. [ 423.630647][T10198] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1320'. [ 425.247007][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 429.196240][T10228] netlink: 'syz.0.1335': attribute type 10 has an invalid length. [ 429.211619][T10228] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1335'. [ 430.113060][T10245] netlink: 'syz.0.1348': attribute type 10 has an invalid length. [ 430.130070][T10245] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1348'. [ 431.107390][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 431.908606][T10286] netlink: 'syz.2.1352': attribute type 10 has an invalid length. [ 431.996161][T10286] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1352'. [ 432.228420][T10300] netlink: 'syz.0.1357': attribute type 39 has an invalid length. [ 432.415538][T10305] netlink: 'syz.1.1358': attribute type 10 has an invalid length. [ 432.442331][T10305] netlink: 55 bytes leftover after parsing attributes in process `syz.1.1358'. [ 433.552195][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 433.930620][T10329] netlink: 'syz.1.1367': attribute type 10 has an invalid length. [ 433.954654][T10329] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1367'. [ 436.273689][T10366] netlink: 'syz.1.1380': attribute type 10 has an invalid length. [ 436.281612][T10366] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1380'. [ 436.630364][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 438.147473][T10399] netlink: 'syz.1.1393': attribute type 10 has an invalid length. [ 438.180551][T10399] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1393'. [ 438.738731][T10411] netlink: 'syz.1.1397': attribute type 10 has an invalid length. [ 440.137015][T10442] netlink: 'syz.2.1406': attribute type 10 has an invalid length. [ 440.149503][T10442] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1406'. [ 440.387372][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.394091][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.783003][T10456] netlink: 'syz.2.1413': attribute type 10 has an invalid length. [ 441.603737][T10483] netlink: 'syz.0.1421': attribute type 10 has an invalid length. [ 441.634394][T10483] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1421'. [ 442.877567][T10519] netlink: 176 bytes leftover after parsing attributes in process `syz.3.1430'. [ 443.403096][T10524] netlink: 'syz.1.1433': attribute type 10 has an invalid length. [ 443.421379][T10524] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1433'. [ 443.869550][T10539] FAULT_INJECTION: forcing a failure. [ 443.869550][T10539] name failslab, interval 1, probability 0, space 0, times 0 [ 443.929306][T10539] CPU: 1 PID: 10539 Comm: syz.1.1438 Not tainted syzkaller #0 [ 443.936895][T10539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 443.947015][T10539] Call Trace: [ 443.950379][T10539] [ 443.953361][T10539] dump_stack_lvl+0x18c/0x250 [ 443.958165][T10539] ? show_regs_print_info+0x20/0x20 [ 443.963441][T10539] ? load_image+0x420/0x420 [ 443.968037][T10539] should_fail_ex+0x394/0x4c0 [ 443.972826][T10539] should_failslab+0x9/0x20 [ 443.977594][T10539] slab_pre_alloc_hook+0x59/0x300 [ 443.982726][T10539] kmem_cache_alloc+0x5a/0x2c0 [ 443.987573][T10539] ? dst_alloc+0x105/0x170 [ 443.992167][T10539] dst_alloc+0x105/0x170 [ 443.996507][T10539] ip_route_output_key_hash_rcu+0x14a2/0x2350 [ 444.002758][T10539] ? ip_route_output_key_hash+0x13d/0x330 [ 444.008559][T10539] ip_route_output_key_hash+0x1f3/0x330 [ 444.014363][T10539] ? ip_route_input_rcu+0x3120/0x3120 [ 444.019818][T10539] ? lockdep_hardirqs_on+0x98/0x150 [ 444.025103][T10539] ? l3mdev_master_ifindex_by_index+0x121/0x1a0 [ 444.031436][T10539] ? inet_sk_flowi_flags+0x2d/0xc0 [ 444.036619][T10539] ip_route_output_flow+0x2a/0x150 [ 444.041794][T10539] ? security_sk_classify_flow+0x7b/0x90 [ 444.047635][T10539] udp_sendmsg+0x160e/0x23d0 [ 444.052325][T10539] ? ip_skb_dst_mtu+0x9c0/0x9c0 [ 444.057236][T10539] ? udp_cmsg_send+0x350/0x350 [ 444.062101][T10539] ? lockdep_hardirqs_on+0x98/0x150 [ 444.067362][T10539] ? inet_sendmsg+0x10d/0x2a0 [ 444.072128][T10539] ? _local_bh_enable+0xa0/0xa0 [ 444.077055][T10539] ? do_raw_spin_unlock+0x121/0x230 [ 444.082337][T10539] ? inet_sendmsg+0x10d/0x2a0 [ 444.087170][T10539] ? inet_sendmsg+0x10d/0x2a0 [ 444.091898][T10539] ? inet_send_prepare+0x250/0x250 [ 444.097058][T10539] ____sys_sendmsg+0x61b/0x980 [ 444.101888][T10539] ? __sys_sendmsg_sock+0x30/0x30 [ 444.106959][T10539] ? __import_iovec+0x5f2/0x850 [ 444.111854][T10539] ? import_iovec+0x73/0xa0 [ 444.116394][T10539] ___sys_sendmsg+0x2a6/0x360 [ 444.121113][T10539] ? perf_trace_run_bpf_submit+0xf4/0x1c0 [ 444.126882][T10539] ? __sys_sendmsg+0x2b0/0x2b0 [ 444.131713][T10539] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 444.137733][T10539] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 444.144040][T10539] ? lockdep_hardirqs_on+0x98/0x150 [ 444.149379][T10539] ? audit_tree_destroy_watch+0x20/0x20 [ 444.155067][T10539] __se_sys_sendmsg+0x1d0/0x2c0 [ 444.159962][T10539] ? perf_trace_preemptirq_template+0x269/0x330 [ 444.166237][T10539] ? __x64_sys_sendmsg+0x80/0x80 [ 444.171250][T10539] ? lockdep_hardirqs_on+0x98/0x150 [ 444.176491][T10539] do_syscall_64+0x55/0xb0 [ 444.180947][T10539] ? clear_bhb_loop+0x40/0x90 [ 444.185651][T10539] ? clear_bhb_loop+0x40/0x90 [ 444.190387][T10539] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 444.196319][T10539] RIP: 0033:0x7f4bcfb9de99 [ 444.200763][T10539] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 444.220408][T10539] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 444.228945][T10539] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 444.236946][T10539] RDX: 0000000000000000 RSI: 0000200000007940 RDI: 0000000000000008 [ 444.244953][T10539] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 444.252950][T10539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 444.260947][T10539] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 444.268989][T10539] [ 445.495770][T10566] netlink: 'syz.1.1446': attribute type 10 has an invalid length. [ 445.552320][T10566] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1446'. [ 445.619912][T10568] netlink: 'syz.0.1448': attribute type 10 has an invalid length. [ 445.815757][T10578] FAULT_INJECTION: forcing a failure. [ 445.815757][T10578] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 445.880850][T10578] CPU: 0 PID: 10578 Comm: syz.2.1450 Not tainted syzkaller #0 [ 445.888402][T10578] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 445.898570][T10578] Call Trace: [ 445.901889][T10578] [ 445.904899][T10578] dump_stack_lvl+0x18c/0x250 [ 445.909647][T10578] ? show_regs_print_info+0x20/0x20 [ 445.914910][T10578] ? load_image+0x420/0x420 [ 445.919476][T10578] ? __might_fault+0xaa/0x120 [ 445.924209][T10578] ? __lock_acquire+0x7d80/0x7d80 [ 445.929287][T10578] should_fail_ex+0x394/0x4c0 [ 445.934008][T10578] _copy_from_user+0x2f/0xe0 [ 445.938686][T10578] ___sys_sendmsg+0x1c7/0x360 [ 445.943523][T10578] ? get_pid_task+0x20/0x1e0 [ 445.948191][T10578] ? __sys_sendmsg+0x2b0/0x2b0 [ 445.953079][T10578] ? __lock_acquire+0x7d80/0x7d80 [ 445.958220][T10578] __se_sys_sendmsg+0x1d0/0x2c0 [ 445.963152][T10578] ? __x64_sys_sendmsg+0x80/0x80 [ 445.968178][T10578] ? lockdep_hardirqs_on+0x98/0x150 [ 445.973453][T10578] do_syscall_64+0x55/0xb0 [ 445.977933][T10578] ? clear_bhb_loop+0x40/0x90 [ 445.982700][T10578] ? clear_bhb_loop+0x40/0x90 [ 445.987458][T10578] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 445.993428][T10578] RIP: 0033:0x7fe6dab9de99 [ 445.997894][T10578] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 446.017603][T10578] RSP: 002b:00007fe6dbae0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 446.026087][T10578] RAX: ffffffffffffffda RBX: 00007fe6dae25fa0 RCX: 00007fe6dab9de99 [ 446.034120][T10578] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 446.042185][T10578] RBP: 00007fe6dbae0090 R08: 0000000000000000 R09: 0000000000000000 [ 446.050217][T10578] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.058332][T10578] R13: 00007fe6dae26038 R14: 00007fe6dae25fa0 R15: 00007ffe3664dc28 [ 446.066389][T10578] [ 446.500590][T10592] FAULT_INJECTION: forcing a failure. [ 446.500590][T10592] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 446.522862][T10592] CPU: 0 PID: 10592 Comm: syz.0.1455 Not tainted syzkaller #0 [ 446.530416][T10592] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 446.540551][T10592] Call Trace: [ 446.543878][T10592] [ 446.546850][T10592] dump_stack_lvl+0x18c/0x250 [ 446.551679][T10592] ? show_regs_print_info+0x20/0x20 [ 446.556938][T10592] ? load_image+0x420/0x420 [ 446.561534][T10592] ? __might_fault+0xaa/0x120 [ 446.566269][T10592] ? __lock_acquire+0x7d80/0x7d80 [ 446.571358][T10592] should_fail_ex+0x394/0x4c0 [ 446.576126][T10592] _copy_from_user+0x2f/0xe0 [ 446.580773][T10592] ___sys_sendmsg+0x1c7/0x360 [ 446.585523][T10592] ? get_pid_task+0x20/0x1e0 [ 446.590182][T10592] ? __sys_sendmsg+0x2b0/0x2b0 [ 446.595032][T10592] ? __lock_acquire+0x7d80/0x7d80 [ 446.600142][T10592] __se_sys_sendmsg+0x1d0/0x2c0 [ 446.605212][T10592] ? __x64_sys_sendmsg+0x80/0x80 [ 446.610236][T10592] ? lockdep_hardirqs_on+0x98/0x150 [ 446.615501][T10592] do_syscall_64+0x55/0xb0 [ 446.620069][T10592] ? clear_bhb_loop+0x40/0x90 [ 446.624884][T10592] ? clear_bhb_loop+0x40/0x90 [ 446.629619][T10592] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 446.635613][T10592] RIP: 0033:0x7f943079de99 [ 446.640117][T10592] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 446.659968][T10592] RSP: 002b:00007f943163c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 446.668493][T10592] RAX: ffffffffffffffda RBX: 00007f9430a25fa0 RCX: 00007f943079de99 [ 446.676531][T10592] RDX: 0000000000004040 RSI: 0000200000002740 RDI: 0000000000000004 [ 446.684564][T10592] RBP: 00007f943163c090 R08: 0000000000000000 R09: 0000000000000000 [ 446.692594][T10592] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 446.700621][T10592] R13: 00007f9430a26038 R14: 00007f9430a25fa0 R15: 00007ffcb308c8d8 [ 446.708665][T10592] [ 447.161832][T10603] netlink: 'syz.2.1459': attribute type 10 has an invalid length. [ 447.176282][T10603] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1459'. [ 447.536693][T10612] netlink: 'syz.2.1461': attribute type 10 has an invalid length. [ 448.201394][T10638] netlink: 'syz.1.1470': attribute type 10 has an invalid length. [ 448.222981][T10638] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1470'. [ 449.225729][T10664] netlink: 'syz.3.1479': attribute type 10 has an invalid length. [ 449.477535][T10671] netlink: 'syz.0.1482': attribute type 10 has an invalid length. [ 449.501370][T10671] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1482'. [ 450.501819][T10704] netlink: 'syz.3.1493': attribute type 39 has an invalid length. [ 450.942718][T10710] netlink: 'syz.3.1495': attribute type 10 has an invalid length. [ 450.972493][T10710] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1495'. [ 454.511912][T10739] netlink: 16098 bytes leftover after parsing attributes in process `syz.2.1502'. [ 454.822373][T10750] netlink: 'syz.1.1507': attribute type 10 has an invalid length. [ 454.840926][T10750] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1507'. [ 455.425372][T10763] netlink: 'syz.1.1509': attribute type 10 has an invalid length. [ 456.980700][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 457.496166][T10789] netlink: 'syz.0.1517': attribute type 10 has an invalid length. [ 457.532303][T10789] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1517'. [ 458.482619][T10802] netlink: 'syz.3.1520': attribute type 10 has an invalid length. [ 460.654691][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 461.272607][T10824] netlink: 'syz.1.1526': attribute type 10 has an invalid length. [ 461.292359][T10824] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1526'. [ 462.046768][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 462.214493][T10845] netlink: 'syz.2.1530': attribute type 10 has an invalid length. [ 464.192434][T10871] netlink: 'syz.2.1536': attribute type 10 has an invalid length. [ 464.249625][T10871] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1536'. [ 465.184585][T10887] netlink: 'syz.2.1541': attribute type 10 has an invalid length. [ 465.383637][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 467.053000][T10908] FAULT_INJECTION: forcing a failure. [ 467.053000][T10908] name failslab, interval 1, probability 0, space 0, times 0 [ 467.142496][T10908] CPU: 0 PID: 10908 Comm: syz.0.1549 Not tainted syzkaller #0 [ 467.150281][T10908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 467.160414][T10908] Call Trace: [ 467.163748][T10908] [ 467.166829][T10908] dump_stack_lvl+0x18c/0x250 [ 467.171598][T10908] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 467.177835][T10908] ? show_regs_print_info+0x20/0x20 [ 467.183102][T10908] ? load_image+0x420/0x420 [ 467.187675][T10908] should_fail_ex+0x394/0x4c0 [ 467.192426][T10908] should_failslab+0x9/0x20 [ 467.197049][T10908] slab_pre_alloc_hook+0x59/0x300 [ 467.202165][T10908] kmem_cache_alloc+0x5a/0x2c0 [ 467.207106][T10908] ? alloc_empty_file+0x9e/0x1d0 [ 467.212123][T10908] alloc_empty_file+0x9e/0x1d0 [ 467.217062][T10908] alloc_file+0x5b/0x600 [ 467.221353][T10908] alloc_file_pseudo+0x184/0x210 [ 467.226336][T10908] ? fput+0x1a0/0x1a0 [ 467.230355][T10908] ? alloc_fd+0x590/0x640 [ 467.234767][T10908] sock_alloc_file+0xb7/0x280 [ 467.239496][T10908] __sys_socket+0x140/0x1b0 [ 467.244168][T10908] __x64_sys_socket+0x7a/0x90 [ 467.248931][T10908] do_syscall_64+0x55/0xb0 [ 467.253401][T10908] ? clear_bhb_loop+0x40/0x90 [ 467.258110][T10908] ? clear_bhb_loop+0x40/0x90 [ 467.262818][T10908] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 467.268806][T10908] RIP: 0033:0x7f943079de99 [ 467.273258][T10908] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.292986][T10908] RSP: 002b:00007f943163c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029 [ 467.301436][T10908] RAX: ffffffffffffffda RBX: 00007f9430a25fa0 RCX: 00007f943079de99 [ 467.309476][T10908] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000002b [ 467.317584][T10908] RBP: 00007f943163c090 R08: 0000000000000000 R09: 0000000000000000 [ 467.325602][T10908] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 467.333622][T10908] R13: 00007f9430a26038 R14: 00007f9430a25fa0 R15: 00007ffcb308c8d8 [ 467.341674][T10908] [ 467.602811][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 469.037715][T10916] netlink: 'syz.0.1550': attribute type 10 has an invalid length. [ 469.082601][T10916] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1550'. [ 469.769002][T10928] netlink: 'syz.2.1553': attribute type 10 has an invalid length. [ 471.062831][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 472.438189][T10939] netlink: 'syz.0.1557': attribute type 3 has an invalid length. [ 472.506402][T10939] netlink: 'syz.0.1557': attribute type 1 has an invalid length. [ 472.542585][T10939] netlink: 60387 bytes leftover after parsing attributes in process `syz.0.1557'. [ 473.055792][T10957] ip6_vti0: entered promiscuous mode [ 473.071724][T10957] ip6_vti0: entered allmulticast mode [ 473.143280][T10954] netlink: 'syz.3.1562': attribute type 10 has an invalid length. [ 473.151632][T10954] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1562'. [ 473.172484][T10957] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1563'. [ 475.093687][T10979] netlink: 'syz.3.1567': attribute type 10 has an invalid length. [ 475.603869][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 478.995295][T11003] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 479.039782][T11001] netlink: 'syz.2.1573': attribute type 10 has an invalid length. [ 479.063767][T11001] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1573'. [ 479.447546][T11015] netlink: 'syz.2.1578': attribute type 10 has an invalid length. [ 482.560102][T11026] netlink: 'syz.0.1581': attribute type 3 has an invalid length. [ 482.580328][T11026] netlink: 201372 bytes leftover after parsing attributes in process `syz.0.1581'. [ 482.615889][T11030] netlink: 'syz.0.1581': attribute type 3 has an invalid length. [ 482.744070][T11030] netlink: 15487 bytes leftover after parsing attributes in process `syz.0.1581'. [ 483.302532][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 483.644665][T11037] netlink: 14719 bytes leftover after parsing attributes in process `syz.3.1583'. [ 484.143887][T11043] netlink: 10 bytes leftover after parsing attributes in process `syz.0.1593'. [ 484.200874][T11045] netlink: 'syz.2.1586': attribute type 10 has an invalid length. [ 484.258361][T11045] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1586'. [ 484.492038][T11056] netlink: 'syz.1.1589': attribute type 10 has an invalid length. [ 485.035046][T11063] netlink: 'syz.1.1591': attribute type 4 has an invalid length. [ 485.097723][T11063] netlink: 152 bytes leftover after parsing attributes in process `syz.1.1591'. [ 485.624141][T11063] .`: renamed from bond0 (while UP) [ 487.495598][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 487.835015][T11083] netlink: 10 bytes leftover after parsing attributes in process `syz.3.1598'. [ 488.140441][T11087] netlink: 'syz.1.1600': attribute type 10 has an invalid length. [ 488.161802][T11085] netlink: 'syz.0.1599': attribute type 10 has an invalid length. [ 488.182511][T11085] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1599'. [ 488.186265][T11092] netlink: 'syz.3.1601': attribute type 3 has an invalid length. [ 488.200481][T11092] netlink: 201372 bytes leftover after parsing attributes in process `syz.3.1601'. [ 488.225207][T11092] netlink: 'syz.3.1601': attribute type 3 has an invalid length. [ 488.242392][T11092] netlink: 15487 bytes leftover after parsing attributes in process `syz.3.1601'. [ 488.975830][T11100] netlink: 'syz.2.1604': attribute type 4 has an invalid length. [ 489.014777][T11100] netlink: 152 bytes leftover after parsing attributes in process `syz.2.1604'. [ 489.526262][T11100] .`: renamed from bond0 (while UP) [ 490.009382][T11120] netlink: 164 bytes leftover after parsing attributes in process `syz.2.1611'. [ 490.658080][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 490.733012][T11127] netlink: 'syz.1.1612': attribute type 10 has an invalid length. [ 492.291946][T11154] syzkaller0: entered promiscuous mode [ 492.334634][T11154] syzkaller0: entered allmulticast mode [ 494.032824][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 494.180643][T11169] netlink: 'syz.0.1624': attribute type 10 has an invalid length. [ 495.684530][T11182] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1628'. [ 495.731755][T11182] netlink: set zone limit has 4 unknown bytes [ 497.253675][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 498.805363][T11203] netlink: 'syz.2.1633': attribute type 10 has an invalid length. [ 499.509615][T11223] syzkaller0: entered promiscuous mode [ 499.532394][T11223] syzkaller0: entered allmulticast mode [ 499.635877][T11213] netlink: 'syz.3.1636': attribute type 10 has an invalid length. [ 499.821226][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 501.843785][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.857250][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.557633][T11251] netlink: 'syz.3.1648': attribute type 10 has an invalid length. [ 502.802315][T11259] netlink: 'syz.0.1650': attribute type 10 has an invalid length. [ 503.492941][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 503.585971][T11271] FAULT_INJECTION: forcing a failure. [ 503.585971][T11271] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 503.617881][T11271] CPU: 1 PID: 11271 Comm: syz.0.1654 Not tainted syzkaller #0 [ 503.625460][T11271] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 503.635574][T11271] Call Trace: [ 503.638924][T11271] [ 503.641947][T11271] dump_stack_lvl+0x18c/0x250 [ 503.646793][T11271] ? show_regs_print_info+0x20/0x20 [ 503.652060][T11271] ? load_image+0x420/0x420 [ 503.656747][T11271] ? __lock_acquire+0x7d80/0x7d80 [ 503.661835][T11271] ? lockdep_hardirqs_on+0x98/0x150 [ 503.667095][T11271] should_fail_ex+0x394/0x4c0 [ 503.671838][T11271] _copy_from_user+0x2f/0xe0 [ 503.676476][T11271] __copy_msghdr+0x388/0x560 [ 503.681390][T11271] ___sys_sendmsg+0x214/0x360 [ 503.686134][T11271] ? __sys_sendmsg+0x2b0/0x2b0 [ 503.691014][T11271] __se_sys_sendmsg+0x1d0/0x2c0 [ 503.695927][T11271] ? __x64_sys_sendmsg+0x80/0x80 [ 503.700936][T11271] ? syscall_enter_from_user_mode+0x2e/0x80 [ 503.706885][T11271] do_syscall_64+0x55/0xb0 [ 503.711392][T11271] ? clear_bhb_loop+0x40/0x90 [ 503.716208][T11271] ? clear_bhb_loop+0x40/0x90 [ 503.721039][T11271] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 503.727010][T11271] RIP: 0033:0x7f943079de99 [ 503.731483][T11271] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 503.751153][T11271] RSP: 002b:00007f943163c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 503.759924][T11271] RAX: ffffffffffffffda RBX: 00007f9430a25fa0 RCX: 00007f943079de99 [ 503.767952][T11271] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 000000000000000a [ 503.775983][T11271] RBP: 00007f943163c090 R08: 0000000000000000 R09: 0000000000000000 [ 503.784100][T11271] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 503.792127][T11271] R13: 00007f9430a26038 R14: 00007f9430a25fa0 R15: 00007ffcb308c8d8 [ 503.795338][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 503.800243][T11271] [ 504.253657][T11278] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1656'. [ 508.012647][T11295] netlink: 'syz.1.1661': attribute type 10 has an invalid length. [ 508.460382][T11312] netlink: 'syz.0.1662': attribute type 10 has an invalid length. [ 509.478250][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 511.617042][T11368] netlink: 'syz.2.1680': attribute type 10 has an invalid length. [ 511.667431][T11368] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1680'. [ 511.964056][T11372] netlink: 'syz.3.1681': attribute type 10 has an invalid length. [ 512.100776][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 513.128880][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 514.823371][T11409] netlink: 'syz.3.1691': attribute type 10 has an invalid length. [ 514.860974][T11409] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1691'. [ 515.039407][T11411] netlink: 'syz.1.1692': attribute type 10 has an invalid length. [ 516.808900][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 518.519569][T11446] netlink: 'syz.2.1702': attribute type 10 has an invalid length. [ 518.612560][T11446] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1702'. [ 518.658221][T11442] netlink: 'syz.3.1703': attribute type 10 has an invalid length. [ 520.691166][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 521.289756][T11483] netlink: 'syz.2.1716': attribute type 10 has an invalid length. [ 521.586212][T11490] netlink: 'syz.0.1717': attribute type 10 has an invalid length. [ 521.642411][T11490] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1717'. [ 524.459766][T11518] netlink: 'syz.1.1727': attribute type 10 has an invalid length. [ 524.766029][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 525.398634][T11527] netlink: 'syz.1.1729': attribute type 10 has an invalid length. [ 525.448470][T11527] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1729'. [ 526.288517][T11545] netlink: 'syz.0.1737': attribute type 10 has an invalid length. [ 529.878894][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 530.503468][T11583] netlink: 'syz.0.1748': attribute type 10 has an invalid length. [ 530.567919][T11583] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1748'. [ 530.936725][T11584] netlink: 'syz.1.1749': attribute type 10 has an invalid length. [ 532.813487][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 535.635165][T11615] netlink: 'syz.0.1761': attribute type 10 has an invalid length. [ 537.178234][ T5777] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 537.361904][T11645] netlink: 'syz.3.1759': attribute type 10 has an invalid length. [ 537.392411][T11645] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1759'. [ 538.657261][T11675] netlink: 'syz.1.1780': attribute type 10 has an invalid length. [ 538.689659][T11675] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1780'. [ 539.402037][ T5777] Bluetooth: hci1: unexpected event 0x05 length: 15 > 4 [ 545.131692][T11710] netlink: 'syz.3.1789': attribute type 10 has an invalid length. [ 545.156928][T11710] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1789'. [ 546.245138][ T5777] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 547.154661][T11751] netlink: 'syz.1.1803': attribute type 10 has an invalid length. [ 547.202375][T11751] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1803'. [ 550.552483][T11790] netlink: 'syz.1.1815': attribute type 10 has an invalid length. [ 550.567550][T11790] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1815'. [ 552.741694][T11832] netlink: 'syz.0.1829': attribute type 10 has an invalid length. [ 552.813744][T11832] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1829'. [ 557.289328][T11885] netlink: 'syz.2.1845': attribute type 10 has an invalid length. [ 557.302677][T11885] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1845'. [ 559.383007][T11919] netlink: 'syz.1.1859': attribute type 10 has an invalid length. [ 559.409100][T11919] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1859'. [ 562.179487][T11961] netlink: 'syz.2.1871': attribute type 10 has an invalid length. [ 562.218296][T11961] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1871'. [ 563.268307][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.280186][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 566.536393][T12008] netlink: 'syz.1.1886': attribute type 10 has an invalid length. [ 566.582436][T12008] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1886'. [ 568.492654][T12053] netlink: 'syz.1.1901': attribute type 10 has an invalid length. [ 568.500567][T12053] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1901'. [ 572.869498][T12094] netlink: 'syz.0.1913': attribute type 10 has an invalid length. [ 572.902526][T12094] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1913'. [ 574.413829][T12134] netlink: 'syz.3.1924': attribute type 10 has an invalid length. [ 574.439879][T12134] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1924'. [ 576.353133][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 576.440538][T12166] netlink: 'syz.2.1936': attribute type 10 has an invalid length. [ 576.519768][T12166] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1936'. [ 579.892782][T12210] netlink: 'syz.2.1947': attribute type 10 has an invalid length. [ 579.930323][T12210] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1947'. [ 582.078697][T12249] netlink: 'syz.3.1959': attribute type 10 has an invalid length. [ 582.132436][T12249] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1959'. [ 585.052058][T12290] syzkaller0: entered promiscuous mode [ 585.127146][T12290] syzkaller0: entered allmulticast mode [ 585.192340][T12291] netlink: 'syz.3.1972': attribute type 10 has an invalid length. [ 585.231112][T12291] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1972'. [ 585.323581][T12298] netlink: 132 bytes leftover after parsing attributes in process `syz.1.1974'. [ 591.413775][T12336] netlink: 'syz.3.1984': attribute type 10 has an invalid length. [ 591.456698][T12336] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1984'. [ 592.708455][T12358] netlink: 'syz.1.1994': attribute type 10 has an invalid length. [ 592.767665][T12358] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1994'. [ 595.807062][T12403] netlink: 'syz.3.2008': attribute type 10 has an invalid length. [ 595.882506][T12403] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2008'. [ 598.685393][T12440] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2020'. [ 598.831515][T12442] netlink: 'syz.0.2021': attribute type 10 has an invalid length. [ 598.862250][T12442] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2021'. [ 600.904176][T12481] FAULT_INJECTION: forcing a failure. [ 600.904176][T12481] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 601.001770][T12481] CPU: 0 PID: 12481 Comm: syz.0.2032 Not tainted syzkaller #0 [ 601.009425][T12481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 601.019540][T12481] Call Trace: [ 601.022869][T12481] [ 601.025848][T12481] dump_stack_lvl+0x18c/0x250 [ 601.030689][T12481] ? show_regs_print_info+0x20/0x20 [ 601.035959][T12481] ? load_image+0x420/0x420 [ 601.040537][T12481] ? __might_fault+0xaa/0x120 [ 601.045276][T12481] ? __lock_acquire+0x7d80/0x7d80 [ 601.050369][T12481] should_fail_ex+0x394/0x4c0 [ 601.055109][T12481] _copy_from_user+0x2f/0xe0 [ 601.059766][T12481] ___sys_recvmsg+0x174/0x590 [ 601.064499][T12481] ? __sys_recvmsg+0x2a0/0x2a0 [ 601.069312][T12481] ? trace_call_bpf+0xc3/0x6c0 [ 601.074122][T12481] ? trace_call_bpf+0x5e9/0x6c0 [ 601.079114][T12481] ? __fget_files+0x3fc/0x460 [ 601.083844][T12481] __x64_sys_recvmsg+0x21e/0x2f0 [ 601.088823][T12481] ? perf_trace_preemptirq_template+0x269/0x330 [ 601.095108][T12481] ? ___sys_recvmsg+0x590/0x590 [ 601.100011][T12481] ? lockdep_hardirqs_on+0x98/0x150 [ 601.105268][T12481] do_syscall_64+0x55/0xb0 [ 601.109738][T12481] ? clear_bhb_loop+0x40/0x90 [ 601.114632][T12481] ? clear_bhb_loop+0x40/0x90 [ 601.119609][T12481] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 601.125634][T12481] RIP: 0033:0x7f943079de99 [ 601.130082][T12481] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 601.150039][T12481] RSP: 002b:00007f943163c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 601.158505][T12481] RAX: ffffffffffffffda RBX: 00007f9430a25fa0 RCX: 00007f943079de99 [ 601.166521][T12481] RDX: 00000000000100b6 RSI: 0000200000005140 RDI: 0000000000000003 [ 601.174703][T12481] RBP: 00007f943163c090 R08: 0000000000000000 R09: 0000000000000000 [ 601.182723][T12481] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 601.190823][T12481] R13: 00007f9430a26038 R14: 00007f9430a25fa0 R15: 00007ffcb308c8d8 [ 601.198855][T12481] [ 602.255328][T12478] netlink: 'syz.1.2031': attribute type 10 has an invalid length. [ 602.264816][T12478] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2031'. [ 604.102121][T12518] netlink: 'syz.1.2043': attribute type 10 has an invalid length. [ 604.131180][T12518] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2043'. [ 606.118354][T12540] netlink: 202920 bytes leftover after parsing attributes in process `syz.1.2050'. [ 606.921489][T12552] netlink: 'syz.1.2054': attribute type 10 has an invalid length. [ 606.962281][T12552] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2054'. [ 609.652368][T12599] netlink: 'syz.1.2067': attribute type 10 has an invalid length. [ 609.710174][T12599] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2067'. [ 610.248303][T12604] netlink: 'syz.2.2073': attribute type 10 has an invalid length. [ 610.967919][T12614] FAULT_INJECTION: forcing a failure. [ 610.967919][T12614] name failslab, interval 1, probability 0, space 0, times 0 [ 611.007774][T12614] CPU: 0 PID: 12614 Comm: syz.1.2076 Not tainted syzkaller #0 [ 611.015358][T12614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 611.025477][T12614] Call Trace: [ 611.028809][T12614] [ 611.031796][T12614] dump_stack_lvl+0x18c/0x250 [ 611.036565][T12614] ? show_regs_print_info+0x20/0x20 [ 611.041856][T12614] ? load_image+0x420/0x420 [ 611.046440][T12614] ? __might_sleep+0xe0/0xe0 [ 611.051138][T12614] ? __lock_acquire+0x7d80/0x7d80 [ 611.056219][T12614] ? mark_lock+0x94/0x320 [ 611.060620][T12614] should_fail_ex+0x394/0x4c0 [ 611.065360][T12614] should_failslab+0x9/0x20 [ 611.069958][T12614] slab_pre_alloc_hook+0x59/0x300 [ 611.075058][T12614] kmem_cache_alloc_node+0x5e/0x310 [ 611.080331][T12614] ? __alloc_skb+0x103/0x2c0 [ 611.084995][T12614] __alloc_skb+0x103/0x2c0 [ 611.089493][T12614] inet_netconf_notify_devconf+0x173/0x230 [ 611.095405][T12614] inetdev_event+0x7aa/0x1610 [ 611.100167][T12614] ? netdevice_event+0x890/0x890 [ 611.105266][T12614] ? rdma_roce_rescan_device+0x30/0x30 [ 611.110790][T12614] ? devinet_exit_net+0x220/0x220 [ 611.115971][T12614] notifier_call_chain+0x18f/0x380 [ 611.121150][T12614] unregister_netdevice_many_notify+0x1037/0x1910 [ 611.127668][T12614] ? lock_chain_count+0x20/0x20 [ 611.132609][T12614] ? unregister_netdevice_many+0x20/0x20 [ 611.138442][T12614] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 611.144670][T12614] ? lockdep_hardirqs_on+0x98/0x150 [ 611.149934][T12614] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 611.156172][T12614] unregister_netdevice_queue+0x2e9/0x330 [ 611.161962][T12614] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 611.168021][T12614] ? list_netdevice+0x730/0x730 [ 611.172947][T12614] __tun_detach+0xdb2/0x1580 [ 611.177659][T12614] tun_chr_close+0x10d/0x1c0 [ 611.182296][T12614] ? tun_chr_open+0x510/0x510 [ 611.187031][T12614] __fput+0x221/0x940 [ 611.191190][T12614] __se_sys_close+0x15c/0x1e0 [ 611.195931][T12614] do_syscall_64+0x55/0xb0 [ 611.200408][T12614] ? clear_bhb_loop+0x40/0x90 [ 611.205146][T12614] ? clear_bhb_loop+0x40/0x90 [ 611.209882][T12614] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 611.216274][T12614] RIP: 0033:0x7f4bcfb9de99 [ 611.221005][T12614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 611.240673][T12614] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 611.249156][T12614] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 611.257181][T12614] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 611.265208][T12614] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 611.273240][T12614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 611.281311][T12614] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 611.289350][T12614] [ 612.433217][T12634] netlink: 'syz.3.2083': attribute type 10 has an invalid length. [ 612.441139][T12634] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2083'. [ 615.199172][T12677] netlink: 'syz.1.2096': attribute type 10 has an invalid length. [ 615.223552][T12677] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2096'. [ 618.150080][T12720] netlink: 'syz.2.2110': attribute type 10 has an invalid length. [ 618.180029][T12720] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2110'. [ 619.324301][T12737] ip6_tunnel: non-ECT from db5b:6861:58bb:cfe8:875a:0603:0000:0023 with DS=0x3f [ 619.421522][T12737] netlink: 201392 bytes leftover after parsing attributes in process `syz.1.2116'. [ 620.501225][T12752] netlink: 'syz.1.2121': attribute type 10 has an invalid length. [ 620.574065][T12752] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2121'. [ 622.681099][T12790] netlink: 'syz.0.2135': attribute type 10 has an invalid length. [ 622.694957][T12790] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2135'. [ 623.100062][T12803] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2139'. [ 624.709763][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.716634][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.246041][T12825] netlink: 'syz.3.2146': attribute type 10 has an invalid length. [ 626.322455][T12825] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2146'. [ 628.639035][T12856] IPv6: Can't replace route, no match found [ 631.833260][T12867] netlink: 'syz.2.2159': attribute type 10 has an invalid length. [ 631.848215][T12867] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2159'. [ 632.473816][T12887] FAULT_INJECTION: forcing a failure. [ 632.473816][T12887] name failslab, interval 1, probability 0, space 0, times 0 [ 632.526235][T12887] CPU: 1 PID: 12887 Comm: syz.3.2167 Not tainted syzkaller #0 [ 632.533793][T12887] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 632.543898][T12887] Call Trace: [ 632.547205][T12887] [ 632.550178][T12887] dump_stack_lvl+0x18c/0x250 [ 632.554902][T12887] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 632.561100][T12887] ? show_regs_print_info+0x20/0x20 [ 632.566335][T12887] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 632.572547][T12887] ? dump_stack+0x9/0x20 [ 632.576842][T12887] should_fail_ex+0x394/0x4c0 [ 632.581557][T12887] should_failslab+0x9/0x20 [ 632.586098][T12887] slab_pre_alloc_hook+0x59/0x300 [ 632.591166][T12887] ? _raw_spin_unlock+0x40/0x40 [ 632.596051][T12887] ? string+0x257/0x290 [ 632.600240][T12887] ? __request_module+0x2d1/0x600 [ 632.605316][T12887] __kmem_cache_alloc_node+0x53/0x250 [ 632.610730][T12887] ? __request_module+0x2d1/0x600 [ 632.615791][T12887] kmalloc_trace+0x2a/0xe0 [ 632.620247][T12887] __request_module+0x2d1/0x600 [ 632.625129][T12887] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 632.631331][T12887] ? module_enforce_rwx_sections+0x150/0x150 [ 632.637352][T12887] ? bpf_lsm_capable+0x9/0x10 [ 632.642075][T12887] ? dev_load+0x21/0x1f0 [ 632.646445][T12887] dev_load+0x18b/0x1f0 [ 632.650641][T12887] dev_ioctl+0x837/0x1140 [ 632.655006][T12887] sock_ioctl+0x74c/0x7e0 [ 632.659365][T12887] ? sock_poll+0x3e0/0x3e0 [ 632.663819][T12887] ? bpf_lsm_file_ioctl+0x9/0x10 [ 632.668801][T12887] ? security_file_ioctl+0x80/0xa0 [ 632.674046][T12887] ? sock_poll+0x3e0/0x3e0 [ 632.678492][T12887] __se_sys_ioctl+0xfd/0x170 [ 632.683115][T12887] do_syscall_64+0x55/0xb0 [ 632.687570][T12887] ? clear_bhb_loop+0x40/0x90 [ 632.692272][T12887] ? clear_bhb_loop+0x40/0x90 [ 632.696981][T12887] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 632.702913][T12887] RIP: 0033:0x7fa3a4b9de99 [ 632.707359][T12887] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.727092][T12887] RSP: 002b:00007fa3a5a75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 632.735535][T12887] RAX: ffffffffffffffda RBX: 00007fa3a4e25fa0 RCX: 00007fa3a4b9de99 [ 632.743537][T12887] RDX: 0000200000000080 RSI: 00000000000089f0 RDI: 000000000000000b [ 632.751544][T12887] RBP: 00007fa3a5a75090 R08: 0000000000000000 R09: 0000000000000000 [ 632.759557][T12887] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 632.767575][T12887] R13: 00007fa3a4e26038 R14: 00007fa3a4e25fa0 R15: 00007ffd87d637a8 [ 632.775624][T12887] [ 634.806110][T12909] netlink: 'syz.1.2172': attribute type 10 has an invalid length. [ 634.835448][T12909] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2172'. [ 637.210815][T12946] netlink: 'syz.0.2185': attribute type 10 has an invalid length. [ 637.221536][T12946] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2185'. [ 637.412968][T12955] FAULT_INJECTION: forcing a failure. [ 637.412968][T12955] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 637.452432][T12955] CPU: 1 PID: 12955 Comm: syz.3.2188 Not tainted syzkaller #0 [ 637.459991][T12955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 637.470198][T12955] Call Trace: [ 637.473553][T12955] [ 637.476538][T12955] dump_stack_lvl+0x18c/0x250 [ 637.481288][T12955] ? show_regs_print_info+0x20/0x20 [ 637.486562][T12955] ? load_image+0x420/0x420 [ 637.491133][T12955] ? __lock_acquire+0x7d80/0x7d80 [ 637.496222][T12955] ? snprintf+0xe9/0x140 [ 637.500511][T12955] should_fail_ex+0x394/0x4c0 [ 637.505233][T12955] _copy_to_user+0x2f/0xa0 [ 637.509778][T12955] simple_read_from_buffer+0xe7/0x150 [ 637.515200][T12955] proc_fail_nth_read+0x1e8/0x260 [ 637.520328][T12955] ? proc_fault_inject_write+0x360/0x360 [ 637.526178][T12955] ? fsnotify_perm+0x271/0x5e0 [ 637.530993][T12955] ? proc_fault_inject_write+0x360/0x360 [ 637.536671][T12955] vfs_read+0x298/0x990 [ 637.540871][T12955] ? kernel_read+0x1e0/0x1e0 [ 637.545503][T12955] ? __fget_files+0x28/0x460 [ 637.550130][T12955] ? __fget_files+0x3fc/0x460 [ 637.554861][T12955] ? __fdget_pos+0x2a3/0x330 [ 637.559552][T12955] ? ksys_read+0x74/0x260 [ 637.563922][T12955] ksys_read+0x151/0x260 [ 637.568201][T12955] ? vfs_write+0x9a0/0x9a0 [ 637.572653][T12955] ? lockdep_hardirqs_on+0x98/0x150 [ 637.577887][T12955] do_syscall_64+0x55/0xb0 [ 637.582349][T12955] ? clear_bhb_loop+0x40/0x90 [ 637.587077][T12955] ? clear_bhb_loop+0x40/0x90 [ 637.591783][T12955] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 637.597750][T12955] RIP: 0033:0x7fa3a4b5e6ce [ 637.602287][T12955] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 637.621948][T12955] RSP: 002b:00007fa3a5a32fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 637.630402][T12955] RAX: ffffffffffffffda RBX: 00007fa3a5a336c0 RCX: 00007fa3a4b5e6ce [ 637.638420][T12955] RDX: 000000000000000f RSI: 00007fa3a5a330a0 RDI: 0000000000000005 [ 637.646420][T12955] RBP: 00007fa3a5a33090 R08: 0000000000000000 R09: 0000000000000000 [ 637.654417][T12955] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 637.662604][T12955] R13: 00007fa3a4e26218 R14: 00007fa3a4e26180 R15: 00007ffd87d637a8 [ 637.670637][T12955] [ 637.776789][T12963] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2190'. [ 637.833648][T12963] netlink: 'syz.0.2190': attribute type 1 has an invalid length. [ 639.582276][T12996] netlink: 'syz.2.2199': attribute type 10 has an invalid length. [ 639.615028][T12996] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2199'. [ 641.596064][T13030] netlink: 'syz.1.2210': attribute type 10 has an invalid length. [ 641.632518][T13030] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2210'. [ 643.164002][T13033] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2212'. [ 643.223378][T13033] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2212'. [ 643.253812][T13033] bridge_slave_0: entered allmulticast mode [ 643.300327][T13033] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2212'. [ 643.371731][T13044] netlink: 'syz.0.2216': attribute type 13 has an invalid length. [ 643.400995][T13044] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2216'. [ 643.447935][T13044] syz_tun: refused to change device tx_queue_len [ 643.492361][T13044] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 644.585359][T13063] netlink: 'syz.0.2221': attribute type 10 has an invalid length. [ 644.661751][T13063] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2221'. [ 647.093240][T13080] FAULT_INJECTION: forcing a failure. [ 647.093240][T13080] name failslab, interval 1, probability 0, space 0, times 0 [ 647.106023][T13080] CPU: 1 PID: 13080 Comm: syz.1.2230 Not tainted syzkaller #0 [ 647.113587][T13080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 647.123704][T13080] Call Trace: [ 647.127027][T13080] [ 647.129988][T13080] dump_stack_lvl+0x18c/0x250 [ 647.134718][T13080] ? show_regs_print_info+0x20/0x20 [ 647.139957][T13080] ? load_image+0x420/0x420 [ 647.144527][T13080] ? netdev_core_pick_tx+0x370/0x370 [ 647.149848][T13080] should_fail_ex+0x394/0x4c0 [ 647.154561][T13080] should_failslab+0x9/0x20 [ 647.159103][T13080] slab_pre_alloc_hook+0x59/0x300 [ 647.164176][T13080] kmem_cache_alloc+0x5a/0x2c0 [ 647.168975][T13080] ? skb_clone+0x1eb/0x370 [ 647.173431][T13080] skb_clone+0x1eb/0x370 [ 647.177727][T13080] bpf_clone_redirect+0x16d/0x4a0 [ 647.182872][T13080] bpf_prog_bf17f61a12bc632f+0x5e/0x63 [ 647.188363][T13080] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 647.194395][T13080] ? __lock_acquire+0x7d80/0x7d80 [ 647.199452][T13080] ? lock_chain_count+0x20/0x20 [ 647.204340][T13080] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 647.210360][T13080] ? lockdep_softirqs_on+0x5b0/0x5b0 [ 647.215685][T13080] ? lock_chain_count+0x20/0x20 [ 647.220564][T13080] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 647.226865][T13080] ? __local_bh_disable_ip+0x108/0x1a0 [ 647.232362][T13080] ? __cant_sleep+0x220/0x220 [ 647.237083][T13080] ? __local_bh_enable_ip+0x13a/0x1c0 [ 647.242488][T13080] ? _local_bh_enable+0xa0/0xa0 [ 647.247373][T13080] ? bpf_test_timer_continue+0x135/0x380 [ 647.253131][T13080] ? bpf_test_run+0x174/0x870 [ 647.257834][T13080] bpf_test_run+0x2df/0x870 [ 647.262390][T13080] ? bpf_test_run+0x174/0x870 [ 647.267109][T13080] ? dst_hold+0x70/0x70 [ 647.271293][T13080] ? eth_get_headlen+0x210/0x210 [ 647.276353][T13080] bpf_prog_test_run_skb+0xdbb/0x18f0 [ 647.281778][T13080] ? cpu_online+0x60/0x60 [ 647.286160][T13080] bpf_prog_test_run+0x31f/0x390 [ 647.291136][T13080] __sys_bpf+0x49d/0x890 [ 647.295417][T13080] ? bpf_link_show_fdinfo+0x390/0x390 [ 647.300833][T13080] ? lock_chain_count+0x20/0x20 [ 647.305901][T13080] __x64_sys_bpf+0x7c/0x90 [ 647.310343][T13080] do_syscall_64+0x55/0xb0 [ 647.314801][T13080] ? clear_bhb_loop+0x40/0x90 [ 647.319499][T13080] ? clear_bhb_loop+0x40/0x90 [ 647.324224][T13080] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 647.330155][T13080] RIP: 0033:0x7f4bcfb9de99 [ 647.334595][T13080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 647.354235][T13080] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 647.362851][T13080] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 647.370850][T13080] RDX: 000000000000002c RSI: 0000200000000080 RDI: 000000000000000a [ 647.378847][T13080] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 647.386881][T13080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 647.394884][T13080] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 647.402899][T13080] [ 648.453519][T13104] netlink: 'syz.2.2234': attribute type 10 has an invalid length. [ 648.461454][T13104] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2234'. [ 649.450819][T13123] netlink: 'syz.1.2243': attribute type 13 has an invalid length. [ 649.494149][T13123] netlink: 152 bytes leftover after parsing attributes in process `syz.1.2243'. [ 649.522470][T13123] FAULT_INJECTION: forcing a failure. [ 649.522470][T13123] name failslab, interval 1, probability 0, space 0, times 0 [ 649.591954][T13123] CPU: 0 PID: 13123 Comm: syz.1.2243 Not tainted syzkaller #0 [ 649.599510][T13123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 649.609631][T13123] Call Trace: [ 649.612985][T13123] [ 649.615970][T13123] dump_stack_lvl+0x18c/0x250 [ 649.620725][T13123] ? show_regs_print_info+0x20/0x20 [ 649.625994][T13123] ? load_image+0x420/0x420 [ 649.630599][T13123] ? __might_sleep+0xe0/0xe0 [ 649.635256][T13123] ? __lock_acquire+0x7d80/0x7d80 [ 649.640348][T13123] should_fail_ex+0x394/0x4c0 [ 649.645099][T13123] should_failslab+0x9/0x20 [ 649.649667][T13123] slab_pre_alloc_hook+0x59/0x300 [ 649.654753][T13123] ? vprintk_emit+0x53d/0x610 [ 649.659497][T13123] ? do_setlink+0x6b9/0x3f40 [ 649.664151][T13123] ? do_setlink+0x6b9/0x3f40 [ 649.668810][T13123] __kmem_cache_alloc_node+0x53/0x250 [ 649.674264][T13123] ? do_setlink+0x6b9/0x3f40 [ 649.678911][T13123] __kmalloc+0xa7/0x240 [ 649.683164][T13123] do_setlink+0x6b9/0x3f40 [ 649.687653][T13123] ? load_image+0x420/0x420 [ 649.692221][T13123] ? nlmsg_parse_deprecated_strict+0x110/0x110 [ 649.698473][T13123] ? stack_trace_save+0xaa/0x100 [ 649.703468][T13123] ? rcu_is_watching+0x15/0xb0 [ 649.708282][T13123] ? do_trace_netlink_extack+0x7e/0x1a0 [ 649.713974][T13123] ? __nla_validate+0x50/0x50 [ 649.718720][T13123] ? validate_linkmsg+0x719/0x910 [ 649.723878][T13123] rtnl_newlink+0x1848/0x2170 [ 649.728619][T13123] ? rtnl_newlink+0x451/0x2170 [ 649.733433][T13123] ? rtnl_setlink+0x4e0/0x4e0 [ 649.738149][T13123] ? __rwlock_init+0x150/0x150 [ 649.743063][T13123] ? do_raw_spin_unlock+0x121/0x230 [ 649.748339][T13123] ? __mutex_lock+0x923/0xc80 [ 649.753063][T13123] ? __mutex_lock+0x4d2/0xc80 [ 649.757883][T13123] ? rtnl_setlink+0x4e0/0x4e0 [ 649.762692][T13123] rtnetlink_rcv_msg+0x843/0xf90 [ 649.767659][T13123] ? rtnetlink_rcv_msg+0x220/0xf90 [ 649.772808][T13123] ? rtnetlink_bind+0x80/0x80 [ 649.777561][T13123] ? perf_trace_preemptirq_template+0xac/0x330 [ 649.783753][T13123] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 649.789774][T13123] ? lock_chain_count+0x20/0x20 [ 649.794668][T13123] ? __local_bh_enable_ip+0x13a/0x1c0 [ 649.800075][T13123] ? lockdep_hardirqs_on+0x98/0x150 [ 649.805314][T13123] ? __local_bh_enable_ip+0x13a/0x1c0 [ 649.810722][T13123] ? _local_bh_enable+0xa0/0xa0 [ 649.815614][T13123] ? __dev_queue_xmit+0x275/0x3630 [ 649.820780][T13123] ? __dev_queue_xmit+0x1bc2/0x3630 [ 649.826073][T13123] ? __dev_queue_xmit+0x275/0x3630 [ 649.831261][T13123] ? ref_tracker_free+0x686/0x830 [ 649.836336][T13123] netlink_rcv_skb+0x235/0x4c0 [ 649.841146][T13123] ? rtnetlink_bind+0x80/0x80 [ 649.845864][T13123] ? netlink_ack+0x1160/0x1160 [ 649.850686][T13123] ? __lock_acquire+0x7d80/0x7d80 [ 649.855760][T13123] ? netlink_deliver_tap+0x2e/0x1b0 [ 649.861008][T13123] netlink_unicast+0x7b1/0x930 [ 649.865820][T13123] netlink_sendmsg+0x8d0/0xbf0 [ 649.870624][T13123] ? netlink_getsockopt+0x590/0x590 [ 649.875861][T13123] ? apparmor_socket_sendmsg+0x8e/0x330 [ 649.881455][T13123] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 649.886774][T13123] ? security_socket_sendmsg+0x80/0xa0 [ 649.892270][T13123] ? netlink_getsockopt+0x590/0x590 [ 649.897509][T13123] ____sys_sendmsg+0x61b/0x980 [ 649.902320][T13123] ? __asan_memset+0x22/0x40 [ 649.906959][T13123] ? __sys_sendmsg_sock+0x30/0x30 [ 649.912017][T13123] ? __import_iovec+0x3fa/0x850 [ 649.916936][T13123] ? import_iovec+0x73/0xa0 [ 649.921478][T13123] ___sys_sendmsg+0x2a6/0x360 [ 649.926196][T13123] ? get_pid_task+0x20/0x1e0 [ 649.930835][T13123] ? __sys_sendmsg+0x2b0/0x2b0 [ 649.935653][T13123] ? __lock_acquire+0x7d80/0x7d80 [ 649.940759][T13123] __se_sys_sendmsg+0x1d0/0x2c0 [ 649.945672][T13123] ? __x64_sys_sendmsg+0x80/0x80 [ 649.950693][T13123] ? lockdep_hardirqs_on+0x98/0x150 [ 649.955938][T13123] do_syscall_64+0x55/0xb0 [ 649.960401][T13123] ? clear_bhb_loop+0x40/0x90 [ 649.965114][T13123] ? clear_bhb_loop+0x40/0x90 [ 649.969827][T13123] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 649.975763][T13123] RIP: 0033:0x7f4bcfb9de99 [ 649.980208][T13123] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 649.999878][T13123] RSP: 002b:00007f4bd09ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 650.008412][T13123] RAX: ffffffffffffffda RBX: 00007f4bcfe25fa0 RCX: 00007f4bcfb9de99 [ 650.016560][T13123] RDX: 0000000008000000 RSI: 0000200000000940 RDI: 0000000000000003 [ 650.024580][T13123] RBP: 00007f4bd09ed090 R08: 0000000000000000 R09: 0000000000000000 [ 650.032601][T13123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 650.040673][T13123] R13: 00007f4bcfe26038 R14: 00007f4bcfe25fa0 R15: 00007fffa1b85bd8 [ 650.048729][T13123] [ 650.238951][T13132] netlink: 'syz.2.2244': attribute type 21 has an invalid length. [ 650.286422][T13132] netlink: 'syz.2.2244': attribute type 10 has an invalid length. [ 650.326938][T13132] netlink: 'syz.2.2244': attribute type 12 has an invalid length. [ 650.361228][T13132] netlink: 'syz.2.2244': attribute type 13 has an invalid length. [ 650.410784][T13132] netlink: 'syz.2.2244': attribute type 14 has an invalid length. [ 650.453089][T13132] netlink: 'syz.2.2244': attribute type 15 has an invalid length. [ 650.502534][T13132] netlink: 'syz.2.2244': attribute type 16 has an invalid length. [ 650.534999][T13132] netlink: 'syz.2.2244': attribute type 19 has an invalid length. [ 650.574302][T13132] netlink: 12226 bytes leftover after parsing attributes in process `syz.2.2244'. [ 651.099961][T13134] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2247'. [ 653.103897][T13171] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2259'. [ 655.053135][T13208] validate_nla: 4 callbacks suppressed [ 655.053155][T13208] netlink: 'syz.0.2274': attribute type 10 has an invalid length. [ 655.092891][T13208] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2274'. [ 656.449818][T13237] netlink: 'syz.2.2284': attribute type 10 has an invalid length. [ 657.210034][T13237] team0: Port device wlan1 removed [ 657.230270][T13237] wlan1: mtu less than device minimum [ 657.249606][T13237] .`: (slave wlan1): Error -22 calling dev_set_mtu [ 657.265299][T13247] netlink: 'syz.0.2288': attribute type 10 has an invalid length. [ 657.297549][T13247] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2288'. [ 658.392304][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 9 (since boot) is 1035 jiffies old. [ 658.554106][ T5084] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 658.564041][ T5084] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 658.574646][ T5084] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 658.589013][ T5084] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 658.597088][ T5084] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 658.612199][ T5084] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 659.509501][T13265] chnl_net:caif_netlink_parms(): no params data found [ 659.952693][T13284] netlink: 'syz.2.2299': attribute type 10 has an invalid length. [ 659.960676][T13284] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2299'. [ 660.119168][T13265] bridge0: port 1(bridge_slave_0) entered blocking state [ 660.158484][T13265] bridge0: port 1(bridge_slave_0) entered disabled state [ 660.173341][T13265] bridge_slave_0: entered allmulticast mode [ 660.232608][T13265] bridge_slave_0: entered promiscuous mode [ 660.267823][T13265] bridge0: port 2(bridge_slave_1) entered blocking state [ 660.286521][T13265] bridge0: port 2(bridge_slave_1) entered disabled state [ 660.308540][T13265] bridge_slave_1: entered allmulticast mode [ 660.336119][T13265] bridge_slave_1: entered promiscuous mode [ 660.598589][T13265] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 660.659768][T13265] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 660.702885][ T5777] Bluetooth: hci3: command tx timeout [ 660.911630][T13265] team0: Port device team_slave_0 added [ 660.963403][T13265] team0: Port device team_slave_1 added [ 661.186114][T13265] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 661.202464][T13265] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 661.257389][T13265] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 661.285632][T13265] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 661.300679][T13265] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 661.358969][T13265] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 662.001369][T13265] hsr_slave_0: entered promiscuous mode [ 662.068350][T13265] hsr_slave_1: entered promiscuous mode [ 662.782620][ T5777] Bluetooth: hci3: command tx timeout [ 663.410181][T13324] netlink: 'syz.2.2308': attribute type 10 has an invalid length. [ 663.423082][T13324] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2308'. [ 663.715763][T13265] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 664.862783][ T5777] Bluetooth: hci3: command tx timeout [ 664.935776][T13265] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.065608][T13265] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.438026][T13265] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.468318][T13342] FAULT_INJECTION: forcing a failure. [ 665.468318][T13342] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 665.502360][T13342] CPU: 0 PID: 13342 Comm: syz.3.2315 Not tainted syzkaller #0 [ 665.509997][T13342] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 665.520116][T13342] Call Trace: [ 665.523439][T13342] [ 665.526409][T13342] dump_stack_lvl+0x18c/0x250 [ 665.531155][T13342] ? show_regs_print_info+0x20/0x20 [ 665.536417][T13342] ? load_image+0x420/0x420 [ 665.540990][T13342] ? __might_fault+0xaa/0x120 [ 665.545735][T13342] should_fail_ex+0x394/0x4c0 [ 665.550579][T13342] copyin+0x1a/0x90 [ 665.554449][T13342] _copy_from_iter+0x532/0x1290 [ 665.559373][T13342] ? copyout_mc+0x70/0x70 [ 665.563754][T13342] ? __virt_addr_valid+0x10c/0x380 [ 665.568959][T13342] ? __virt_addr_valid+0x10c/0x380 [ 665.574141][T13342] ? __virt_addr_valid+0x10c/0x380 [ 665.579374][T13342] ? __check_object_size+0x4fc/0xa40 [ 665.584720][T13342] skb_copy_datagram_from_iter+0xf2/0x6f0 [ 665.590496][T13342] ? dev_get_by_index+0x22/0x2d0 [ 665.595506][T13342] ? skb_put+0x112/0x210 [ 665.599786][T13342] packet_sendmsg+0x345e/0x4c70 [ 665.604801][T13342] ? balance_push_set+0x140/0x370 [ 665.609878][T13342] ? aa_sk_perm+0x83c/0x970 [ 665.614428][T13342] ? packet_getsockopt+0xad0/0xad0 [ 665.619641][T13342] ? tomoyo_write_file+0xf0/0xc50 [ 665.624705][T13342] ? aa_sock_msg_perm+0x94/0x150 [ 665.629672][T13342] ? apparmor_socket_sendmsg+0x23d/0x330 [ 665.635333][T13342] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 665.640649][T13342] ? security_socket_sendmsg+0x80/0xa0 [ 665.646172][T13342] ? packet_getsockopt+0xad0/0xad0 [ 665.651323][T13342] ____sys_sendmsg+0x61b/0x980 [ 665.656139][T13342] ? __asan_memset+0x22/0x40 [ 665.660890][T13342] ? __sys_sendmsg_sock+0x30/0x30 [ 665.665961][T13342] ? __import_iovec+0x3fa/0x850 [ 665.670858][T13342] ? import_iovec+0x73/0xa0 [ 665.675399][T13342] ___sys_sendmsg+0x2a6/0x360 [ 665.680115][T13342] ? get_pid_task+0x20/0x1e0 [ 665.684742][T13342] ? __sys_sendmsg+0x2b0/0x2b0 [ 665.689563][T13342] ? __lock_acquire+0x7d80/0x7d80 [ 665.694817][T13342] __se_sys_sendmsg+0x1d0/0x2c0 [ 665.699708][T13342] ? __x64_sys_sendmsg+0x80/0x80 [ 665.704692][T13342] ? lockdep_hardirqs_on+0x98/0x150 [ 665.709920][T13342] do_syscall_64+0x55/0xb0 [ 665.714374][T13342] ? clear_bhb_loop+0x40/0x90 [ 665.719083][T13342] ? clear_bhb_loop+0x40/0x90 [ 665.723793][T13342] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 665.729734][T13342] RIP: 0033:0x7fa3a4b9de99 [ 665.734183][T13342] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 665.753821][T13342] RSP: 002b:00007fa3a5a75028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 665.762267][T13342] RAX: ffffffffffffffda RBX: 00007fa3a4e25fa0 RCX: 00007fa3a4b9de99 [ 665.770267][T13342] RDX: 0000000020004000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 665.778265][T13342] RBP: 00007fa3a5a75090 R08: 0000000000000000 R09: 0000000000000000 [ 665.786265][T13342] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 665.794263][T13342] R13: 00007fa3a4e26038 R14: 00007fa3a4e25fa0 R15: 00007ffd87d637a8 [ 665.802279][T13342] [ 666.388963][T13348] netlink: 'syz.2.2317': attribute type 10 has an invalid length. [ 666.419060][T13348] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2317'. [ 666.492738][T13265] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 666.514738][T13265] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 666.556020][T13265] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 666.587469][T13265] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 666.881244][T13265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 666.943621][ T5777] Bluetooth: hci3: command tx timeout [ 666.965783][T13265] 8021q: adding VLAN 0 to HW filter on device team0 [ 667.024438][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.031753][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 667.057015][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.064280][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 668.279758][T13265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 668.455675][T13265] veth0_vlan: entered promiscuous mode [ 668.529282][T13265] veth1_vlan: entered promiscuous mode [ 668.616686][T13265] veth0_macvtap: entered promiscuous mode [ 668.628129][T13265] veth1_macvtap: entered promiscuous mode [ 668.661143][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 668.681916][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 668.693744][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 668.711261][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 668.730472][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 668.743892][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 668.775700][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 668.804474][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 668.845305][T13265] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 668.907895][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 668.968387][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 668.986200][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 668.999912][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 669.017648][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 669.033012][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 669.050879][T13265] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 669.072107][T13265] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 669.094094][T13265] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 669.126272][T13265] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.145921][T13265] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.171551][T13265] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.186394][T13265] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.219518][T13379] netlink: 'syz.1.2326': attribute type 10 has an invalid length. [ 669.236643][T13379] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2326'. [ 669.568018][ T1082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.602361][ T1082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.774624][ T42] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.792653][ T42] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 670.400590][T13402] delete_channel: no stack [ 670.618449][T13405] netlink: 'syz.0.2334': attribute type 21 has an invalid length. [ 670.627294][T13405] netlink: 'syz.0.2334': attribute type 1 has an invalid length. [ 670.646370][T13405] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2334'. [ 670.700897][T13409] netlink: 'syz.0.2334': attribute type 21 has an invalid length. [ 670.731137][T13409] netlink: 'syz.0.2334': attribute type 1 has an invalid length. [ 670.772634][T13409] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2334'. [ 671.163611][ T5777] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 672.167858][ T5084] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 672.185826][ T5084] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 672.204820][ T5084] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 672.216150][ T5084] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 672.224881][ T5084] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 672.233174][ T5084] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 673.088692][T13431] chnl_net:caif_netlink_parms(): no params data found [ 674.145830][T13431] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.180832][T13431] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.190952][T13431] bridge_slave_0: entered allmulticast mode [ 674.211013][T13431] bridge_slave_0: entered promiscuous mode [ 674.249743][T13431] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.282426][T13431] bridge0: port 2(bridge_slave_1) entered disabled state [ 674.289958][T13431] bridge_slave_1: entered allmulticast mode [ 674.303370][ T5084] Bluetooth: hci4: command tx timeout [ 674.314050][T13431] bridge_slave_1: entered promiscuous mode [ 674.401664][T13431] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 674.431781][ T5084] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 674.435392][T13431] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 674.727414][T13431] team0: Port device team_slave_0 added [ 674.763623][T13431] team0: Port device team_slave_1 added [ 674.844651][T13431] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 674.851674][T13431] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 674.962260][T13431] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 674.994897][T13431] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 675.001954][T13431] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 675.046900][T13431] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 675.143864][T13431] hsr_slave_0: entered promiscuous mode [ 675.168750][T13431] hsr_slave_1: entered promiscuous mode [ 675.202772][T13431] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 675.220472][T13431] Cannot create hsr debugfs directory [ 675.590313][T13431] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.785103][T13431] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 676.607629][ T5084] Bluetooth: hci4: command tx timeout [ 677.239870][T13431] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.682781][T13431] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 677.780883][ T5084] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 678.159254][T13431] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 678.204573][T13431] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 678.225170][T13431] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 678.238811][T13431] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 678.515132][T13431] 8021q: adding VLAN 0 to HW filter on device bond0 [ 678.579088][T13431] 8021q: adding VLAN 0 to HW filter on device team0 [ 678.610288][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 678.617635][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 678.632551][ T5084] Bluetooth: hci4: command tx timeout [ 678.663200][ T2989] bridge0: port 2(bridge_slave_1) entered blocking state [ 678.670443][ T2989] bridge0: port 2(bridge_slave_1) entered forwarding state [ 679.287142][T13431] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 679.439589][T13431] veth0_vlan: entered promiscuous mode [ 679.491789][T13431] veth1_vlan: entered promiscuous mode [ 679.627497][T13431] veth0_macvtap: entered promiscuous mode [ 679.677230][T13431] veth1_macvtap: entered promiscuous mode [ 679.748533][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.782047][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.808032][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.838716][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.871251][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.902441][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.922703][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.942273][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.962279][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.977242][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.007996][T13431] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 680.125164][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.144678][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.166892][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.207922][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.234722][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.289411][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.320409][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.729567][ T5084] Bluetooth: hci4: command tx timeout [ 680.892352][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.926138][T13431] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.967777][T13431] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 681.010246][T13431] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 681.100337][T13431] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.131493][T13431] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.141595][T13431] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 681.155767][ T5084] Bluetooth: hci0: unexpected event 0x05 length: 15 > 4 [ 681.156013][T13431] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 682.893967][ T1082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 682.901964][ T1082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 683.135997][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 683.147583][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 683.259160][T13540] netlink: 'syz.0.2378': attribute type 9 has an invalid length. [ 683.267097][T13540] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.2378'. [ 683.558238][T13544] netlink: 'syz.2.2337': attribute type 10 has an invalid length. [ 683.566865][T13544] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2337'. [ 683.595034][T13544] batman_adv: batadv0: Adding interface: veth1_virt_wifi [ 683.640596][T13544] batman_adv: batadv0: The MTU of interface veth1_virt_wifi is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 683.710015][T13544] batman_adv: batadv0: Interface activated: veth1_virt_wifi [ 684.124752][ T5084] Bluetooth: hci3: unexpected event 0x05 length: 15 > 4 [ 685.245836][T13571] syzkaller0: entered promiscuous mode [ 685.309193][T13571] syzkaller0: entered allmulticast mode [ 686.149374][ T1284] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.172256][ T1284] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.569280][ T5084] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 689.991654][T13602] netlink: 'syz.3.2393': attribute type 10 has an invalid length. [ 690.007085][T13602] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2393'. [ 691.987850][T13644] netlink: 'syz.3.2408': attribute type 10 has an invalid length. [ 692.000733][T13644] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2408'. [ 692.038324][ T5084] Bluetooth: hci2: unexpected event 0x05 length: 15 > 4 [ 692.209652][T13651] FAULT_INJECTION: forcing a failure. [ 692.209652][T13651] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 692.258989][T13651] CPU: 0 PID: 13651 Comm: syz.3.2410 Not tainted syzkaller #0 [ 692.266545][T13651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 692.276664][T13651] Call Trace: [ 692.279986][T13651] [ 692.282996][T13651] dump_stack_lvl+0x18c/0x250 [ 692.287850][T13651] ? show_regs_print_info+0x20/0x20 [ 692.293112][T13651] ? load_image+0x420/0x420 [ 692.297681][T13651] ? __might_fault+0xaa/0x120 [ 692.302546][T13651] ? __lock_acquire+0x7d80/0x7d80 [ 692.307638][T13651] should_fail_ex+0x394/0x4c0 [ 692.312393][T13651] _copy_from_iter+0x1cd/0x1290 [ 692.317317][T13651] ? sock_alloc_send_pskb+0x8a1/0x9a0 [ 692.322756][T13651] ? copyout_mc+0x70/0x70 [ 692.327146][T13651] ? __virt_addr_valid+0x10c/0x380 [ 692.332316][T13651] ? __virt_addr_valid+0x10c/0x380 [ 692.337500][T13651] ? __virt_addr_valid+0x10c/0x380 [ 692.342811][T13651] ? __check_object_size+0x4fc/0xa40 [ 692.348175][T13651] skb_copy_datagram_from_iter+0xf2/0x6f0 [ 692.353963][T13651] ? skb_put+0x112/0x210 [ 692.358259][T13651] tun_get_user+0xc84/0x3d70 [ 692.362923][T13651] ? trace_event_raw_event_lock+0x150/0x240 [ 692.368875][T13651] ? aa_file_perm+0x3e3/0xee0 [ 692.373609][T13651] ? rcu_read_unlock+0xa0/0xa0 [ 692.378486][T13651] ? tun_get+0x1c/0x2e0 [ 692.382688][T13651] ? __lock_acquire+0x7d80/0x7d80 [ 692.387773][T13651] ? tun_get+0x1c/0x2e0 [ 692.391985][T13651] tun_chr_write_iter+0x119/0x200 [ 692.397148][T13651] vfs_write+0x474/0x9a0 [ 692.401458][T13651] ? file_end_write+0x250/0x250 [ 692.406376][T13651] ? __fget_files+0x3fc/0x460 [ 692.411117][T13651] ? __fdget_pos+0x1d8/0x330 [ 692.415763][T13651] ? ksys_write+0x74/0x260 [ 692.420241][T13651] ksys_write+0x151/0x260 [ 692.424637][T13651] ? __ia32_sys_read+0x90/0x90 [ 692.429459][T13651] ? lockdep_hardirqs_on+0x98/0x150 [ 692.434710][T13651] do_syscall_64+0x55/0xb0 [ 692.439182][T13651] ? clear_bhb_loop+0x40/0x90 [ 692.443942][T13651] ? clear_bhb_loop+0x40/0x90 [ 692.448673][T13651] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 692.454629][T13651] RIP: 0033:0x7fa3a4b9de99 [ 692.459093][T13651] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.478926][T13651] RSP: 002b:00007fa3a5a75028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 692.487398][T13651] RAX: ffffffffffffffda RBX: 00007fa3a4e25fa0 RCX: 00007fa3a4b9de99 [ 692.495421][T13651] RDX: 000000000000fdef RSI: 0000200000000200 RDI: 00000000000000c8 [ 692.503465][T13651] RBP: 00007fa3a5a75090 R08: 0000000000000000 R09: 0000000000000000 [ 692.511486][T13651] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 692.519514][T13651] R13: 00007fa3a4e26038 R14: 00007fa3a4e25fa0 R15: 00007ffd87d637a8 [ 692.527556][T13651] [ 693.279672][T13665] delete_channel: no stack [ 693.374846][T13670] netlink: 'syz.3.2419': attribute type 10 has an invalid length. [ 693.388275][T13670] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2419'. [ 694.061680][ T5084] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 694.164904][T13682] netlink: 'syz.1.2421': attribute type 9 has an invalid length. [ 694.262860][T13682] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.2421'. [ 697.126139][ T5084] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 698.128191][ T5777] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 698.146802][ T5777] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 698.156673][ T5777] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 698.165824][ T5777] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 698.174068][ T5777] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 698.184802][ T5777] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 698.779581][T13755] chnl_net:caif_netlink_parms(): no params data found [ 699.593719][T13755] bridge0: port 1(bridge_slave_0) entered blocking state [ 699.628194][T13755] bridge0: port 1(bridge_slave_0) entered disabled state [ 699.650016][T13755] bridge_slave_0: entered allmulticast mode [ 699.658746][T13755] bridge_slave_0: entered promiscuous mode [ 699.694923][T13755] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.704843][T13755] bridge0: port 2(bridge_slave_1) entered disabled state [ 699.721847][T13755] bridge_slave_1: entered allmulticast mode [ 699.748541][T13755] bridge_slave_1: entered promiscuous mode [ 699.838040][T13755] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 699.895989][T13755] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 700.054438][T13755] team0: Port device team_slave_0 added [ 700.071739][T13755] team0: Port device team_slave_1 added [ 700.127746][T13755] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 700.141482][T13755] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 700.199530][T13755] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 700.226274][T13755] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 700.242311][T13755] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 700.290186][T13755] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 700.314687][ T5084] Bluetooth: hci1: command tx timeout [ 700.390628][T13755] hsr_slave_0: entered promiscuous mode [ 700.398965][T13755] hsr_slave_1: entered promiscuous mode [ 700.406304][T13755] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 700.414097][T13755] Cannot create hsr debugfs directory [ 700.705255][ T5084] Bluetooth: hci4: unexpected event 0x05 length: 15 > 4 [ 702.382291][ T5084] Bluetooth: hci1: command tx timeout [ 704.008387][T13755] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.275485][T13755] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.462424][ T5084] Bluetooth: hci1: command tx timeout [ 704.583715][T13755] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 704.859121][T13755] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.521819][T13824] syzkaller0: entered promiscuous mode [ 705.535957][T13824] syzkaller0: entered allmulticast mode [ 706.552917][ T5084] Bluetooth: hci1: command tx timeout [ 708.066032][T13755] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 708.081425][T13755] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 708.092590][T13755] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 708.132254][T13755] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 708.417205][T13755] 8021q: adding VLAN 0 to HW filter on device bond0 [ 708.495951][T13755] 8021q: adding VLAN 0 to HW filter on device team0 [ 708.557159][T13618] bridge0: port 1(bridge_slave_0) entered blocking state [ 708.564406][T13618] bridge0: port 1(bridge_slave_0) entered forwarding state [ 708.596739][T13618] bridge0: port 2(bridge_slave_1) entered blocking state [ 708.603989][T13618] bridge0: port 2(bridge_slave_1) entered forwarding state [ 708.810008][T13755] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 709.561699][T13755] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 709.857424][T13895] syzkaller0: entered promiscuous mode [ 709.869461][T13895] syzkaller0: entered allmulticast mode [ 709.919109][T13755] veth0_vlan: entered promiscuous mode [ 712.034410][T13755] veth1_vlan: entered promiscuous mode [ 712.134285][T13755] veth0_macvtap: entered promiscuous mode [ 712.190955][T13755] veth1_macvtap: entered promiscuous mode [ 712.213176][T13914] [ 712.215861][T13914] ============================= [ 712.220800][T13914] WARNING: suspicious RCU usage [ 712.226053][T13914] syzkaller #0 Not tainted [ 712.230530][T13914] ----------------------------- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 712.235528][T13914] kernel/events/callchain.c:161 suspicious rcu_dereference_check() usage! [ 712.244247][T13914] [ 712.244247][T13914] other info that might help us debug this: [ 712.244247][T13914] [ 712.254599][T13914] [ 712.254599][T13914] rcu_scheduler_active = 2, debug_locks = 1 [ 712.262767][T13914] 1 lock held by syz.0.2502/13914: [ 712.267932][T13914] #0: ffffffff8d131f80 (rcu_read_lock_trace){....}-{0:0}, at: rcu_read_lock_trace+0x37/0x70 [ 712.278408][T13914] [ 712.278408][T13914] stack backtrace: [ 712.284738][T13914] CPU: 0 PID: 13914 Comm: syz.0.2502 Not tainted syzkaller #0 [ 712.292256][T13914] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 712.302368][T13914] Call Trace: [ 712.305737][T13914] [ 712.308697][T13914] dump_stack_lvl+0x18c/0x250 [ 712.313434][T13914] ? show_regs_print_info+0x20/0x20 [ 712.318673][T13914] ? load_image+0x420/0x420 [ 712.323214][T13914] ? __lock_acquire+0x1262/0x7d80 [ 712.328290][T13914] lockdep_rcu_suspicious+0x1e1/0x300 [ 712.333699][T13914] get_callchain_entry+0x2a9/0x3c0 [ 712.338850][T13914] get_perf_callchain+0xc6/0x510 [ 712.343825][T13914] ? put_callchain_entry+0xb0/0xb0 [ 712.348966][T13914] ? futex_wait_queue+0x9d/0x1b0 [ 712.353940][T13914] __bpf_get_stack+0x2e4/0x540 [ 712.358752][T13914] ? stack_map_get_build_id_offset+0x720/0x720 [ 712.364946][T13914] ? bpf_prog_939e3abb3850b85a_F+0x31/0x33 [ 712.370784][T13914] bpf_get_stack_raw_tp+0x1a4/0x210 [ 712.376020][T13914] bpf_prog_939e3abb3850b85a_F+0x31/0x33 [ 712.381693][T13914] bpf_prog_825df63258e64e33+0x22/0x27 [ 712.387193][T13914] bpf_prog_run_pin_on_cpu+0x64/0x150 [ 712.392615][T13914] bpf_prog_test_run_syscall+0x320/0x4b0 [ 712.398302][T13914] ? sock_gen_cookie+0x60/0x60 [ 712.403101][T13914] ? sock_gen_cookie+0x60/0x60 [ 712.407894][T13914] bpf_prog_test_run+0x31f/0x390 [ 712.412867][T13914] __sys_bpf+0x49d/0x890 [ 712.417147][T13914] ? bpf_link_show_fdinfo+0x390/0x390 [ 712.422567][T13914] ? lock_chain_count+0x20/0x20 [ 712.427456][T13914] __x64_sys_bpf+0x7c/0x90 [ 712.431902][T13914] do_syscall_64+0x55/0xb0 [ 712.436358][T13914] ? clear_bhb_loop+0x40/0x90 [ 712.441061][T13914] ? clear_bhb_loop+0x40/0x90 [ 712.445777][T13914] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 712.451716][T13914] RIP: 0033:0x7f3082b9de99 [ 712.456165][T13914] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 712.475804][T13914] RSP: 002b:00007f3083a5d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 712.484260][T13914] RAX: ffffffffffffffda RBX: 00007f3082e25fa0 RCX: 00007f3082b9de99 [ 712.492267][T13914] RDX: 000000000000000c RSI: 00002000000004c0 RDI: 000000000000000a [ 712.500282][T13914] RBP: 00007f3082c33eaf R08: 0000000000000000 R09: 0000000000000000 [ 712.508382][T13914] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 712.516392][T13914] R13: 00007f3082e26038 R14: 00007f3082e25fa0 R15: 00007ffde3def138 [ 712.524414][T13914] [ 713.827337][ T151] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 713.961622][ T151] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.042056][ T151] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 714.184289][ T151] bond0: (slave netdevsim0): Releasing backup interface [ 714.206771][ T151] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 715.310485][ T151] [ 715.312894][ T151] ====================================================== [ 715.319957][ T151] WARNING: possible circular locking dependency detected [ 715.327014][ T151] syzkaller #0 Not tainted [ 715.331463][ T151] ------------------------------------------------------ [ 715.338517][ T151] kworker/u4:6/151 is trying to acquire lock: [ 715.344624][ T151] ffff8880300acd80 (team->team_lock_key){+.+.}-{3:3}, at: team_del_slave+0x31/0x1b0 [ 715.354098][ T151] [ 715.354098][ T151] but task is already holding lock: [ 715.361501][ T151] ffff8880212d8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x2bd/0x690 [ 715.372051][ T151] [ 715.372051][ T151] which lock already depends on the new lock. [ 715.372051][ T151] [ 715.382502][ T151] [ 715.382502][ T151] the existing dependency chain (in reverse order) is: [ 715.391599][ T151] [ 715.391599][ T151] -> #1 (&rdev->wiphy.mtx){+.+.}-{3:3}: [ 715.399386][ T151] __mutex_lock+0x135/0xc80 [ 715.404468][ T151] ieee80211_open+0x144/0x200 [ 715.409728][ T151] __dev_open+0x2cb/0x430 [ 715.414630][ T151] dev_open+0xab/0x190 [ 715.419261][ T151] team_add_slave+0x709/0x2880 [ 715.424594][ T151] do_setlink+0xcde/0x3f40 [ 715.429618][ T151] rtnl_newlink+0x1848/0x2170 [ 715.434905][ T151] rtnetlink_rcv_msg+0x843/0xf90 [ 715.440413][ T151] netlink_rcv_skb+0x235/0x4c0 [ 715.445747][ T151] netlink_unicast+0x7b1/0x930 [ 715.451189][ T151] netlink_sendmsg+0x8d0/0xbf0 [ 715.456535][ T151] ____sys_sendmsg+0x61b/0x980 [ 715.461877][ T151] ___sys_sendmsg+0x2a6/0x360 [ 715.467125][ T151] __se_sys_sendmsg+0x1d0/0x2c0 [ 715.472554][ T151] do_syscall_64+0x55/0xb0 [ 715.477554][ T151] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 715.484027][ T151] [ 715.484027][ T151] -> #0 (team->team_lock_key){+.+.}-{3:3}: [ 715.492081][ T151] __lock_acquire+0x37ef/0x7d80 [ 715.497524][ T151] lock_acquire+0x19e/0x420 [ 715.502753][ T151] __mutex_lock+0x135/0xc80 [ 715.507832][ T151] team_del_slave+0x31/0x1b0 [ 715.513010][ T151] team_device_event+0x297/0xa30 [ 715.518565][ T151] notifier_call_chain+0x18f/0x380 [ 715.524261][ T151] unregister_netdevice_many_notify+0x1037/0x1910 [ 715.531262][ T151] unregister_netdevice_queue+0x2e9/0x330 [ 715.537601][ T151] _cfg80211_unregister_wdev+0x16d/0x580 [ 715.543897][ T151] ieee80211_remove_interfaces+0x4b3/0x690 [ 715.550275][ T151] ieee80211_unregister_hw+0x5d/0x2a0 [ 715.556385][ T151] mac80211_hwsim_del_radio+0x289/0x480 [ 715.562548][ T151] hwsim_exit_net+0x58d/0x650 [ 715.567802][ T151] cleanup_net+0x707/0xbb0 [ 715.572795][ T151] process_scheduled_works+0xa60/0x1600 [ 715.578909][ T151] worker_thread+0xa5e/0xfe0 [ 715.584066][ T151] kthread+0x2fa/0x390 [ 715.588704][ T151] ret_from_fork+0x48/0x80 [ 715.593701][ T151] ret_from_fork_asm+0x11/0x20 [ 715.599078][ T151] [ 715.599078][ T151] other info that might help us debug this: [ 715.599078][ T151] [ 715.609340][ T151] Possible unsafe locking scenario: [ 715.609340][ T151] [ 715.616858][ T151] CPU0 CPU1 [ 715.622258][ T151] ---- ---- [ 715.627694][ T151] lock(&rdev->wiphy.mtx); [ 715.632243][ T151] lock(team->team_lock_key); [ 715.639574][ T151] lock(&rdev->wiphy.mtx); [ 715.646643][ T151] lock(team->team_lock_key); [ 715.651547][ T151] [ 715.651547][ T151] *** DEADLOCK *** [ 715.651547][ T151] [ 715.659776][ T151] 5 locks held by kworker/u4:6/151: [ 715.665013][ T151] #0: ffff888140048938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 715.675970][ T151] #1: ffffc90002e57d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 715.686586][ T151] #2: ffffffff8e3c8b10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 [ 715.696069][ T151] #3: ffffffff8e3d5b08 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_unregister_hw+0x55/0x2a0 [ 715.705980][ T151] #4: ffff8880212d8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: ieee80211_remove_interfaces+0x2bd/0x690 [ 715.716854][ T151] [ 715.716854][ T151] stack backtrace: [ 715.722874][ T151] CPU: 0 PID: 151 Comm: kworker/u4:6 Not tainted syzkaller #0 [ 715.730373][ T151] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 715.740486][ T151] Workqueue: netns cleanup_net [ 715.745315][ T151] Call Trace: [ 715.748641][ T151] [ 715.751615][ T151] dump_stack_lvl+0x18c/0x250 [ 715.756375][ T151] ? load_image+0x420/0x420 [ 715.760935][ T151] ? show_regs_print_info+0x20/0x20 [ 715.766190][ T151] ? print_circular_bug+0x12b/0x1a0 [ 715.771443][ T151] check_noncircular+0x2fc/0x400 [ 715.776445][ T151] ? print_deadlock_bug+0x5d0/0x5d0 [ 715.781689][ T151] ? lockdep_lock+0xf5/0x230 [ 715.786327][ T151] ? _find_first_zero_bit+0xd6/0x100 [ 715.791672][ T151] __lock_acquire+0x37ef/0x7d80 [ 715.796591][ T151] ? verify_lock_unused+0x140/0x140 [ 715.801841][ T151] ? verify_lock_unused+0x140/0x140 [ 715.807093][ T151] ? __up_read+0x2b8/0x6b0 [ 715.811557][ T151] lock_acquire+0x19e/0x420 [ 715.816099][ T151] ? team_del_slave+0x31/0x1b0 [ 715.820920][ T151] ? __might_sleep+0xe0/0xe0 [ 715.825567][ T151] ? read_lock_is_recursive+0x20/0x20 [ 715.830989][ T151] __mutex_lock+0x135/0xc80 [ 715.835545][ T151] ? team_del_slave+0x31/0x1b0 [ 715.840400][ T151] ? __mutex_lock+0x30d/0xc80 [ 715.845134][ T151] ? team_del_slave+0x31/0x1b0 [ 715.849949][ T151] ? mutex_lock_nested+0x20/0x20 [ 715.854928][ T151] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 715.860621][ T151] team_del_slave+0x31/0x1b0 [ 715.865268][ T151] team_device_event+0x297/0xa30 [ 715.870251][ T151] notifier_call_chain+0x18f/0x380 [ 715.875424][ T151] unregister_netdevice_many_notify+0x1037/0x1910 [ 715.881905][ T151] ? unregister_netdevice_many+0x20/0x20 [ 715.887613][ T151] ? kernfs_remove_by_name_ns+0x117/0x150 [ 715.893396][ T151] ? __lock_acquire+0x7d80/0x7d80 [ 715.898488][ T151] unregister_netdevice_queue+0x2e9/0x330 [ 715.904275][ T151] ? list_netdevice+0x730/0x730 [ 715.909249][ T151] ? kernfs_remove_by_name_ns+0x117/0x150 [ 715.915033][ T151] _cfg80211_unregister_wdev+0x16d/0x580 [ 715.920721][ T151] ieee80211_remove_interfaces+0x4b3/0x690 [ 715.926669][ T151] ? ieee80211_do_stop+0x1df0/0x1df0 [ 715.932058][ T151] ? rcu_is_watching+0x15/0xb0 [ 715.936892][ T151] ieee80211_unregister_hw+0x5d/0x2a0 [ 715.942312][ T151] mac80211_hwsim_del_radio+0x289/0x480 [ 715.947920][ T151] ? rhashtable_remove_fast+0xc00/0xc00 [ 715.953619][ T151] hwsim_exit_net+0x58d/0x650 [ 715.958362][ T151] ? hwsim_init_net+0x90/0x90 [ 715.963093][ T151] ? __ip_vs_dev_cleanup_batch+0x238/0x250 [ 715.969045][ T151] cleanup_net+0x707/0xbb0 [ 715.973521][ T151] ? ops_free_list+0x3b0/0x3b0 [ 715.978343][ T151] ? _raw_spin_unlock_irq+0x23/0x50 [ 715.983778][ T151] ? process_scheduled_works+0x975/0x1600 [ 715.989943][ T151] ? process_scheduled_works+0x975/0x1600 [ 715.995753][ T151] process_scheduled_works+0xa60/0x1600 [ 716.001384][ T151] ? worker_attach_to_pool+0x370/0x370 [ 716.006910][ T151] ? assign_work+0x3cc/0x5d0 [ 716.011665][ T151] worker_thread+0xa5e/0xfe0 [ 716.016333][ T151] ? _raw_spin_unlock+0x40/0x40 [ 716.021246][ T151] ? __kthread_parkme+0x71/0x1c0 [ 716.026235][ T151] kthread+0x2fa/0x390 [ 716.030363][ T151] ? pr_cont_work+0x550/0x550 [ 716.035099][ T151] ? kthread_blkcg+0xd0/0xd0 [ 716.039735][ T151] ret_from_fork+0x48/0x80 [ 716.044201][ T151] ? kthread_blkcg+0xd0/0xd0 [ 716.048835][ T151] ret_from_fork_asm+0x11/0x20 [ 716.053669][ T151] [ 716.064827][ T151] team0: Port device wlan1 removed [ 716.237618][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 716.248778][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 716.263337][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 716.270829][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 716.283274][ T151] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 716.290835][ T151] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 716.307542][ T151] veth1_vlan: left promiscuous mode [ 716.315370][ T151] veth0_vlan: left promiscuous mode [ 716.467998][ T151] team0 (unregistering): Port device geneve1 removed [ 716.662351][ T151] team0 (unregistering): Port device team_slave_1 removed [ 716.691003][ T151] team0 (unregistering): Port device team_slave_0 removed [ 716.720351][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 716.750573][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 716.920000][ T151] bond0 (unregistering): Released all slaves [ 717.478114][ T151] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.535097][ T151] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.590529][ T151] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 717.643844][ T151] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 718.643982][ T151] hsr_slave_0: left promiscuous mode [ 718.650068][ T151] hsr_slave_1: left promiscuous mode [ 718.660439][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 718.669303][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 718.677594][ T151] bridge_slave_1: left allmulticast mode [ 718.686010][ T151] bridge_slave_1: left promiscuous mode [ 718.691869][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 718.701474][ T151] bridge_slave_0: left allmulticast mode [ 718.709732][ T151] bridge_slave_0: left promiscuous mode [ 718.716011][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 718.733746][ T151] hsr_slave_0: left promiscuous mode [ 718.739792][ T151] hsr_slave_1: left promiscuous mode [ 718.748196][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 718.758372][ T151] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 718.768596][ T151] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 718.776966][ T151] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 718.787806][ T151] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 718.796341][ T151] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 718.806953][ T151] bridge_slave_1: left allmulticast mode [ 718.813056][ T151] bridge_slave_1: left promiscuous mode [ 718.818844][ T151] bridge0: port 2(bridge_slave_1) entered disabled state [ 718.830077][ T151] bridge_slave_0: left allmulticast mode [ 718.836726][ T151] bridge_slave_0: left promiscuous mode [ 718.843581][ T151] bridge0: port 1(bridge_slave_0) entered disabled state [ 718.856492][ T151] veth1_macvtap: left promiscuous mode [ 718.862338][ T151] veth0_macvtap: left promiscuous mode [ 718.868446][ T151] veth1_vlan: left promiscuous mode [ 718.874496][ T151] veth0_vlan: left promiscuous mode [ 718.880901][ T151] veth1_macvtap: left promiscuous mode [ 718.886535][ T151] veth0_macvtap: left promiscuous mode [ 718.893147][ T151] veth1_vlan: left promiscuous mode [ 718.898464][ T151] veth0_vlan: left promiscuous mode [ 719.208307][ T151] team0 (unregistering): Port device team_slave_1 removed [ 719.240487][ T151] team0 (unregistering): Port device team_slave_0 removed [ 719.271143][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 719.301237][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 719.377111][ T151] bond0 (unregistering): Released all slaves [ 719.588363][ T151] team0 (unregistering): Port device team_slave_1 removed [ 719.618596][ T151] team0 (unregistering): Port device team_slave_0 removed [ 719.647233][ T151] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 719.678066][ T151] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 719.759295][ T151] bond0 (unregistering): Released all slaves