last executing test programs: 9.655520028s ago: executing program 0 (id=2675): socket$kcm(0x10, 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7f, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x4, 0x0, 0x0, 0x0, 0x200002009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000020000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000808500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x28108, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.66139662s ago: executing program 2 (id=2677): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)}, 0x20000018) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@generic={0x0}, 0x18) socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000b80)=ANY=[], 0xfe33) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x8, 0x400, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, @perf_config_ext={0xffffffffffffff7f}, 0x111311, 0x1, 0x0, 0x1, 0x20000, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x28, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1800000091000000000000000100000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000030c0a00ffff00009b800400040000001853000002800000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001841000003000000000000000000000018120000", @ANYRES32, @ANYBLOB="0040000000000000b70300000000000085008000000000000000000000000000ac998120cf54f5f8a938125a00000000008500000085000000b7000000000000950000"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x5}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000007fffffff00000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00ffffffe200"/26], 0x50) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xd, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000021b81a000000004da6afd9f045135b23dca78d311f0000000000000000008500000039000000a0000000000000003ce51d6b49e2c8d92067372b47f98c2e1b184d906db6dc2f6c42543824aae56af95dfd2451f266c8c06df367b4c5c9e7d90adaf7a26fc309b1c85622ac1360dc4cef09a88b975707e4bd6bc8dbe02d2c0753803313127aa820196eb936a0d0bf16630655998d9c1550c1bc7654cfb3f8e2dfd3d393f1b98311a99d8827bb1765e8d9d9f9d1480c173f401db94a0e0d17e25f459e76"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) close(r3) socket$kcm(0x29, 0x5, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000340)={0x0, &(0x7f0000000200)=""/105, 0x0, &(0x7f0000000580)="bca13f58108937270789108abef62fc69699d33b5b5ef0def2fb77dbb117902c28122e2f2fb8ac793c47db676efd92aeacef4f223cdb490d7eaa0860b0f1abaaad5a58cd7e5855b48a7272e2854fda05f41a005d555f788cac0ce588812f48ec13a49b934fcfa64f4862f43adc0335ee9a202360de774f6123ff", 0x7, r3, 0x4}, 0x38) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x6, 0xd}, 0x0, 0x80000, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x4861}, 0x0, 0x0, 0xffffffffffffffff, 0xb) ioctl$SIOCSIFHWADDR(r3, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}], 0x1}, 0x4000000) socket$kcm(0x10, 0x2, 0x0) r4 = gettid() perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x10, 0x5, 0x0, 0x72, 0x0, 0x8, 0x4009, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={&(0x7f0000000140), 0xa}, 0x200, 0x0, 0x4, 0x5, 0xfffffffffffffffb, 0x2, 0xfffd, 0x0, 0x7fff, 0x0, 0x6}, r4, 0xa, r1, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r5) getpid() 7.837839457s ago: executing program 0 (id=2679): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688a24c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 7.836634338s ago: executing program 3 (id=2680): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x3, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xb}, 0x100000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}, 0x40000) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x82, 0x5, 0x0, 0x0, 0x0, 0x0, 0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xe}, 0x9034, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x6, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000008c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, @fallback=0x25}, 0x94) socketpair(0x1a, 0xa, 0x0, &(0x7f0000000000)) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x4b) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_virt_wifi\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000080)) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0x4}, {0x6, 0x1, 0x0, 0x1}]}) r4 = socket$kcm(0x11, 0x200000000000002, 0x300) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x7, 0x4, 0x5}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000cc0)={{r5}, &(0x7f0000000c40), &(0x7f0000000c80)='%pB \x00'}, 0x20) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000000)=r6, 0x4) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688a24c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 7.770392509s ago: executing program 2 (id=2681): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73f72cc9f0ba1f8483a0000005e1206021f1f00000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4004850) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000380)=@bpf_tracing={0x1a, 0x1b, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000ffff0000000000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000810000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000018120000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000008510000002000000181100", @ANYRES32, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x1b, 0x49, &(0x7f0000000200)=""/73, 0x40f00, 0x2, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x2, 0xb, 0x1, 0xfffffff0}, 0x10, 0x2d052, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7f, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x4, 0x0, 0x0, 0x0, 0x200002009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000020000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000808500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="aeaa000000000000711019000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r5 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x28108, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 7.457367756s ago: executing program 1 (id=2683): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x0, 0x200000, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0xa, 0x6, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000000000)={'wlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r2 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x7c, &(0x7f00000000c0)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000400110000000a600e41b0000900ac00060411000000160012000a00037c0248035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x0) 4.258161516s ago: executing program 0 (id=2684): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) close(r0) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x5d, &(0x7f00000000c0)=[{&(0x7f0000000040)="1400000016000b63d25a80648c2594f90224fc60", 0x14}], 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x400000000000000b, 0xb54b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ffffffd, 0x1, @perf_config_ext={0xe, 0x1ef7}, 0x1080aa, 0x4, 0x98, 0x9, 0x8, 0x32f7cb41, 0xffff, 0x0, 0x0, 0x0, 0x100024}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f0000000000)=0x73) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000080)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x4}, 0x50) socketpair(0x11, 0x800, 0x3, &(0x7f0000000380)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000540)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x2, [@enum={0x10000c, 0x4, 0x0, 0x6, 0x4, [{0xb, 0x2}, {0x3, 0x9}, {0x8, 0x47}, {0x3, 0xfffffff1}]}, @float={0xc, 0x0, 0x0, 0x10, 0x2}, @decl_tag={0xf, 0x0, 0x0, 0x11, 0x5, 0x7}, @typedef={0xe}, @func={0x9, 0x0, 0x0, 0xc, 0x4}]}}, &(0x7f0000000180)=""/171, 0x7a, 0xab, 0x0, 0x8, 0x10000}, 0x28) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x10001) r6 = socket$kcm(0x10, 0x2, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{r5}, &(0x7f0000000480), &(0x7f00000004c0)}, 0x20) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff7ffa}, 0x0, 0x35, 0x43a1bd76, 0x7, 0x3, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r7 = socket$kcm(0x11, 0x20000000000000a, 0x300) setsockopt$sock_attach_bpf(r7, 0x1, 0x28, &(0x7f0000000000), 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe80, 0x6000, &(0x7f0000000640)="b9ff03076844268cb89e14f088a847e08906200060000021000aac141440e0", 0x0, 0x11, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x48) sendmsg$kcm(r6, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080307000000e8fea4a1190015000600142603600e120800110000810401040016000a00104005000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) (fail_nth: 1) close(0xffffffffffffffff) r8 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r8, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004091) sendmsg$kcm(r0, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x2400c094) 4.11623365s ago: executing program 2 (id=2686): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={0x0, &(0x7f00000002c0)=""/129, 0x0, 0x81}, 0x20) close(0x3) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000940)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xe, 0x0, &(0x7f00000003c0)="7993ff01190000e5ffa53b00008f", 0x0, 0x400, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe, 0x4}, 0x50) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) openat$cgroup(0xffffffffffffffff, 0x0, 0x200002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x28) socket$kcm(0x10, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb01001800000000000000300000003000000006000000040000000000000700000000000000000000000b010000000000000001000005fdffffff00000000020000000000000000000000da00449cc3c714906e08dfee3d99e0139560133b9b52f6b1fc8ee247390f62fa6fa2075cee426c4667c484e1b9f396f840cf065a51d68d849465675069467aac7b5af9c2dc7e660a08374bf8196e7b5e2e88b3e48c2c7278bc70a7933a01a85ba8246282486ac3b617529e09c8a805e33bcda33343932444"], &(0x7f0000000340)=""/142, 0x4e, 0x8e, 0x1}, 0x28) r5 = openat$cgroup_int(r4, &(0x7f0000000100)='cpuset.cpus\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000040), 0x1) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_config_ext={0x5, 0x6}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r6, &(0x7f0000001700)={0x0, 0x0, 0x0}, 0x20000010) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000002"], 0x48) ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x890c, &(0x7f0000000100)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="85000000130000005d0000000000000095000000000000000a621cf434b9eaafdc0a00e9bfde908990817b364e51afe9c81a97f0570759f1cae63487ff68fffffffffffe8e3932e2b7185a25a4cf8a9456aa8a701c318c67edb6e9330b53c0eeba8644311ba75411890700000000000000d8e5b1dc91c5499bea0977"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000440)={0xffffffffffffffff, 0x58, &(0x7f00000003c0)}, 0x10) r7 = socket$kcm(0x10, 0x3, 0x0) write$cgroup_subtree(r7, &(0x7f0000001ec0)=ANY=[@ANYBLOB="13120000120091ef04e9befbbd00005c0a"], 0xfe33) recvmsg$kcm(r7, &(0x7f0000000c40)={0x0, 0x0, 0x0}, 0x0) 3.696301119s ago: executing program 1 (id=2687): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 3.63475947s ago: executing program 3 (id=2688): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)}, 0x20000018) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@generic={0x0}, 0x18) socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000b80)=ANY=[], 0xfe33) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x8, 0x400, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, @perf_config_ext={0xffffffffffffff7f}, 0x111311, 0x1, 0x0, 0x1, 0x20000, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x28, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1800000091000000000000000100000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000030c0a00ffff00009b800400040000001853000002800000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001841000003000000000000000000000018120000", @ANYRES32, @ANYBLOB="0040000000000000b70300000000000085008000000000000000000000000000ac998120cf54f5f8a938125a00000000008500000085000000b7000000000000950000"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x5}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000007fffffff00000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00ffffffe200"/26], 0x50) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xd, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000021b81a000000004da6afd9f045135b23dca78d311f0000000000000000008500000039000000a0000000000000003ce51d6b49e2c8d92067372b47f98c2e1b184d906db6dc2f6c42543824aae56af95dfd2451f266c8c06df367b4c5c9e7d90adaf7a26fc309b1c85622ac1360dc4cef09a88b975707e4bd6bc8dbe02d2c0753803313127aa820196eb936a0d0bf16630655998d9c1550c1bc7654cfb3f8e2dfd3d393f1b98311a99d8827bb1765e8d9d9f9d1480c173f401db94a0e0d17e25f459e76"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) close(r3) socket$kcm(0x29, 0x5, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000340)={0x0, &(0x7f0000000200)=""/105, 0x0, &(0x7f0000000580)="bca13f58108937270789108abef62fc69699d33b5b5ef0def2fb77dbb117902c28122e2f2fb8ac793c47db676efd92aeacef4f223cdb490d7eaa0860b0f1abaaad5a58cd7e5855b48a7272e2854fda05f41a005d555f788cac0ce588812f48ec13a49b934fcfa64f4862f43adc0335ee9a202360de774f6123ff", 0x7, r3, 0x4}, 0x38) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x6, 0xd}, 0x0, 0x80000, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x4861}, 0x0, 0x0, 0xffffffffffffffff, 0xb) ioctl$SIOCSIFHWADDR(r3, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}], 0x1}, 0x4000000) socket$kcm(0x10, 0x2, 0x0) r4 = gettid() perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x10, 0x5, 0x0, 0x72, 0x0, 0x8, 0x4009, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={&(0x7f0000000140), 0xa}, 0x200, 0x0, 0x4, 0x5, 0xfffffffffffffffb, 0x2, 0xfffd, 0x0, 0x7fff, 0x0, 0x6}, r4, 0xa, r1, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r5) getpid() 3.541345482s ago: executing program 1 (id=2689): socket$kcm(0x10, 0x2, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7f, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x4, 0x0, 0x0, 0x0, 0x200002009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000020000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000808500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x28108, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r2, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 3.530614793s ago: executing program 0 (id=2690): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000005640)={&(0x7f0000000c00)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1}}, 0x80, &(0x7f00000055c0)=[{&(0x7f0000000c80)="1cef0aa8867c5c5f699a73408efb7cc1061773efa9c3bf13f3a4db2d3a4b7fa69c7eeadf750e65a51cb176b1bed5cf5c40ea075e29a1bf8479b7929b1b83bf0280c5749427dc92ae36eeade83c28464bdf28ca04fbb258d1c83e6ab60b2ae0c445ffa3e3e38539bcdf526000f1497669d9b3f3a2e46971500ba10db63717a8cf48c1f92141abc3205c0118d33c543e213e7b472583ce69ff8267cdc756fe1b56bf6ae01e09fac60cec4a323444f0d4604bbf037c13ccdb78b7bc8ce426", 0xbd}, {&(0x7f0000000d40)="046523533dca9278cff45ee010582f9354fc4232d588531d11ad92dc536080d4f9df66ca9f669426f15efc38fd6c6a3c5d6464a64cef86a3b2b50cd155814792cc1b533842e6990ba439194b661cffa64740c8b05670c3fda1ee3032080b369a53e3d6391f6170a67a62f7c4c90587970d2e3d8ebd85a0a9e0d17bf6ea15c518d6027d6bf00f3af370284bb568c84d0a2f23e67f355853cc882bdf4be457322781490fac466355bd9a0d09d670c4f868ed536b4f4f0ce3262586bda44b9a13856e372076664c0a653ecf620bea1f728915", 0xd1}, {&(0x7f0000000e40)="d03188a3e0330431d266773307f9d9e4ba8a7f52c5052e377d7fb09ee2b3e045865abb15f6be1576b399d50ce80a069064a85c6d66499cca4b40", 0x3a}, {&(0x7f0000000e80)="ba382cbaab16ec6b535daf667b7bbd6d87664dbcd62e198521035a61174129", 0x1f}, {&(0x7f00000054c0)}, {&(0x7f0000005540)="f1c6a93b2de974c5a6325d117d7421016661fa8f0960b102c834de1a956497f3a5a425d86b244201d363c3e0294e992c0d38663b660c894499ad5a9e4a4bb344a842", 0x42}], 0x6}, 0x40100) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0xa1, &(0x7f0000001240)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000004b000000850000007dcd4d00180100002020702500000000002020207b1af8ff00010000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000002d00000095000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r1}, 0xc) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe49, 0x2, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}}, 0x0, 0x9, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r2, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1}}}], 0x20}, 0x4008804) sendmsg$inet(r2, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000640)="a1cac048decc07180339b0435d79ad4fa65e0858f1ae5129d4c6330073058c379b25fcf1a5fcbf4d37e52c640ded5f6babd6e1236971bf9779dd0690fe23781239f8d0e9e684cf633ab1c17ab47d8b0abbd6d1493c551a2e62109ad8595680fca04ade38176eeacb6fdcfd049dd041e42c54b9a4774c4ea5c228a16441eff7204d1b2ea7fe947c77c1686f74ae296f50b0eaad946c62e984e70db2f24f34279d48b7d3127cddb5656fcfa451e9da5cd44a3a2423cc46e28824e46c475ec172539e26e2e4a111f50ac9117d214d731a36ad05bd346ab2d5b1d483f1414a89c50836e3ae5532acd125f9237b851f9f6d879490f9a91d51052abd28a6be1394dcbdd6794013e96b94f2321135eef96e81bfe20e7ea0b68fc5755e7d31beb0283e21499d8fcd83f514a8a6eea618ec21120ef062cc0017a73204e33702fde7e1d3fe010f895a8ade4de79ffa763dd069d3af78cf49a32719099b16510a416b47fa0bebaaa1726f60ccc19bfdd9f0bdafa74517eace278604079136310609e34a7519e840af9acb923e74f932eb88aab4a7c49c479e5be61086e77140f94015a8e7e9985ae8822bb2b06c5badadae50f0efb849a2227f0e8b6112c7fa63f7609fb3902acc6544ba14925ad235bc7d16b90854dd5bea48d9687f4474cf4d9f39b8d0a54b06ac6cbdfb18a33d3eb9de47a3b9acbecb8eef97335c7f55e97bd4cc89c020a1a618859e8d8980b4fadcebe26ad234d0777d4b7c6c4f1b11c45530ab78e2100945452978fc8cc349fe919b8b4fb53a594f3f10201e1d3146ad706109649e4ff2e59354ebfbe6f068a72a9b18215efa0e7a6f4bd73e715fc73618972aff440c3ba526309f3866043f731ab8a9e455ef0b5684976dac37b8f7686be3ec322056e452b5cdda7a10415ce148af5df96fecb10228fa0994c9d25702fb894634661f26dcfed8809ee0a409ccab1325665c1524a4ebe533fef9ab39ca29fb2cb64dd20ba9fcdf2f3c7716847ff88cb601000000000000e2e10e6745422f770e9e5c9aa8634857e5d43eff8a76228e0556f99f848cac1a587664c1ea7c46374d4c1d7b142d403c1906840c6a027ee837b50da72e549867b9c52ad138880c59c997d0410375c96625d841995575e722768e0106f5768da4ebea4f2bea2ce333ad81597f4bd7708c833a54cb3604e1da14de5573d2e326dedeb0041cd416fc5d48ea47571e89ff8eeb45c505f0c1e035e830290235e16439c57bf53c7e7f8603243dd7870040457e06ef6c19c676082272b1a77ed41548ca758068b75a49025bbd4e5b3cecc8a95afeedcbcccf3ee3cf874843ef79b0bb4cc01f9856e2da367fc39e35a5b84cbef5804a5004eda41123071760ef447b09c9a0cb395007429fd25df4b5d339c25ff919121571298ca491f6de0c3474f586ccde072988342bc952a29d97fa6b9c3301cab65e01ff242d21e5a705fd3fe0f0a874b431babaf36ea0805830273de0f97a81c08ec89827c0e9f3643686be8a5cc0f80efd176c2fef7653eaec4ecedf0ce860b99dca23e4b4d9662d184ad9c607c0e0baaab5b2d8ad63d4fff719ea69c46b6731b917b002dfc81a1e18cf9bd57bfa3a60d6ca45f28caeca4133487a0adc36513e3e3b0f1b1253d97830d74051659d2420b3c736d7118610009a64676933c65b71d05f84e41b7d1b491d9aacb1276ab65b1480986f4d9302e7d50ececc557e95a0e15a842623d8cafc92df63198e41fc3de42ba1b802476c5987fd56286e4541fa48e344b10d953250f18b99414aa5b7fb33cbf3c3eb69176db2d3d9f71504e8324d7525ad8310f634485130aeb7c23ce650d032fb76ef282bfb51e46eb7b2affa1e0f2d1f8b39b1b2463978872c0aed7fa5c2db88e906d0f710365e468d0d99ce166f30fff8987439fa35456ff36e78fbe838824d21a419115b3101f7e142468b16e00e44ec24ad339a1063717c2d4bb152228a963869412309cb77985c228d9901fb543bd4b64cb167681ab0d136a9d51ff6c7867c286a1f42c893ac59c40847ccd4a0f1ef57b7a8", 0x5ae}], 0x1}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xe, 0x4, 0x4, 0xa}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r3, &(0x7f0000000300)="989f", &(0x7f00000005c0)=""/104}, 0x20) recvmsg(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/4096, 0x1000}], 0x1}, 0x40010040) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)}], 0x1}, 0x4000000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000200)}, 0x0) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) sendmsg$kcm(r4, &(0x7f0000004480)={0x0, 0x0, &(0x7f0000000780)=[{0x0}], 0x1, &(0x7f00000032c0)=[{0x10, 0x119, 0x8000}, {0x410, 0x88, 0x2, "b3cb1ead501ef31f73b48227a1e9c1e1126c392ec4aac0ed1a54f4398ee08e3f6066dc334f989422e89f23315eddd6d38e40563891fb1c39f9df8e2720ae3fb13a4c5209dac94f4692bca071212e649d9f98b228e5fb9e71240ab1b1181a3ee6dfe267e4f63ef4e9a23e82ee1e4a20286f8ebfbfccdec6e3a0530a15e55acb16d3db51055a8960dc25ba80978b565f952978ef9342f07071e03eb549263ec411fd307cfee6b5f36b6da00bdb086356af0da632b1c23b411391fe21581a5e76187eb39814aef2cd45ad6d22689625a3b458a72d3c063194754a32137434322ec06faa1a978b326fb189f4a3adfa680f528472a9e91650cdf68aebc89eda8212e094fba6f85af9ceb41f8889150be7a49a798850d45ede1954f8a471b6586f0be43c809f4d7526e57e65aadf394d062aa98feba77f7178983429fa7aff42edc83ad80c632238c2fd9a5e3e6f98bc7cdf893306c9c3a99be4c8fbbadd5a5fc1218d5f46960e918b7e830984d66fe8c3e0db1dc7b380e168bf15a2a0963fedabee59cb8fb643ae7f205fbfda1b9bd0cea098a3ce2825a139dc92397c5ddf4e38f7bc25d1dbbf4a092ef193eb39a17515ae4b7bd95e150ced2f0f1dc08d480629c137c17ab5e384118670a8717b90da4a5505e3cbd5453901974b08cdfad49a84906ed850615434edca5faba734e5ae5b322b2418dbee691cd6377ea8814ff2e96a8f75d4a6845f8555c4b5c08981ac3239a0580285dab8acc45e79fcc5f22bbe7d106988f1746bc71e0dc9d82688265f2dc43207045dfba6c282dcc9d803c38dc124ba9127361b1db7e4328b3f671f98ed5c5eaa21075d6242ec520d303255f1e9935451b419e29dbb577c7ee17e4421a234fa98755bb9517998d8febd645076024041fafb0319768aa7b4c5d2f51cc37e7d9921c8483ecbb81a3e4e023b4a107fdae4f5d803eff07f6e4ed9ed7f0db3d69654d7fac0bae87b52fb459c51bcb3fc8d2de3bd555401d6d24d9faeac92265130c6803981c24bf527c4b38761eaa56029e034d130cf99debc058964862afa19b9e7c8e4a445a45faa9d61f15a23736c2f5ca016c1a35d8844d78a8389b348987835a88668c0a199e7c2d619a4e0224ab853f11733cc85f172cc9c655b17ce73d6b796c4f8a5ff3d693fdc4c5abb541f9d6e4c9e8f906b584b767f77d36cd3e04696647a3e87e91441cffb291ae93178815704a37c002c166275db233c1afa8c621ba42512f8fbf2b4fbee3539ee4f05deb49ae5eb819ed0de43b7370b6b7b1f922ce9796d7bb2aab3a22fc514e3e5fe5789fd44000a3c651758aee7beb7299ab2e1adb8829fd4b97b292b344d402e4136ddeae68c4c396c85d6d1b484149c8f1a55e1649fbd13167873e4df9c57817f1dc07dc4e700e3abb502df4e572f8a3d04f8095a7269ac2b17386368b3bf21b63f"}, {0xb0, 0x0, 0x9, "2acd7edb86a049a9c0cb5a802e09f388840a182f1e7e7f679efa89a17a8c6b97b834c3cd993ba79c5ed25cbdf7ba281ba906e214ceacaa30d8e56c3d8dda2dce51523581b50667bd105dcf666ba2ef2717f33a93cb96e7f3cdc8fda673ac82ad176cc1c2d00b026702401cd3afd7d5a963039f7a9368dbe5956de308720378dad67ec7930281b5861bcbeb3aff7e20e8e16ef0affbc37bd949ff4a4482a1a3"}, {0x30, 0x1, 0x0, "6d252e1499101611bb376f6f613529c035b09c8b6523e5503cc5f1"}], 0x500}, 0x40000) close(r4) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_lsm={0x18, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB], 0x0, 0x1, 0xd8, &(0x7f0000000300)=""/216, 0x0, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8916, &(0x7f0000000040)={'bond_slave_1\x00', @random="0200"}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x3}, 0x8) 2.073474244s ago: executing program 3 (id=2691): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)}, 0x20000018) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@generic={0x0}, 0x18) socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000b80)=ANY=[], 0xfe33) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x8, 0x400, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, @perf_config_ext={0xffffffffffffff7f}, 0x111311, 0x1, 0x0, 0x1, 0x20000, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x28, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1800000091000000000000000100000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000030c0a00ffff00009b800400040000001853000002800000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001841000003000000000000000000000018120000", @ANYRES32, @ANYBLOB="0040000000000000b70300000000000085008000000000000000000000000000ac998120cf54f5f8a938125a00000000008500000085000000b7000000000000950000"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x5}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000007fffffff00000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00ffffffe200"/26], 0x50) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xd, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000021b81a000000004da6afd9f045135b23dca78d311f0000000000000000008500000039000000a0000000000000003ce51d6b49e2c8d92067372b47f98c2e1b184d906db6dc2f6c42543824aae56af95dfd2451f266c8c06df367b4c5c9e7d90adaf7a26fc309b1c85622ac1360dc4cef09a88b975707e4bd6bc8dbe02d2c0753803313127aa820196eb936a0d0bf16630655998d9c1550c1bc7654cfb3f8e2dfd3d393f1b98311a99d8827bb1765e8d9d9f9d1480c173f401db94a0e0d17e25f459e76"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) close(r3) socket$kcm(0x29, 0x5, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000340)={0x0, &(0x7f0000000200)=""/105, 0x0, &(0x7f0000000580)="bca13f58108937270789108abef62fc69699d33b5b5ef0def2fb77dbb117902c28122e2f2fb8ac793c47db676efd92aeacef4f223cdb490d7eaa0860b0f1abaaad5a58cd7e5855b48a7272e2854fda05f41a005d555f788cac0ce588812f48ec13a49b934fcfa64f4862f43adc0335ee9a202360de774f6123ff", 0x7, r3, 0x4}, 0x38) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x6, 0xd}, 0x0, 0x80000, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x4861}, 0x0, 0x0, 0xffffffffffffffff, 0xb) ioctl$SIOCSIFHWADDR(r3, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}], 0x1}, 0x4000000) socket$kcm(0x10, 0x2, 0x0) r4 = gettid() perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x10, 0x5, 0x0, 0x72, 0x0, 0x8, 0x4009, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={&(0x7f0000000140), 0xa}, 0x200, 0x0, 0x4, 0x5, 0xfffffffffffffffb, 0x2, 0xfffd, 0x0, 0x7fff, 0x0, 0x6}, r4, 0xa, r1, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r5) getpid() 2.071456245s ago: executing program 2 (id=2699): socket$kcm(0x2c, 0x3, 0x0) (async) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x0, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xfdffffffffffffff, 0xffffffffffffffff, 0x0) (async) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0xc220, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x41, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000006"], 0x66) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0c000000040000000400000009"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000024c0), &(0x7f0000001280), 0xffffffff, r1}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r3 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r2) (async) socket$kcm(0x2, 0x2, 0x0) socket$kcm(0x2c, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) (async) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000024000000080000000b"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r6, 0xffffffffffffffff}, &(0x7f0000000340), &(0x7f00000004c0)=r5}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000006c0)={r7, &(0x7f0000000580), 0x0}, 0x20) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x1}, 0x72bd1de2ad10b2f3, 0x63, 0xcfb5, 0x1, 0x0, 0x0, 0x0, 0x0, 0x84000, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) (async) socketpair(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001a80)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb01001800000000000000640000006400000006000000000000000000000300000000030000000200000000000000020000000100000f01000000000000000000000000000000990000000000000004c9d920c1926c72310afac149cd6b0c00000000000000000000000c00000000000000000100000f03000000000000000000de92fd95439d8e1360cd27affea9a60fd175e469fc8614637792fd723662be3ce48d75218da08682cc379178e7f65dbeb50bb60f164c4cf40f1819c905fc48a927c6162a6599e4287a430237631361ada20db458d7128b8db339af5d6057633bc3898ec07d900134813ba40171482700"/256], 0x0, 0x82, 0x0, 0x1}, 0x28) (async) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8940, &(0x7f0000000080)) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000340)=@generic={&(0x7f00000001c0)='./file0\x00', r2}, 0x18) (async) close(r4) 2.069788325s ago: executing program 1 (id=2692): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)}, 0x4004850) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7f, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x4, 0x0, 0x0, 0x0, 0x200002009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000020000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000808500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="aeaa000000000000711019000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r5 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x28108, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0) sendmsg$unix(0xffffffffffffffff, 0x0, 0x10) 2.006335736s ago: executing program 0 (id=2693): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x0, 0x200000, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0xa, 0x6, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000000000)={'wlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x30, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x0, 0x8, 0xffff, 0xc0, 0x1, 0x9d, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x0, 0x1}, 0x48) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x7c, &(0x7f00000000c0)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000400110000000a600e41b0000900ac00060411000000160012000a00037c0248035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x0) 477.56499ms ago: executing program 2 (id=2694): r0 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={&(0x7f0000000080)=@nfc={0x27, 0x0, 0xcd, 0x2}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)="c0496b67133ce29b14c964e25a7ea8f8d4869a3b4ece95e296ccacbea03b3b52e39e6549e405305aaeaea4c30b2824139a911a9393feb0208a2b11571554b341d69a1966291511e9c0aec3b63f696f2b56ec", 0x52}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="b000000000000000cc2ef6278e6e6e68df7d360a5298d6249944a8eebe0b51b56827b5e9d9d4a658335427662e784f9e4cde3d4b7ed9ad75ecaf7ecc86c44f8b5e2ac5a3e2dad3b82369512afb012b51a8afdd102cdd1ac0a01af84cf9f2c3acf7da122d5aa674c8fb63f682a98a1bd6377d56578c791cb6e801264f85c64e86fd49fb6baccef9c404202d45a74b3476c852c1f5338a0ba6258df835621ebf643751d6b70fcd4500e8161248db31545b4e680860c78a145833c442abd32a71506f67c79d4398b27cf456c3501ffa53fad1c18fdf6aba2bf4a25efa5115bd412c1b9376f0fa3459fe8c1645ef6030b4a3401741bb3cb63d1de39ea6375bd62364ad6b98b3afed4b812c243e07b223d17c4b098ecfb4407454227988cd7148e4a6879e749730d7efeb8ddfe1a9b42175a8bd961bb96a37b5a097f647caee0cb89006dacf9fa5838fef77c1beed703b5658a4d42c452b7ac478cfd9b8df2a"], 0xb0}, 0xc000) sendmsg$kcm(r0, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4001, 0x0, @empty}, 0x80, 0x0}, 0x20000001) recvmsg$kcm(r0, &(0x7f0000005140)={0x0, 0x0, 0x0}, 0x100b6) 463.8529ms ago: executing program 3 (id=2695): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2101, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}, 0x100904, 0x0, 0x0, 0x0, 0x200000, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) close(r1) socket$kcm(0xa, 0x6, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000000000)={'wlan0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7, 0xa}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0x0, 0x8, 0xffff, 0xc0, 0x1, 0x9d, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x1, 0x0, 0x1}, 0x48) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x7c, &(0x7f00000000c0)=[{&(0x7f0000000180)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe55a10a000400110000000a600e41b0000900ac00060411000000160012000a00037c0248035c3b61c1d67f6f94007134cf6efb8000a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000000008af26c8b7b55f4d2a6823a45f28fcb1d", 0xd8}], 0x1}, 0x0) 431.448811ms ago: executing program 1 (id=2696): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x80, 0x0) close(r0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x3, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xb}, 0x100000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.memory_pressure\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x3e, &(0x7f00000002c0)=r1, 0x4) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000005c0)={{}, &(0x7f0000000440), &(0x7f0000000580)='%pi6 \x00'}, 0x20) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000600)={0x0, 0x9}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r2}, &(0x7f0000000240), &(0x7f0000000280)='%pS \x00'}, 0x20) 389.008691ms ago: executing program 0 (id=2697): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73f72cc9f0ba1f8483a0000005e1206021f1f00000e000a0010000000028000001294", 0x2e}], 0x1}, 0x4004850) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000380)=@bpf_tracing={0x1a, 0x1b, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000ffff0000000000000000000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000810000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000001000000850000008200000018120000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="00000000000000008510000002000000181100", @ANYRES32, @ANYBLOB="0000000000000000b70200000000000085000000860000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x1b, 0x49, &(0x7f0000000200)=""/73, 0x40f00, 0x2, '\x00', 0x0, 0x1a, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x4, 0x3}, 0x8, 0x10, &(0x7f0000000300)={0x2, 0xb, 0x1, 0xfffffff0}, 0x10, 0x2d052, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7f, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x4, 0x0, 0x0, 0x0, 0x200002009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000d80)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$ITER_CREATE(0xb, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x13, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000020000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000808500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000009b00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @sched_cls=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="aeaa000000000000711019000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x94) r5 = perf_event_open(&(0x7f00000012c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x28108, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x400000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r5, 0x40042408, r4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x0, 0xe, 0x0, &(0x7f0000000900)="928e04b416cac951c35f7f4586e6", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 310.474813ms ago: executing program 1 (id=2698): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x8000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x3, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0xb}, 0x100000, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x29, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7}, 0x40000) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x82, 0x5, 0x0, 0x0, 0x0, 0x0, 0x11, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x1, @perf_bp={0x0, 0xe}, 0x9034, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000000c0)={0x2, 0x80, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x0, 0x6, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000008c0)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x19, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0xc, '\x00', 0x0, @fallback=0x25}, 0x94) socketpair(0x1a, 0xa, 0x0, &(0x7f0000000000)) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, &(0x7f0000000000)=0x4b) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'veth1_virt_wifi\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x8946, &(0x7f0000000080)) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x1, 0x0, 0x4}, {0x6, 0x1, 0x0, 0x1}]}) r4 = socket$kcm(0x11, 0x200000000000002, 0x300) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x7, 0x4, 0x5}, 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e00000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000cc0)={{r5}, &(0x7f0000000c40), &(0x7f0000000c80)='%pB \x00'}, 0x20) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f0000000000)=r6, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688a24c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 188.323126ms ago: executing program 2 (id=2700): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)}, 0x20000018) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@generic={0x0}, 0x18) socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000b80)=ANY=[], 0xfe33) r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x8, 0x400, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, @perf_config_ext={0xffffffffffffff7f}, 0x111311, 0x1, 0x0, 0x1, 0x20000, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x18, 0x28, &(0x7f0000000dc0)=ANY=[@ANYBLOB="1800000091000000000000000100000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000030c0a00ffff00009b800400040000001853000002800000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001841000003000000000000000000000018120000", @ANYRES32, @ANYBLOB="0040000000000000b70300000000000085008000000000000000000000000000ac998120cf54f5f8a938125a00000000008500000085000000b7000000000000950000"], &(0x7f0000000080)='GPL\x00', 0x7, 0x0, 0x0, 0x41100, 0x5}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x5, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1600000000000000040000007fffffff00000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00ffffffe200"/26], 0x50) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0xd, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000021b81a000000004da6afd9f045135b23dca78d311f0000000000000000008500000039000000a0000000000000003ce51d6b49e2c8d92067372b47f98c2e1b184d906db6dc2f6c42543824aae56af95dfd2451f266c8c06df367b4c5c9e7d90adaf7a26fc309b1c85622ac1360dc4cef09a88b975707e4bd6bc8dbe02d2c0753803313127aa820196eb936a0d0bf16630655998d9c1550c1bc7654cfb3f8e2dfd3d393f1b98311a99d8827bb1765e8d9d9f9d1480c173f401db94a0e0d17e25f459e76"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) close(r3) socket$kcm(0x29, 0x5, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x200002, 0x0) bpf$MAP_DELETE_BATCH(0x1b, &(0x7f0000000340)={0x0, &(0x7f0000000200)=""/105, 0x0, &(0x7f0000000580)="bca13f58108937270789108abef62fc69699d33b5b5ef0def2fb77dbb117902c28122e2f2fb8ac793c47db676efd92aeacef4f223cdb490d7eaa0860b0f1abaaad5a58cd7e5855b48a7272e2854fda05f41a005d555f788cac0ce588812f48ec13a49b934fcfa64f4862f43adc0335ee9a202360de774f6123ff", 0x7, r3, 0x4}, 0x38) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup/syz1\x00', 0x200002, 0x0) perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10021, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, @perf_config_ext={0x6, 0xd}, 0x0, 0x80000, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x4861}, 0x0, 0x0, 0xffffffffffffffff, 0xb) ioctl$SIOCSIFHWADDR(r3, 0x8b1a, &(0x7f0000000000)={'wlan1\x00', @random="0000230c1100"}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)}], 0x1}, 0x4000000) socket$kcm(0x10, 0x2, 0x0) r4 = gettid() perf_event_open(&(0x7f0000000340)={0x1, 0x80, 0x10, 0x5, 0x0, 0x72, 0x0, 0x8, 0x4009, 0x3, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x2, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x9, 0x1, @perf_bp={&(0x7f0000000140), 0xa}, 0x200, 0x0, 0x4, 0x5, 0xfffffffffffffffb, 0x2, 0xfffd, 0x0, 0x7fff, 0x0, 0x6}, r4, 0xa, r1, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r5) getpid() 188.204646ms ago: executing program 3 (id=2701): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r0, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @multicast}) 0s ago: executing program 3 (id=2702): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000005640)={&(0x7f0000000c00)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0x1}}, 0x80, &(0x7f00000055c0)=[{&(0x7f0000000c80)="1cef0aa8867c5c5f699a73408efb7cc1061773efa9c3bf13f3a4db2d3a4b7fa69c7eeadf750e65a51cb176b1bed5cf5c40ea075e29a1bf8479b7929b1b83bf0280c5749427dc92ae36eeade83c28464bdf28ca04fbb258d1c83e6ab60b2ae0c445ffa3e3e38539bcdf526000f1497669d9b3f3a2e46971500ba10db63717a8cf48c1f92141abc3205c0118d33c543e213e7b472583ce69ff8267cdc756fe1b56bf6ae01e09fac60cec4a323444f0d4604bbf037c13ccdb78b7bc8ce426", 0xbd}, {&(0x7f0000000d40)="046523533dca9278cff45ee010582f9354fc4232d588531d11ad92dc536080d4f9df66ca9f669426f15efc38fd6c6a3c5d6464a64cef86a3b2b50cd155814792cc1b533842e6990ba439194b661cffa64740c8b05670c3fda1ee3032080b369a53e3d6391f6170a67a62f7c4c90587970d2e3d8ebd85a0a9e0d17bf6ea15c518d6027d6bf00f3af370284bb568c84d0a2f23e67f355853cc882bdf4be457322781490fac466355bd9a0d09d670c4f868ed536b4f4f0ce3262586bda44b9a13856e372076664c0a653ecf620bea1f728915", 0xd1}, {&(0x7f0000000e40)="d03188a3e0330431d266773307f9d9e4ba8a7f52c5052e377d7fb09ee2b3e045865abb15f6be1576b399d50ce80a069064a85c6d66499cca4b40", 0x3a}, {&(0x7f0000000e80)="ba382cbaab16ec6b535daf667b7bbd6d87664dbcd62e198521035a61174129", 0x1f}, {&(0x7f00000054c0)}, {&(0x7f0000005540)="f1c6a93b2de974c5a6325d117d7421016661fa8f0960b102c834de1a956497f3a5a425d86b244201d363c3e0294e992c0d38663b660c894499ad5a9e4a4bb344a842", 0x42}], 0x6}, 0x40100) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0xa1, &(0x7f0000001240)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x11, 0xc, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000004b000000850000007dcd4d00180100002020702500000000002020207b1af8ff00010000bfa100000000000007010000f8ffffffb702000008000000b703000006000000850000002d00000095000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r1}, 0xc) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c31, 0x410, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe49, 0x2, @perf_bp={0x0}, 0x100c, 0x0, 0x0, 0x0, 0x0, 0x4, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x4}}, 0x0, 0x9, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r2, &(0x7f0000003a80)={&(0x7f00000004c0)={0x2, 0x0, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1}}}], 0x20}, 0x4008804) sendmsg$inet(r2, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e20, @remote}, 0x10, &(0x7f0000000280)=[{&(0x7f0000000640)="a1cac048decc07180339b0435d79ad4fa65e0858f1ae5129d4c6330073058c379b25fcf1a5fcbf4d37e52c640ded5f6babd6e1236971bf9779dd0690fe23781239f8d0e9e684cf633ab1c17ab47d8b0abbd6d1493c551a2e62109ad8595680fca04ade38176eeacb6fdcfd049dd041e42c54b9a4774c4ea5c228a16441eff7204d1b2ea7fe947c77c1686f74ae296f50b0eaad946c62e984e70db2f24f34279d48b7d3127cddb5656fcfa451e9da5cd44a3a2423cc46e28824e46c475ec172539e26e2e4a111f50ac9117d214d731a36ad05bd346ab2d5b1d483f1414a89c50836e3ae5532acd125f9237b851f9f6d879490f9a91d51052abd28a6be1394dcbdd6794013e96b94f2321135eef96e81bfe20e7ea0b68fc5755e7d31beb0283e21499d8fcd83f514a8a6eea618ec21120ef062cc0017a73204e33702fde7e1d3fe010f895a8ade4de79ffa763dd069d3af78cf49a32719099b16510a416b47fa0bebaaa1726f60ccc19bfdd9f0bdafa74517eace278604079136310609e34a7519e840af9acb923e74f932eb88aab4a7c49c479e5be61086e77140f94015a8e7e9985ae8822bb2b06c5badadae50f0efb849a2227f0e8b6112c7fa63f7609fb3902acc6544ba14925ad235bc7d16b90854dd5bea48d9687f4474cf4d9f39b8d0a54b06ac6cbdfb18a33d3eb9de47a3b9acbecb8eef97335c7f55e97bd4cc89c020a1a618859e8d8980b4fadcebe26ad234d0777d4b7c6c4f1b11c45530ab78e2100945452978fc8cc349fe919b8b4fb53a594f3f10201e1d3146ad706109649e4ff2e59354ebfbe6f068a72a9b18215efa0e7a6f4bd73e715fc73618972aff440c3ba526309f3866043f731ab8a9e455ef0b5684976dac37b8f7686be3ec322056e452b5cdda7a10415ce148af5df96fecb10228fa0994c9d25702fb894634661f26dcfed8809ee0a409ccab1325665c1524a4ebe533fef9ab39ca29fb2cb64dd20ba9fcdf2f3c7716847ff88cb601000000000000e2e10e6745422f770e9e5c9aa8634857e5d43eff8a76228e0556f99f848cac1a587664c1ea7c46374d4c1d7b142d403c1906840c6a027ee837b50da72e549867b9c52ad138880c59c997d0410375c96625d841995575e722768e0106f5768da4ebea4f2bea2ce333ad81597f4bd7708c833a54cb3604e1da14de5573d2e326dedeb0041cd416fc5d48ea47571e89ff8eeb45c505f0c1e035e830290235e16439c57bf53c7e7f8603243dd7870040457e06ef6c19c676082272b1a77ed41548ca758068b75a49025bbd4e5b3cecc8a95afeedcbcccf3ee3cf874843ef79b0bb4cc01f9856e2da367fc39e35a5b84cbef5804a5004eda41123071760ef447b09c9a0cb395007429fd25df4b5d339c25ff919121571298ca491f6de0c3474f586ccde072988342bc952a29d97fa6b9c3301cab65e01ff242d21e5a705fd3fe0f0a874b431babaf36ea0805830273de0f97a81c08ec89827c0e9f3643686be8a5cc0f80efd176c2fef7653eaec4ecedf0ce860b99dca23e4b4d9662d184ad9c607c0e0baaab5b2d8ad63d4fff719ea69c46b6731b917b002dfc81a1e18cf9bd57bfa3a60d6ca45f28caeca4133487a0adc36513e3e3b0f1b1253d97830d74051659d2420b3c736d7118610009a64676933c65b71d05f84e41b7d1b491d9aacb1276ab65b1480986f4d9302e7d50ececc557e95a0e15a842623d8cafc92df63198e41fc3de42ba1b802476c5987fd56286e4541fa48e344b10d953250f18b99414aa5b7fb33cbf3c3eb69176db2d3d9f71504e8324d7525ad8310f634485130aeb7c23ce650d032fb76ef282bfb51e46eb7b2affa1e0f2d1f8b39b1b2463978872c0aed7fa5c2db88e906d0f710365e468d0d99ce166f30fff8987439fa35456ff36e78fbe838824d21a419115b3101f7e142468b16e00e44ec24ad339a1063717c2d4bb152228a963869412309cb77985c228d9901fb543bd4b64cb167681ab0d136a9d51ff6c7867c286a1f42c893ac59c40847ccd4a0f1ef57b7a8", 0x5ae}], 0x1}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xe, 0x4, 0x4, 0xa}, 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r3, &(0x7f0000000300)="989f", &(0x7f00000005c0)=""/104}, 0x20) recvmsg(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/4096, 0x1000}], 0x1}, 0x40010040) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)}], 0x1}, 0x4000000) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000140)={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000200)}, 0x0) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) sendmsg$kcm(r4, &(0x7f0000004480)={0x0, 0x0, &(0x7f0000000780)=[{0x0}], 0x1, &(0x7f00000032c0)=[{0x10, 0x119, 0x8000}, {0x410, 0x88, 0x2, "b3cb1ead501ef31f73b48227a1e9c1e1126c392ec4aac0ed1a54f4398ee08e3f6066dc334f989422e89f23315eddd6d38e40563891fb1c39f9df8e2720ae3fb13a4c5209dac94f4692bca071212e649d9f98b228e5fb9e71240ab1b1181a3ee6dfe267e4f63ef4e9a23e82ee1e4a20286f8ebfbfccdec6e3a0530a15e55acb16d3db51055a8960dc25ba80978b565f952978ef9342f07071e03eb549263ec411fd307cfee6b5f36b6da00bdb086356af0da632b1c23b411391fe21581a5e76187eb39814aef2cd45ad6d22689625a3b458a72d3c063194754a32137434322ec06faa1a978b326fb189f4a3adfa680f528472a9e91650cdf68aebc89eda8212e094fba6f85af9ceb41f8889150be7a49a798850d45ede1954f8a471b6586f0be43c809f4d7526e57e65aadf394d062aa98feba77f7178983429fa7aff42edc83ad80c632238c2fd9a5e3e6f98bc7cdf893306c9c3a99be4c8fbbadd5a5fc1218d5f46960e918b7e830984d66fe8c3e0db1dc7b380e168bf15a2a0963fedabee59cb8fb643ae7f205fbfda1b9bd0cea098a3ce2825a139dc92397c5ddf4e38f7bc25d1dbbf4a092ef193eb39a17515ae4b7bd95e150ced2f0f1dc08d480629c137c17ab5e384118670a8717b90da4a5505e3cbd5453901974b08cdfad49a84906ed850615434edca5faba734e5ae5b322b2418dbee691cd6377ea8814ff2e96a8f75d4a6845f8555c4b5c08981ac3239a0580285dab8acc45e79fcc5f22bbe7d106988f1746bc71e0dc9d82688265f2dc43207045dfba6c282dcc9d803c38dc124ba9127361b1db7e4328b3f671f98ed5c5eaa21075d6242ec520d303255f1e9935451b419e29dbb577c7ee17e4421a234fa98755bb9517998d8febd645076024041fafb0319768aa7b4c5d2f51cc37e7d9921c8483ecbb81a3e4e023b4a107fdae4f5d803eff07f6e4ed9ed7f0db3d69654d7fac0bae87b52fb459c51bcb3fc8d2de3bd555401d6d24d9faeac92265130c6803981c24bf527c4b38761eaa56029e034d130cf99debc058964862afa19b9e7c8e4a445a45faa9d61f15a23736c2f5ca016c1a35d8844d78a8389b348987835a88668c0a199e7c2d619a4e0224ab853f11733cc85f172cc9c655b17ce73d6b796c4f8a5ff3d693fdc4c5abb541f9d6e4c9e8f906b584b767f77d36cd3e04696647a3e87e91441cffb291ae93178815704a37c002c166275db233c1afa8c621ba42512f8fbf2b4fbee3539ee4f05deb49ae5eb819ed0de43b7370b6b7b1f922ce9796d7bb2aab3a22fc514e3e5fe5789fd44000a3c651758aee7beb7299ab2e1adb8829fd4b97b292b344d402e4136ddeae68c4c396c85d6d1b484149c8f1a55e1649fbd13167873e4df9c57817f1dc07dc4e700e3abb502df4e572f8a3d04f8095a7269ac2b17386368b3bf21b63f"}, {0xb0, 0x0, 0x9, "2acd7edb86a049a9c0cb5a802e09f388840a182f1e7e7f679efa89a17a8c6b97b834c3cd993ba79c5ed25cbdf7ba281ba906e214ceacaa30d8e56c3d8dda2dce51523581b50667bd105dcf666ba2ef2717f33a93cb96e7f3cdc8fda673ac82ad176cc1c2d00b026702401cd3afd7d5a963039f7a9368dbe5956de308720378dad67ec7930281b5861bcbeb3aff7e20e8e16ef0affbc37bd949ff4a4482a1a3"}, {0x30, 0x1, 0x0, "6d252e1499101611bb376f6f613529c035b09c8b6523e5503cc5f1"}], 0x500}, 0x40000) close(r4) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_lsm={0x18, 0x5, &(0x7f0000000ec0)=ANY=[@ANYBLOB], 0x0, 0x1, 0xd8, &(0x7f0000000300)=""/216, 0x0, 0x1}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x24}, 0x94) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r6 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8916, &(0x7f0000000040)={'bond_slave_1\x00', @random="0200"}) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000340)={0x3}, 0x8) kernel console output (not intermixed with test programs): invalid length. [ 443.062014][T10719] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1750'. [ 443.110078][T10717] syz.1.1749 (10717) used greatest stack depth: 17320 bytes left [ 443.192553][T10725] netlink: 'syz.3.1751': attribute type 15 has an invalid length. [ 443.216643][T10725] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1751'. [ 443.239183][T10721] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 443.266402][T10726] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 443.284235][T10729] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 443.299991][T10729] syzkaller1: linktype set to 773 [ 443.597094][T10739] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1754'. [ 443.994397][T10741] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1755'. [ 446.854245][T10758] netlink: 'syz.0.1761': attribute type 15 has an invalid length. [ 446.868455][T10758] __nla_validate_parse: 4 callbacks suppressed [ 446.868473][T10758] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1761'. [ 447.026417][T10760] netlink: 'syz.2.1762': attribute type 10 has an invalid length. [ 447.057937][T10758] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 447.136724][T10758] netlink: 16098 bytes leftover after parsing attributes in process `syz.0.1761'. [ 447.481922][T10765] netlink: 'syz.3.1763': attribute type 15 has an invalid length. [ 447.514999][T10765] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1763'. [ 447.697655][T10765] netlink: 16098 bytes leftover after parsing attributes in process `syz.3.1763'. [ 448.522558][T10768] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1764'. [ 448.532621][T10768] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1764'. [ 448.545376][T10768] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1764'. [ 448.557285][T10768] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1764'. [ 448.704681][T10776] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1765'. [ 448.751542][T10778] netlink: 'syz.3.1770': attribute type 10 has an invalid length. [ 448.770171][T10779] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.1769'. [ 449.700374][T10787] netlink: 'syz.3.1774': attribute type 15 has an invalid length. [ 449.850588][T10787] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 451.469367][T10807] netlink: 'syz.1.1789': attribute type 15 has an invalid length. [ 451.477596][T10808] netlink: 'syz.2.1781': attribute type 15 has an invalid length. [ 451.581545][T10807] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 451.603697][T10808] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 452.060294][T10815] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 452.068466][T10815] syzkaller1: linktype set to 773 [ 452.452368][T10823] __nla_validate_parse: 14 callbacks suppressed [ 452.452392][T10823] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1786'. [ 452.468679][T10823] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1786'. [ 452.480317][T10823] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1786'. [ 452.490680][T10823] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1786'. [ 452.753855][T10829] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1788'. [ 452.765694][T10829] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1788'. [ 452.778942][T10829] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1788'. [ 452.790862][T10829] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1788'. [ 452.953338][T10833] netlink: 'syz.2.1791': attribute type 10 has an invalid length. [ 453.761019][T10835] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.1792'. [ 453.796300][T10839] netlink: 'syz.0.1794': attribute type 15 has an invalid length. [ 453.819432][T10839] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1794'. [ 453.914218][T10839] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 454.032363][T10847] netlink: 'syz.3.1797': attribute type 15 has an invalid length. [ 454.128741][T10847] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 454.208486][T10853] netlink: 'syz.0.1799': attribute type 15 has an invalid length. [ 454.476745][T10858] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 456.212399][T10873] netlink: 'syz.0.1808': attribute type 15 has an invalid length. [ 456.405262][T10879] netlink: 'syz.1.1811': attribute type 15 has an invalid length. [ 456.487115][T10876] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 456.510334][T10876] syzkaller1: linktype set to 773 [ 456.672424][T10879] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 457.632544][T10887] __nla_validate_parse: 19 callbacks suppressed [ 457.632569][T10887] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.1815'. [ 457.659753][T10889] netlink: 'syz.2.1814': attribute type 15 has an invalid length. [ 457.667662][T10889] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1814'. [ 457.877415][T10889] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 459.065126][T10893] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1816'. [ 459.075267][T10893] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1816'. [ 459.100170][T10893] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1816'. [ 459.139892][T10893] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1816'. [ 459.290631][T10900] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1819'. [ 459.334011][T10904] netlink: 'syz.2.1818': attribute type 15 has an invalid length. [ 459.349384][T10904] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1818'. [ 459.432026][T10906] netlink: 'syz.1.1821': attribute type 15 has an invalid length. [ 459.444503][T10906] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1821'. [ 459.474048][T10904] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 459.608753][T10910] netlink: 'syz.2.1823': attribute type 15 has an invalid length. [ 459.618362][T10910] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1823'. [ 459.685791][T10910] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 461.832525][T10929] netlink: 'syz.2.1832': attribute type 15 has an invalid length. [ 462.795180][T10943] __nla_validate_parse: 8 callbacks suppressed [ 462.795202][T10943] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1837'. [ 462.811720][T10943] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1837'. [ 462.826692][T10943] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1837'. [ 462.837123][T10943] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1837'. [ 463.042033][T10945] mac80211_hwsim hwsim3 wlan1: entered promiscuous mode [ 463.057920][T10945] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 463.273398][T10956] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.1843'. [ 463.320236][T10958] netlink: 'syz.2.1844': attribute type 15 has an invalid length. [ 463.346721][T10958] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1844'. [ 463.455632][T10962] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.1845'. [ 463.543464][T10965] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 464.777854][T10968] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.1846'. [ 465.173361][T10982] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1852'. [ 465.192219][T10984] netlink: 'syz.0.1853': attribute type 15 has an invalid length. [ 465.200678][T10984] netlink: 168 bytes leftover after parsing attributes in process `syz.0.1853'. [ 465.269935][T10984] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 466.617727][T10993] netlink: 'syz.0.1856': attribute type 15 has an invalid length. [ 466.819981][T10997] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 468.458386][T11020] netlink: 'syz.3.1866': attribute type 15 has an invalid length. [ 468.467834][T11020] __nla_validate_parse: 4 callbacks suppressed [ 468.467851][T11020] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1866'. [ 468.597800][T11020] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 469.795328][T11026] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.1867'. [ 469.959692][T11029] netlink: 'syz.2.1868': attribute type 4 has an invalid length. [ 469.967924][T11029] netlink: 194500 bytes leftover after parsing attributes in process `syz.2.1868'. [ 470.873195][T11031] netlink: 'syz.1.1871': attribute type 15 has an invalid length. [ 470.883969][T11031] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1871'. [ 470.973273][T11031] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 471.075614][T11035] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.1870'. [ 471.552077][T11044] netlink: 'syz.1.1877': attribute type 10 has an invalid length. [ 472.640316][T11056] netlink: 'syz.1.1880': attribute type 15 has an invalid length. [ 472.648487][T11056] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1880'. [ 472.702294][T11059] netlink: 'syz.3.1881': attribute type 4 has an invalid length. [ 472.717122][T11058] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1888'. [ 472.744802][T11059] netlink: 194500 bytes leftover after parsing attributes in process `syz.3.1881'. [ 472.762481][T11058] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1888'. [ 472.790712][T11056] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 472.833832][T11058] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1888'. [ 473.096955][T11064] netlink: 'syz.2.1883': attribute type 15 has an invalid length. [ 473.171497][T11064] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 474.716619][T11075] netlink: 'syz.2.1887': attribute type 10 has an invalid length. [ 474.748042][T11073] delete_channel: no stack [ 476.175985][T11087] __nla_validate_parse: 2 callbacks suppressed [ 476.176006][T11087] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 476.209534][T11087] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 476.234453][T11087] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 476.262759][T11087] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1891'. [ 476.544193][T11097] netlink: 'syz.3.1896': attribute type 15 has an invalid length. [ 476.552722][T11097] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1896'. [ 476.712106][T11103] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 478.558152][T11114] netlink: 'syz.0.1900': attribute type 10 has an invalid length. [ 478.607478][T11111] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.1898'. [ 478.659738][T11110] delete_channel: no stack [ 480.410439][T11128] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1906'. [ 480.529486][T11134] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1908'. [ 480.796925][T11139] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.1917'. [ 482.072132][T11150] netlink: 'syz.2.1910': attribute type 21 has an invalid length. [ 482.085649][T11150] netlink: 'syz.2.1910': attribute type 12 has an invalid length. [ 482.126649][T11150] netlink: 'syz.2.1910': attribute type 13 has an invalid length. [ 482.151950][T11150] netlink: 'syz.2.1910': attribute type 14 has an invalid length. [ 482.189874][T11151] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.1913'. [ 482.199858][T11150] netlink: 'syz.2.1910': attribute type 15 has an invalid length. [ 482.216399][T11150] netlink: 'syz.2.1910': attribute type 16 has an invalid length. [ 482.228957][T11150] netlink: 'syz.2.1910': attribute type 19 has an invalid length. [ 482.237486][T11150] netlink: 'syz.2.1910': attribute type 21 has an invalid length. [ 482.245830][T11150] netlink: 'syz.2.1910': attribute type 22 has an invalid length. [ 482.254710][T11150] netlink: 12226 bytes leftover after parsing attributes in process `syz.2.1910'. [ 482.569705][T11165] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1918'. [ 482.611218][T11166] netlink: 'syz.3.1919': attribute type 10 has an invalid length. [ 484.058177][T11170] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.1920'. [ 485.707135][T11186] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1926'. [ 485.716841][T11186] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1926'. [ 485.727282][T11186] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1926'. [ 485.737546][T11186] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1926'. [ 485.961016][T11191] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1928'. [ 486.076604][T11191] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 486.453445][T11200] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.1931'. [ 487.734755][T11216] __nla_validate_parse: 3 callbacks suppressed [ 487.734775][T11216] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1937'. [ 487.750892][T11216] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1937'. [ 487.761293][T11216] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1937'. [ 487.771724][T11216] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1937'. [ 489.242465][T11226] validate_nla: 5 callbacks suppressed [ 489.242486][T11226] netlink: 'syz.2.1942': attribute type 10 has an invalid length. [ 489.484950][T11235] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.1943'. [ 489.563333][T11237] raw_sendmsg: syz.1.1945 forgot to set AF_INET. Fix it! [ 489.658445][T11240] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1946'. [ 489.670054][T11240] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1946'. [ 489.687129][T11240] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1946'. [ 489.699435][T11240] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1946'. [ 490.933979][T11249] netlink: 'syz.2.1950': attribute type 15 has an invalid length. [ 490.945126][T11249] netlink: 'syz.2.1950': attribute type 7 has an invalid length. [ 491.971234][T11266] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1955'. [ 492.271263][T11272] FAULT_INJECTION: forcing a failure. [ 492.271263][T11272] name failslab, interval 1, probability 0, space 0, times 0 [ 492.285419][T11272] CPU: 1 PID: 11272 Comm: syz.2.1957 Not tainted syzkaller #0 [ 492.292958][T11272] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 492.303331][T11272] Call Trace: [ 492.306661][T11272] [ 492.309734][T11272] dump_stack_lvl+0x18c/0x250 [ 492.314495][T11272] ? show_regs_print_info+0x20/0x20 [ 492.319766][T11272] ? load_image+0x420/0x420 [ 492.324337][T11272] ? __might_sleep+0xe0/0xe0 [ 492.329160][T11272] ? __lock_acquire+0x7d80/0x7d80 [ 492.334243][T11272] should_fail_ex+0x394/0x4c0 [ 492.338985][T11272] should_failslab+0x9/0x20 [ 492.343646][T11272] slab_pre_alloc_hook+0x59/0x300 [ 492.348748][T11272] ? __lock_acquire+0x7d80/0x7d80 [ 492.353835][T11272] kmem_cache_alloc_node+0x5e/0x310 [ 492.359105][T11272] ? __alloc_skb+0x103/0x2c0 [ 492.363948][T11272] __alloc_skb+0x103/0x2c0 [ 492.368434][T11272] netlink_sendmsg+0x66a/0xbf0 [ 492.373287][T11272] ? netlink_getsockopt+0x590/0x590 [ 492.378556][T11272] ? aa_sock_msg_perm+0x94/0x150 [ 492.383552][T11272] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 492.388991][T11272] ? security_socket_sendmsg+0x80/0xa0 [ 492.394522][T11272] ? netlink_getsockopt+0x590/0x590 [ 492.399779][T11272] ____sys_sendmsg+0x61b/0x980 [ 492.404618][T11272] ? __asan_memset+0x22/0x40 [ 492.409269][T11272] ? __sys_sendmsg_sock+0x30/0x30 [ 492.414347][T11272] ? __import_iovec+0x5f2/0x850 [ 492.419357][T11272] ? import_iovec+0x73/0xa0 [ 492.423919][T11272] ___sys_sendmsg+0x2a6/0x360 [ 492.428657][T11272] ? get_pid_task+0x20/0x1e0 [ 492.433336][T11272] ? __sys_sendmsg+0x2b0/0x2b0 [ 492.438217][T11272] ? __lock_acquire+0x7d80/0x7d80 [ 492.443325][T11272] __se_sys_sendmsg+0x1d0/0x2c0 [ 492.448241][T11272] ? __x64_sys_sendmsg+0x80/0x80 [ 492.453266][T11272] ? lockdep_hardirqs_on+0x98/0x150 [ 492.458531][T11272] do_syscall_64+0x55/0xb0 [ 492.463096][T11272] ? clear_bhb_loop+0x40/0x90 [ 492.468082][T11272] ? clear_bhb_loop+0x40/0x90 [ 492.472806][T11272] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 492.478941][T11272] RIP: 0033:0x7fb20519de59 [ 492.483409][T11272] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.503252][T11272] RSP: 002b:00007fb206117028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 492.511723][T11272] RAX: ffffffffffffffda RBX: 00007fb205426180 RCX: 00007fb20519de59 [ 492.519929][T11272] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000009 [ 492.527979][T11272] RBP: 00007fb206117090 R08: 0000000000000000 R09: 0000000000000000 [ 492.536000][T11272] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 492.544027][T11272] R13: 00007fb205426218 R14: 00007fb205426180 R15: 00007ffc66eb22c8 [ 492.552072][T11272] [ 496.194032][T11275] netlink: 'syz.1.1958': attribute type 10 has an invalid length. [ 496.202249][T11280] netlink: 'syz.2.1960': attribute type 10 has an invalid length. [ 496.370030][T11284] __nla_validate_parse: 3 callbacks suppressed [ 496.370053][T11284] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.1961'. [ 496.461589][T11292] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1964'. [ 496.471344][T11292] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1964'. [ 496.483705][T11292] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1964'. [ 496.494539][T11292] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1964'. [ 496.519636][T11290] netlink: 164 bytes leftover after parsing attributes in process `syz.3.1963'. [ 496.827085][T11303] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.1968'. [ 498.023618][T11294] sit0: left promiscuous mode [ 498.195226][T11306] netlink: 'syz.3.1969': attribute type 15 has an invalid length. [ 498.213874][T11306] netlink: 168 bytes leftover after parsing attributes in process `syz.3.1969'. [ 498.361964][T11310] netlink: 'syz.1.1971': attribute type 10 has an invalid length. [ 498.395949][T11306] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 498.678629][T11320] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1975'. [ 498.689785][T11320] netlink: 60 bytes leftover after parsing attributes in process `syz.2.1975'. [ 498.834064][T11323] netlink: 'syz.2.1976': attribute type 15 has an invalid length. [ 500.088390][T11334] FAULT_INJECTION: forcing a failure. [ 500.088390][T11334] name failslab, interval 1, probability 0, space 0, times 0 [ 500.116815][T11334] CPU: 0 PID: 11334 Comm: syz.0.1980 Not tainted syzkaller #0 [ 500.124568][T11334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 500.134874][T11334] Call Trace: [ 500.138247][T11334] [ 500.141345][T11334] dump_stack_lvl+0x18c/0x250 [ 500.146100][T11334] ? show_regs_print_info+0x20/0x20 [ 500.151372][T11334] ? load_image+0x420/0x420 [ 500.155958][T11334] ? __might_sleep+0xe0/0xe0 [ 500.160708][T11334] ? __lock_acquire+0x7d80/0x7d80 [ 500.165816][T11334] should_fail_ex+0x394/0x4c0 [ 500.170582][T11334] should_failslab+0x9/0x20 [ 500.175196][T11334] slab_pre_alloc_hook+0x59/0x300 [ 500.180396][T11334] ? __get_vm_area_node+0x125/0x370 [ 500.185659][T11334] __kmem_cache_alloc_node+0x53/0x250 [ 500.191180][T11334] ? trace_call_bpf+0x5e9/0x6c0 [ 500.196081][T11334] ? __get_vm_area_node+0x125/0x370 [ 500.201341][T11334] kmalloc_node_trace+0x26/0xe0 [ 500.206279][T11334] __get_vm_area_node+0x125/0x370 [ 500.211370][T11334] __vmalloc_node_range+0x36f/0x1320 [ 500.216748][T11334] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 500.222332][T11334] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 500.228201][T11334] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 500.234247][T11334] ? lock_chain_count+0x20/0x20 [ 500.239160][T11334] ? aa_get_newest_label+0xfd/0x5c0 [ 500.244400][T11334] ? free_vm_area+0x50/0x50 [ 500.248946][T11334] ? end_current_label_crit_section+0x170/0x170 [ 500.255226][T11334] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 500.260813][T11334] __vmalloc+0x7a/0x90 [ 500.264929][T11334] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 500.270519][T11334] bpf_prog_alloc_no_stats+0x46/0x430 [ 500.275940][T11334] bpf_prog_alloc+0x3d/0x1a0 [ 500.280570][T11334] bpf_prog_load+0x6b2/0x1610 [ 500.285333][T11334] ? perf_trace_preemptirq_template+0x269/0x330 [ 500.291652][T11334] ? map_freeze+0x420/0x420 [ 500.296211][T11334] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 500.302415][T11334] ? lockdep_hardirqs_on+0x98/0x150 [ 500.307660][T11334] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 500.313860][T11334] ? __sys_bpf+0x5a5/0x890 [ 500.318316][T11334] __sys_bpf+0x5ba/0x890 [ 500.322602][T11334] ? bpf_link_show_fdinfo+0x390/0x390 [ 500.328022][T11334] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 500.334228][T11334] __x64_sys_bpf+0x7c/0x90 [ 500.338685][T11334] do_syscall_64+0x55/0xb0 [ 500.343158][T11334] ? clear_bhb_loop+0x40/0x90 [ 500.347958][T11334] ? clear_bhb_loop+0x40/0x90 [ 500.352668][T11334] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 500.358686][T11334] RIP: 0033:0x7f60b6d9de59 [ 500.363177][T11334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.382915][T11334] RSP: 002b:00007f60b7c9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 500.391377][T11334] RAX: ffffffffffffffda RBX: 00007f60b7025fa0 RCX: 00007f60b6d9de59 [ 500.399383][T11334] RDX: 0000000000000094 RSI: 0000200000000580 RDI: 0000000000000005 [ 500.407385][T11334] RBP: 00007f60b7c9d090 R08: 0000000000000000 R09: 0000000000000000 [ 500.415386][T11334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.423393][T11334] R13: 00007f60b7026038 R14: 00007f60b7025fa0 R15: 00007ffd0ba3de38 [ 500.431454][T11334] [ 500.481563][T11334] syz.0.1980: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 500.501138][T11334] CPU: 0 PID: 11334 Comm: syz.0.1980 Not tainted syzkaller #0 [ 500.508691][T11334] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 500.518815][T11334] Call Trace: [ 500.522149][T11334] [ 500.525125][T11334] dump_stack_lvl+0x18c/0x250 [ 500.529878][T11334] ? show_regs_print_info+0x20/0x20 [ 500.535153][T11334] ? load_image+0x420/0x420 [ 500.539734][T11334] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 500.546228][T11334] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 500.552822][T11334] warn_alloc+0x246/0x340 [ 500.557262][T11334] ? __get_vm_area_node+0x125/0x370 [ 500.562537][T11334] ? zone_watermark_ok_safe+0x230/0x230 [ 500.568161][T11334] ? rcu_is_watching+0x15/0xb0 [ 500.573002][T11334] ? __get_vm_area_node+0x356/0x370 [ 500.578284][T11334] __vmalloc_node_range+0x394/0x1320 [ 500.583641][T11334] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 500.589536][T11334] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 500.595592][T11334] ? lock_chain_count+0x20/0x20 [ 500.600619][T11334] ? aa_get_newest_label+0xfd/0x5c0 [ 500.605897][T11334] ? free_vm_area+0x50/0x50 [ 500.610482][T11334] ? end_current_label_crit_section+0x170/0x170 [ 500.616796][T11334] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 500.622494][T11334] __vmalloc+0x7a/0x90 [ 500.626679][T11334] ? bpf_prog_alloc_no_stats+0x46/0x430 [ 500.632308][T11334] bpf_prog_alloc_no_stats+0x46/0x430 [ 500.637757][T11334] bpf_prog_alloc+0x3d/0x1a0 [ 500.642523][T11334] bpf_prog_load+0x6b2/0x1610 [ 500.647276][T11334] ? perf_trace_preemptirq_template+0x269/0x330 [ 500.653603][T11334] ? map_freeze+0x420/0x420 [ 500.658183][T11334] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 500.664511][T11334] ? lockdep_hardirqs_on+0x98/0x150 [ 500.669780][T11334] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 500.676026][T11334] ? __sys_bpf+0x5a5/0x890 [ 500.680521][T11334] __sys_bpf+0x5ba/0x890 [ 500.684833][T11334] ? bpf_link_show_fdinfo+0x390/0x390 [ 500.690277][T11334] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 500.696511][T11334] __x64_sys_bpf+0x7c/0x90 [ 500.700989][T11334] do_syscall_64+0x55/0xb0 [ 500.705475][T11334] ? clear_bhb_loop+0x40/0x90 [ 500.710210][T11334] ? clear_bhb_loop+0x40/0x90 [ 500.714960][T11334] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 500.720979][T11334] RIP: 0033:0x7f60b6d9de59 [ 500.725440][T11334] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 500.745096][T11334] RSP: 002b:00007f60b7c9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 500.753564][T11334] RAX: ffffffffffffffda RBX: 00007f60b7025fa0 RCX: 00007f60b6d9de59 [ 500.761577][T11334] RDX: 0000000000000094 RSI: 0000200000000580 RDI: 0000000000000005 [ 500.769619][T11334] RBP: 00007f60b7c9d090 R08: 0000000000000000 R09: 0000000000000000 [ 500.777632][T11334] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 500.785640][T11334] R13: 00007f60b7026038 R14: 00007f60b7025fa0 R15: 00007ffd0ba3de38 [ 500.793707][T11334] [ 500.847663][T11334] Mem-Info: [ 500.856499][T11334] active_anon:5547 inactive_anon:0 isolated_anon:0 [ 500.856499][T11334] active_file:12974 inactive_file:40107 isolated_file:0 [ 500.856499][T11334] unevictable:768 dirty:141 writeback:0 [ 500.856499][T11334] slab_reclaimable:10050 slab_unreclaimable:91829 [ 500.856499][T11334] mapped:25115 shmem:1361 pagetables:547 [ 500.856499][T11334] sec_pagetables:0 bounce:0 [ 500.856499][T11334] kernel_misc_reclaimable:0 [ 500.856499][T11334] free:1359802 free_pcp:8182 free_cma:0 [ 500.909388][T11334] Node 0 active_anon:22188kB inactive_anon:0kB active_file:51896kB inactive_file:160224kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:100460kB dirty:564kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:10208kB pagetables:2188kB sec_pagetables:0kB all_unreclaimable? no [ 500.949278][T11334] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 500.980771][T11334] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 501.009394][T11334] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 501.015761][T11334] Node 0 DMA32 free:1530932kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:22144kB inactive_anon:0kB active_file:51896kB inactive_file:159400kB unevictable:1536kB writepending:564kB present:3129332kB managed:2586848kB mlocked:0kB bounce:0kB free_pcp:11448kB local_pcp:2052kB free_cma:0kB [ 501.053898][T11334] lowmem_reserve[]: 0 0 0 0 0 [ 501.059895][T11334] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:44kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 501.087727][T11334] lowmem_reserve[]: 0 0 0 0 0 [ 501.093429][T11334] Node 1 Normal free:3892912kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:21280kB local_pcp:13856kB free_cma:0kB [ 501.123978][T11334] lowmem_reserve[]: 0 0 0 0 0 [ 501.130341][T11334] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 501.144716][T11334] Node 0 DMA32: 1603*4kB (UME) 1461*8kB (UME) 848*16kB (UME) 838*32kB (UME) 239*64kB (UME) 8*128kB (UME) 20*256kB (UM) 10*512kB (M) 4*1024kB (UME) 4*2048kB (UME) 350*4096kB (UM) = 1530932kB [ 501.168785][T11334] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 501.183994][T11334] Node 1 Normal: 296*4kB (UM) 72*8kB (UME) 59*16kB (UME) 137*32kB (UME) 32*64kB (UME) 8*128kB (UME) 1*256kB (M) 1*512kB (E) 1*1024kB (E) 1*2048kB (E) 947*4096kB (M) = 3892912kB [ 501.204028][T11334] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 501.214395][T11334] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 501.224667][T11334] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 501.235729][T11334] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 501.246040][T11334] 54442 total pagecache pages [ 501.251320][T11334] 0 pages in swap cache [ 501.255662][T11334] Free swap = 124996kB [ 501.263594][T11334] Total swap = 124996kB [ 501.268224][T11334] 2097051 pages RAM [ 501.274367][T11334] 0 pages HighMem/MovableOnly [ 501.279909][T11334] 416953 pages reserved [ 501.284320][T11334] 0 pages cma reserved [ 501.829607][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.835991][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.034681][T11348] __nla_validate_parse: 7 callbacks suppressed [ 502.034702][T11348] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1984'. [ 502.051885][T11348] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1984'. [ 502.062992][T11348] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1984'. [ 502.073361][T11348] netlink: 60 bytes leftover after parsing attributes in process `syz.1.1984'. [ 502.105846][T11349] netlink: 'syz.0.1985': attribute type 10 has an invalid length. [ 502.185154][T11352] netlink: 'syz.2.1987': attribute type 15 has an invalid length. [ 502.194839][T11352] netlink: 168 bytes leftover after parsing attributes in process `syz.2.1987'. [ 502.212962][T11353] netlink: 'syz.3.1986': attribute type 10 has an invalid length. [ 502.390512][T11356] netlink: 'syz.1.1988': attribute type 15 has an invalid length. [ 502.414282][T11356] netlink: 168 bytes leftover after parsing attributes in process `syz.1.1988'. [ 502.593507][T11359] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 503.792896][T11361] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.1989'. [ 503.836640][T11363] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.1990'. [ 504.000434][T11371] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.1992'. [ 505.393906][T11373] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.1993'. [ 505.458311][T11382] netlink: 'syz.2.1997': attribute type 15 has an invalid length. [ 505.655228][T11388] netlink: 'syz.1.1999': attribute type 10 has an invalid length. [ 505.779870][T11393] netlink: 'syz.0.2000': attribute type 10 has an invalid length. [ 507.569573][T11410] __nla_validate_parse: 7 callbacks suppressed [ 507.569626][T11410] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2004'. [ 507.596612][T11416] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2006'. [ 507.606619][T11412] netlink: 'syz.2.2005': attribute type 15 has an invalid length. [ 507.637978][T11412] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2005'. [ 507.655497][T11416] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2006'. [ 507.679682][T11418] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2006'. [ 507.705159][T11416] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2006'. [ 507.738844][T11412] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 507.868958][T11426] netlink: 'syz.3.2009': attribute type 15 has an invalid length. [ 507.877723][T11426] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2009'. [ 508.093134][T11433] netlink: 'syz.2.2012': attribute type 10 has an invalid length. [ 509.597080][T11438] netlink: 'syz.0.2021': attribute type 15 has an invalid length. [ 509.630420][T11438] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2021'. [ 509.695845][T11443] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2015'. [ 509.708654][T11440] netlink: 'syz.3.2013': attribute type 10 has an invalid length. [ 511.066652][T11449] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2016'. [ 511.363083][T11462] netlink: 'syz.2.2024': attribute type 10 has an invalid length. [ 511.450030][T11467] netlink: 'syz.3.2023': attribute type 28 has an invalid length. [ 511.487001][T11467] netlink: 'syz.3.2023': attribute type 29 has an invalid length. [ 511.561894][T11472] netlink: 'syz.1.2028': attribute type 10 has an invalid length. [ 512.021075][T11474] netlink: 'syz.1.2029': attribute type 1 has an invalid length. [ 512.827022][T11490] __nla_validate_parse: 12 callbacks suppressed [ 512.827044][T11490] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2035'. [ 514.128403][T11494] netlink: 'syz.0.2037': attribute type 10 has an invalid length. [ 514.171427][T11492] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2036'. [ 514.281046][T11500] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2039'. [ 514.290516][T11500] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2039'. [ 514.302228][T11500] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2039'. [ 514.355331][T11498] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.2038'. [ 514.380163][T11498] netlink: 3064 bytes leftover after parsing attributes in process `syz.3.2038'. [ 514.414456][T11501] netlink: 'syz.3.2038': attribute type 1 has an invalid length. [ 514.429583][T11501] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.2038'. [ 514.455872][T11506] netlink: 'syz.0.2042': attribute type 15 has an invalid length. [ 514.472969][T11506] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2042'. [ 514.507285][T11507] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2041'. [ 514.537174][T11506] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 514.619672][T11509] netlink: 'syz.1.2043': attribute type 10 has an invalid length. [ 517.020430][T11529] netlink: 'syz.2.2051': attribute type 10 has an invalid length. [ 517.112640][T11531] netlink: 'syz.0.2053': attribute type 1 has an invalid length. [ 517.332484][T11537] netlink: 'syz.2.2055': attribute type 15 has an invalid length. [ 517.414217][T11537] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 517.518926][T11540] netlink: 'syz.1.2057': attribute type 10 has an invalid length. [ 518.618692][T11553] __nla_validate_parse: 11 callbacks suppressed [ 518.618716][T11553] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2061'. [ 519.440777][T11558] netlink: 'syz.1.2063': attribute type 10 has an invalid length. [ 519.617841][T11560] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2064'. [ 519.632179][T11560] netlink: 3064 bytes leftover after parsing attributes in process `syz.2.2064'. [ 519.645885][T11562] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2065'. [ 519.690986][T11565] netlink: 'syz.2.2064': attribute type 1 has an invalid length. [ 519.698978][T11565] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2064'. [ 519.749578][T11568] netlink: 'syz.1.2067': attribute type 15 has an invalid length. [ 519.757541][T11568] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2067'. [ 519.826668][T11568] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 519.934314][T11574] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2070'. [ 519.958891][T11576] netlink: 'syz.1.2071': attribute type 10 has an invalid length. [ 521.141619][T11582] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2073'. [ 522.589040][T11589] netlink: 'syz.2.2075': attribute type 10 has an invalid length. [ 522.707193][T11593] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2078'. [ 522.784951][T11596] netlink: 'syz.0.2079': attribute type 15 has an invalid length. [ 522.829236][T11596] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2079'. [ 522.979634][T11603] netlink: 'syz.1.2082': attribute type 10 has an invalid length. [ 523.163251][T11605] netlink: 'syz.3.2083': attribute type 1 has an invalid length. [ 523.891725][T11613] __nla_validate_parse: 4 callbacks suppressed [ 523.891747][T11613] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2086'. [ 524.450405][T11620] netlink: 'syz.1.2089': attribute type 10 has an invalid length. [ 524.551304][T11622] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2090'. [ 524.665021][T11627] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2092'. [ 524.668376][T11629] netlink: 'syz.1.2093': attribute type 15 has an invalid length. [ 524.682926][T11629] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2093'. [ 524.805709][T11631] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.2094'. [ 524.830692][T11631] netlink: 3064 bytes leftover after parsing attributes in process `syz.0.2094'. [ 524.863305][T11634] netlink: 'syz.0.2094': attribute type 1 has an invalid length. [ 524.884805][T11634] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.2094'. [ 524.977132][T11638] netlink: 'syz.1.2097': attribute type 10 has an invalid length. [ 525.676176][T11643] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2099'. [ 527.204817][T11652] netlink: 'syz.1.2101': attribute type 10 has an invalid length. [ 527.232786][T11650] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2102'. [ 527.292300][T11656] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2104'. [ 527.336277][T11659] netlink: 'syz.2.2105': attribute type 15 has an invalid length. [ 527.632921][T11663] netlink: 'syz.3.2107': attribute type 1 has an invalid length. [ 527.712143][T11667] netlink: 'syz.1.2109': attribute type 10 has an invalid length. [ 529.932281][T11682] __nla_validate_parse: 5 callbacks suppressed [ 529.932303][T11682] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2115'. [ 529.981441][T11684] netlink: 'syz.2.2116': attribute type 10 has an invalid length. [ 530.022163][T11680] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2114'. [ 530.183458][T11692] netlink: 'syz.0.2119': attribute type 15 has an invalid length. [ 530.209344][T11692] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2119'. [ 530.294325][T11693] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.2120'. [ 530.304184][T11692] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 530.328450][T11693] netlink: 3064 bytes leftover after parsing attributes in process `syz.3.2120'. [ 530.364050][T11696] netlink: 'syz.3.2120': attribute type 1 has an invalid length. [ 530.372741][T11696] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.2120'. [ 531.923294][T11707] netlink: 'syz.2.2125': attribute type 10 has an invalid length. [ 531.941907][T11706] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2124'. [ 532.128872][T11715] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2127'. [ 532.156660][T11716] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2128'. [ 533.515056][T11719] netlink: 'syz.0.2130': attribute type 10 has an invalid length. [ 533.560565][T11724] netlink: 'syz.3.2132': attribute type 15 has an invalid length. [ 533.568642][T11724] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2132'. [ 533.634903][T11724] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 533.950183][T11732] netlink: 'syz.0.2135': attribute type 1 has an invalid length. [ 534.517247][T11736] netlink: 'syz.1.2137': attribute type 10 has an invalid length. [ 535.732244][T11739] __nla_validate_parse: 3 callbacks suppressed [ 535.732265][T11739] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2138'. [ 535.811300][T11743] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2139'. [ 535.822359][T11742] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2140'. [ 535.843130][T11751] netlink: 'syz.1.2142': attribute type 15 has an invalid length. [ 535.853945][T11751] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2142'. [ 535.936670][T11751] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 536.031147][T11753] netlink: 'syz.3.2143': attribute type 10 has an invalid length. [ 536.198885][T11759] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2146'. [ 536.209551][T11759] netlink: 3064 bytes leftover after parsing attributes in process `syz.2.2146'. [ 536.265735][T11759] netlink: 'syz.2.2146': attribute type 1 has an invalid length. [ 536.283536][T11759] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2146'. [ 536.391332][T11767] netlink: 'syz.1.2149': attribute type 10 has an invalid length. [ 537.370459][T11773] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2152'. [ 537.388618][T11771] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2151'. [ 537.435696][T11776] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2153'. [ 538.169205][T11778] netlink: 'syz.2.2155': attribute type 15 has an invalid length. [ 538.221076][T11778] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 538.309521][T11782] netlink: 'syz.0.2156': attribute type 10 has an invalid length. [ 538.541863][T11788] netlink: 'syz.2.2159': attribute type 1 has an invalid length. [ 538.656585][T11796] netlink: 'syz.0.2162': attribute type 10 has an invalid length. [ 540.621513][T11819] netlink: 'syz.1.2169': attribute type 15 has an invalid length. [ 540.652402][T11819] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 540.679417][T11821] netlink: 'syz.2.2170': attribute type 10 has an invalid length. [ 540.845842][T11823] __nla_validate_parse: 7 callbacks suppressed [ 540.845899][T11823] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.2172'. [ 540.900715][T11823] netlink: 3064 bytes leftover after parsing attributes in process `syz.3.2172'. [ 540.968046][T11826] netlink: 'syz.3.2172': attribute type 1 has an invalid length. [ 540.986545][T11826] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.2172'. [ 540.996663][T11828] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2174'. [ 541.846371][T11833] netlink: 'syz.2.2176': attribute type 10 has an invalid length. [ 542.844723][T11836] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2177'. [ 543.098714][T11848] netlink: 'syz.0.2182': attribute type 15 has an invalid length. [ 543.109518][T11848] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2182'. [ 543.120039][T11850] netlink: 'syz.1.2183': attribute type 10 has an invalid length. [ 543.191450][T11848] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 543.370274][T11856] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2187'. [ 543.396219][T11859] netlink: 'syz.0.2186': attribute type 10 has an invalid length. [ 544.191897][T11865] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2188'. [ 544.201927][T11865] netlink: 3064 bytes leftover after parsing attributes in process `syz.2.2188'. [ 544.216760][T11865] netlink: 'syz.2.2188': attribute type 1 has an invalid length. [ 544.229396][T11865] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2188'. [ 545.180006][T11879] netlink: 'syz.2.2194': attribute type 15 has an invalid length. [ 545.300110][T11881] netlink: 'syz.1.2195': attribute type 10 has an invalid length. [ 545.341246][T11879] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 546.462301][T11887] netlink: 'syz.3.2197': attribute type 10 has an invalid length. [ 547.029334][T11892] __nla_validate_parse: 2 callbacks suppressed [ 547.029354][T11892] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2198'. [ 547.503297][T11896] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2200'. [ 547.537180][T11896] netlink: 3064 bytes leftover after parsing attributes in process `syz.2.2200'. [ 547.568341][T11899] netlink: 'syz.2.2200': attribute type 1 has an invalid length. [ 547.600060][T11899] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2200'. [ 547.702764][T11906] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2203'. [ 549.148196][T11915] netlink: 'syz.2.2208': attribute type 15 has an invalid length. [ 549.167659][T11915] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2208'. [ 549.178055][T11916] netlink: 'syz.0.2206': attribute type 10 has an invalid length. [ 549.189473][T11919] netlink: 'syz.1.2209': attribute type 10 has an invalid length. [ 549.424590][T11915] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 550.182813][T11927] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2210'. [ 551.643552][T11935] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2214'. [ 551.810092][T11943] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.2216'. [ 551.820034][T11943] netlink: 3064 bytes leftover after parsing attributes in process `syz.1.2216'. [ 551.835227][T11943] netlink: 'syz.1.2216': attribute type 1 has an invalid length. [ 552.418467][T11947] netlink: 'syz.2.2218': attribute type 10 has an invalid length. [ 553.239485][T11952] netlink: 'syz.2.2219': attribute type 15 has an invalid length. [ 553.247427][T11952] __nla_validate_parse: 1 callbacks suppressed [ 553.247442][T11952] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2219'. [ 553.315441][T11954] netlink: 'syz.0.2221': attribute type 10 has an invalid length. [ 553.373800][T11952] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 554.896703][T11959] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2223'. [ 555.146293][T11970] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2228'. [ 555.156316][T11967] netlink: 'syz.1.2227': attribute type 10 has an invalid length. [ 555.189571][T11970] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2228'. [ 555.203919][T11970] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2228'. [ 555.239354][T11970] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2228'. [ 555.541679][T11975] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2230'. [ 555.564357][T11976] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.2231'. [ 555.577068][T11976] netlink: 3064 bytes leftover after parsing attributes in process `syz.1.2231'. [ 555.592679][T11978] netlink: 'syz.1.2231': attribute type 1 has an invalid length. [ 555.621862][T11978] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.2231'. [ 555.932301][T11980] netlink: 'syz.0.2232': attribute type 15 has an invalid length. [ 556.068638][T11982] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 556.794683][T11986] netlink: 'syz.2.2233': attribute type 10 has an invalid length. [ 559.100461][T11999] netlink: 'syz.1.2239': attribute type 10 has an invalid length. [ 559.280850][T12003] __nla_validate_parse: 2 callbacks suppressed [ 559.280873][T12003] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2242'. [ 559.474015][T12009] netlink: 203516 bytes leftover after parsing attributes in process `syz.1.2243'. [ 559.484078][T12009] netlink: 3064 bytes leftover after parsing attributes in process `syz.1.2243'. [ 559.506308][T12009] netlink: 'syz.1.2243': attribute type 1 has an invalid length. [ 559.518477][T12009] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.2243'. [ 560.001908][T12011] netlink: 'syz.2.2244': attribute type 15 has an invalid length. [ 560.013108][T12011] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2244'. [ 560.157203][T12013] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 560.891404][T12022] netlink: 'syz.1.2248': attribute type 10 has an invalid length. [ 561.296130][T12025] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2250'. [ 561.430450][T12027] netlink: 'syz.0.2251': attribute type 10 has an invalid length. [ 563.238063][T12033] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2253'. [ 563.254417][T12038] netlink: 'syz.2.2255': attribute type 15 has an invalid length. [ 563.266794][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.274914][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.283493][T12038] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2255'. [ 563.438710][T12038] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 563.505188][T12040] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.2256'. [ 563.516361][T12040] netlink: 3064 bytes leftover after parsing attributes in process `syz.0.2256'. [ 563.527352][T12044] netlink: 'syz.0.2256': attribute type 1 has an invalid length. [ 563.780007][T12052] netlink: 'syz.0.2261': attribute type 10 has an invalid length. [ 563.831334][T12054] netlink: 'syz.1.2262': attribute type 10 has an invalid length. [ 564.625117][T12057] __nla_validate_parse: 1 callbacks suppressed [ 564.625143][T12057] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2263'. [ 566.027605][T12062] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2265'. [ 566.261767][T12069] netlink: 'syz.2.2268': attribute type 15 has an invalid length. [ 566.275085][T12069] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2268'. [ 566.332044][T12072] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.2269'. [ 566.369258][T12072] netlink: 3064 bytes leftover after parsing attributes in process `syz.3.2269'. [ 566.392506][T12076] netlink: 'syz.3.2269': attribute type 1 has an invalid length. [ 566.401817][T12069] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 566.423182][T12078] netlink: 'syz.0.2272': attribute type 10 has an invalid length. [ 566.431688][T12076] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.2269'. [ 566.626784][T12080] netlink: 'syz.2.2274': attribute type 10 has an invalid length. [ 566.836927][T12084] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2275'. [ 566.923564][T12084] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2275'. [ 567.007103][T12085] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2275'. [ 567.584845][T12088] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2277'. [ 569.128238][T12100] netlink: 'syz.3.2281': attribute type 10 has an invalid length. [ 569.214789][T12102] netlink: 'syz.1.2282': attribute type 15 has an invalid length. [ 569.278885][T12104] netlink: 'syz.2.2283': attribute type 1 has an invalid length. [ 569.358156][T12102] mac80211_hwsim hwsim9 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 569.451212][T12111] netlink: 'syz.0.2286': attribute type 10 has an invalid length. [ 570.651833][T12123] __nla_validate_parse: 5 callbacks suppressed [ 570.651856][T12123] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2290'. [ 570.684916][T12123] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2290'. [ 570.706763][T12123] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2290'. [ 570.907821][T12125] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2291'. [ 572.029018][T12127] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2292'. [ 572.311914][T12134] netlink: 'syz.0.2295': attribute type 15 has an invalid length. [ 572.354766][T12134] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2295'. [ 572.487813][T12140] netlink: 'syz.2.2296': attribute type 1 has an invalid length. [ 572.509252][T12134] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 572.531736][T12140] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.2296'. [ 572.550604][T12137] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2296'. [ 572.581084][T12137] netlink: 3064 bytes leftover after parsing attributes in process `syz.2.2296'. [ 572.883763][T12145] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 572.895374][T12145] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 572.910303][T12145] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 572.934186][T12145] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 572.942495][T12145] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 572.951087][T12145] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 573.052533][T12150] netlink: 'syz.0.2300': attribute type 10 has an invalid length. [ 574.891918][ T59] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 574.983963][T12158] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2303'. [ 575.026909][ T5783] Bluetooth: hci4: command tx timeout [ 575.036571][ T59] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.186087][ T59] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.253099][T12166] netlink: 'syz.2.2306': attribute type 15 has an invalid length. [ 575.342159][ T59] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 575.364470][T12166] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 575.376297][T12173] netlink: 'syz.0.2308': attribute type 1 has an invalid length. [ 575.475904][T12144] chnl_net:caif_netlink_parms(): no params data found [ 575.809543][T12144] bridge0: port 1(bridge_slave_0) entered blocking state [ 575.821589][T12144] bridge0: port 1(bridge_slave_0) entered disabled state [ 575.831273][T12144] bridge_slave_0: entered allmulticast mode [ 575.839860][T12144] bridge_slave_0: entered promiscuous mode [ 575.853432][T12185] netlink: 'syz.2.2312': attribute type 10 has an invalid length. [ 575.865243][T12144] bridge0: port 2(bridge_slave_1) entered blocking state [ 575.892722][T12144] bridge0: port 2(bridge_slave_1) entered disabled state [ 575.938197][T12144] bridge_slave_1: entered allmulticast mode [ 576.013079][T12144] bridge_slave_1: entered promiscuous mode [ 576.401781][T12144] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 576.542810][T12144] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 576.750267][T12144] team0: Port device team_slave_0 added [ 576.763051][T12188] __nla_validate_parse: 5 callbacks suppressed [ 576.763076][T12188] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2313'. [ 576.785085][T12144] team0: Port device team_slave_1 added [ 576.889417][T12144] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 576.906996][T12144] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 576.964036][T12144] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 577.109308][ T5783] Bluetooth: hci4: command tx timeout [ 578.461777][T12144] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 578.469313][T12144] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 578.498512][T12144] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 578.665028][ T59] ip6gretap0 (unregistering): left allmulticast mode [ 578.686420][T12204] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2314'. [ 578.696454][ T59] ip6gretap0 (unregistering): left promiscuous mode [ 578.719908][ T59] : port 1(ip6gretap0) entered disabled state [ 578.924196][T12213] netlink: 'syz.2.2317': attribute type 15 has an invalid length. [ 578.949250][T12213] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2317'. [ 579.135072][ T59] smc: removing net device  with user defined pnetid CONFIG [ 579.173635][T12219] netlink: 'syz.0.2318': attribute type 1 has an invalid length. [ 579.181803][ T5783] Bluetooth: hci4: command tx timeout [ 579.253918][T12219] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.2318'. [ 579.322728][T12213] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 579.496774][T12215] netlink: 203516 bytes leftover after parsing attributes in process `syz.0.2318'. [ 579.552345][T12144] hsr_slave_0: entered promiscuous mode [ 579.582936][T12144] hsr_slave_1: entered promiscuous mode [ 579.590570][T12144] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 579.598216][T12144] Cannot create hsr debugfs directory [ 579.685681][T12215] netlink: 3064 bytes leftover after parsing attributes in process `syz.0.2318'. [ 580.063312][T12235] netlink: 'syz.0.2322': attribute type 10 has an invalid length. [ 580.756430][T12239] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2323'. [ 581.259295][ T5783] Bluetooth: hci4: command tx timeout [ 582.522102][T12246] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2325'. [ 582.929280][T12255] netlink: 'syz.0.2328': attribute type 15 has an invalid length. [ 582.937213][T12255] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2328'. [ 582.968446][T12258] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.2329'. [ 583.064141][T12259] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 583.092958][T12258] netlink: 3064 bytes leftover after parsing attributes in process `syz.3.2329'. [ 583.121241][T12263] netlink: 'syz.3.2329': attribute type 1 has an invalid length. [ 583.151365][T12263] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.2329'. [ 583.567921][T12279] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2332'. [ 583.687635][T12144] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 585.124415][T12144] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 585.136129][T12144] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 585.146670][T12282] netlink: 'syz.2.2333': attribute type 10 has an invalid length. [ 585.285259][T12144] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 585.375337][T12291] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2336'. [ 585.419784][ T59] vlan0: left allmulticast mode [ 585.424748][ T59] veth0_vlan: left allmulticast mode [ 585.430925][ T59] vlan0: left promiscuous mode [ 585.437903][ T59] À: port 1(vlan0) entered disabled state [ 585.466368][ T59] hsr_slave_0: left promiscuous mode [ 585.483134][ T59] hsr_slave_1: left promiscuous mode [ 585.550726][ T59] bridge_slave_1: left allmulticast mode [ 585.556539][ T59] bridge_slave_1: left promiscuous mode [ 585.575585][ T59] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.590588][ T59] bridge_slave_0: left allmulticast mode [ 585.596442][ T59] bridge_slave_0: left promiscuous mode [ 585.604537][ T59] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.654461][ T59] veth1_macvtap: left promiscuous mode [ 585.668460][T12298] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2339'. [ 585.680695][ T59] veth0_macvtap: left promiscuous mode [ 585.686382][ T59] veth1_vlan: left promiscuous mode [ 585.774556][T12304] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2340'. [ 586.135087][ T59] team0 (unregistering): Port device macvlan1 removed [ 586.508062][ T59] team0 (unregistering): Port device team_slave_1 removed [ 586.552711][ T59] team0 (unregistering): Port device C removed [ 586.603309][ T59] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 586.664532][ T59] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 587.003392][ T59] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 587.015538][ T59] bond0 (unregistering): Released all slaves [ 587.114322][T12296] netlink: 'syz.0.2338': attribute type 15 has an invalid length. [ 587.122711][T12296] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2338'. [ 587.134371][T12299] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 587.137709][T12300] netlink: 'syz.2.2339': attribute type 1 has an invalid length. [ 587.433168][T12144] 8021q: adding VLAN 0 to HW filter on device bond0 [ 587.442506][T12313] netlink: 'syz.2.2343': attribute type 10 has an invalid length. [ 588.942702][T12144] 8021q: adding VLAN 0 to HW filter on device team0 [ 588.977772][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 588.985086][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 589.011900][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 589.019511][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 589.287900][T12322] __nla_validate_parse: 4 callbacks suppressed [ 589.287923][T12322] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2346'. [ 589.472612][T12331] netlink: 'syz.2.2348': attribute type 15 has an invalid length. [ 589.489316][T12331] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2348'. [ 589.623444][T12331] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 589.681334][T12144] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 589.735646][T12338] netlink: 203516 bytes leftover after parsing attributes in process `syz.3.2350'. [ 589.775327][T12338] netlink: 3064 bytes leftover after parsing attributes in process `syz.3.2350'. [ 589.798770][T12341] netlink: 'syz.3.2350': attribute type 1 has an invalid length. [ 589.824229][T12341] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.2350'. [ 589.868912][T12344] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2352'. [ 589.896245][T12144] veth0_vlan: entered promiscuous mode [ 589.924617][T12344] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2352'. [ 589.937528][T12346] netlink: 'syz.0.2351': attribute type 10 has an invalid length. [ 589.985761][T12144] veth1_vlan: entered promiscuous mode [ 590.335824][T12144] veth0_macvtap: entered promiscuous mode [ 590.427839][T12144] veth1_macvtap: entered promiscuous mode [ 590.436395][T12353] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2354'. [ 590.643848][T12144] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 590.765634][T12144] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 590.848077][T12144] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.880751][T12144] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.911836][T12144] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 590.957106][T12144] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.604790][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.618391][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.670050][ T1081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 592.678103][ T1081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 592.816730][T12371] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2357'. [ 592.941210][T12379] netlink: 'syz.1.2293': attribute type 10 has an invalid length. [ 593.009913][T12379] bridge0: port 2(bridge_slave_1) entered disabled state [ 593.017798][T12379] bridge0: port 1(bridge_slave_0) entered disabled state [ 593.114008][T12379] bridge0: port 2(bridge_slave_1) entered blocking state [ 593.121588][T12379] bridge0: port 2(bridge_slave_1) entered forwarding state [ 593.129329][T12379] bridge0: port 1(bridge_slave_0) entered blocking state [ 593.136548][T12379] bridge0: port 1(bridge_slave_0) entered forwarding state [ 593.209717][T12388] netlink: 203516 bytes leftover after parsing attributes in process `syz.2.2361'. [ 593.232787][T12379] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 593.244736][T12387] netlink: 'syz.0.2360': attribute type 15 has an invalid length. [ 593.279322][T12390] netlink: 'syz.2.2361': attribute type 1 has an invalid length. [ 593.291197][T12389] mac80211_hwsim hwsim8 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 593.337599][T12394] netlink: 'syz.3.2362': attribute type 10 has an invalid length. [ 596.397977][T12430] __nla_validate_parse: 4 callbacks suppressed [ 596.397998][T12430] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2366'. [ 596.456982][T12430] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2366'. [ 596.729302][T12444] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2369'. [ 596.739670][T12444] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2369'. [ 596.782463][T12441] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2370'. [ 596.794070][T12444] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2369'. [ 596.999948][T12450] netlink: 'syz.1.2373': attribute type 15 has an invalid length. [ 597.023156][T12450] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2373'. [ 597.071262][T12454] netlink: 'syz.2.2374': attribute type 10 has an invalid length. [ 598.306320][T12145] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 598.319117][T12145] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 598.329179][T12145] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 598.341344][T12145] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 598.351756][T12145] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 598.359683][T12145] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 599.605328][T12450] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 599.893383][T12472] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2376'. [ 599.927728][T12475] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2378'. [ 599.954018][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 599.986132][T12475] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2378'. [ 600.061862][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.132097][T12464] chnl_net:caif_netlink_parms(): no params data found [ 600.230885][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.351572][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.481333][T12464] bridge0: port 1(bridge_slave_0) entered blocking state [ 600.488896][T12464] bridge0: port 1(bridge_slave_0) entered disabled state [ 600.496819][T12464] bridge_slave_0: entered allmulticast mode [ 600.504912][T12464] bridge_slave_0: entered promiscuous mode [ 600.515765][T12464] bridge0: port 2(bridge_slave_1) entered blocking state [ 600.523597][T12464] bridge0: port 2(bridge_slave_1) entered disabled state [ 600.542749][T12464] bridge_slave_1: entered allmulticast mode [ 600.557757][T12464] bridge_slave_1: entered promiscuous mode [ 600.612975][T12464] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 600.624848][T12495] netlink: 'syz.2.2383': attribute type 10 has an invalid length. [ 600.695516][T12464] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 601.037815][T12464] team0: Port device team_slave_0 added [ 601.252886][T12464] team0: Port device team_slave_1 added [ 601.436383][T12464] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 601.459281][T12464] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 601.539604][T12464] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 601.562185][T12464] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 601.581238][ T5783] Bluetooth: hci1: command tx timeout [ 601.609445][T12464] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 601.664132][T12464] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 602.229489][ T59] wlan1: Trigger new scan to find an IBSS to join [ 603.469155][T12505] netlink: 'syz.3.2388': attribute type 15 has an invalid length. [ 603.477085][T12505] __nla_validate_parse: 3 callbacks suppressed [ 603.477102][T12505] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2388'. [ 603.559380][T12507] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 603.659229][ T5783] Bluetooth: hci1: command tx timeout [ 603.792991][T12527] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2390'. [ 603.861928][T12464] hsr_slave_0: entered promiscuous mode [ 603.882661][T12464] hsr_slave_1: entered promiscuous mode [ 603.900967][T12464] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 603.919333][T12464] Cannot create hsr debugfs directory [ 603.964390][T12531] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2391'. [ 604.021499][T12531] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2391'. [ 604.060210][T12534] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2391'. [ 604.181147][ T49] smc: removing net device  with user defined pnetid CONFIG [ 604.196694][T12539] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2393'. [ 605.739266][ T5783] Bluetooth: hci1: command tx timeout [ 606.173622][T12551] netlink: 'syz.3.2396': attribute type 10 has an invalid length. [ 606.219984][ T59] wlan1: Trigger new scan to find an IBSS to join [ 606.838165][T12558] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 607.174168][T12566] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2400'. [ 607.196488][T12569] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2401'. [ 607.207565][ T59] wlan1: Creating new IBSS network, BSSID a6:bb:b7:da:46:8f [ 607.296323][T12569] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2401'. [ 607.313357][T12571] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2401'. [ 607.911107][ T5783] Bluetooth: hci1: command tx timeout [ 610.148720][T12593] netlink: 'syz.2.2407': attribute type 10 has an invalid length. [ 610.161532][T12597] netlink: 'syz.3.2408': attribute type 15 has an invalid length. [ 610.169717][T12597] __nla_validate_parse: 1 callbacks suppressed [ 610.169730][T12597] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2408'. [ 610.203013][T12598] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 610.562498][T12609] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2410'. [ 610.594818][T12464] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 610.613574][T12611] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2411'. [ 610.640742][T12464] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 610.672266][T12611] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2411'. [ 610.691545][T12614] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2411'. [ 610.713408][T12464] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 610.754741][ T49] vlan0: left allmulticast mode [ 610.763250][ T49] veth0_vlan: left allmulticast mode [ 610.768700][ T49] vlan0: left promiscuous mode [ 610.790593][ T49] À: port 1(vlan0) entered disabled state [ 610.808491][ T49] hsr_slave_0: left promiscuous mode [ 610.817374][ T49] hsr_slave_1: left promiscuous mode [ 610.834981][ T49] bridge_slave_1: left allmulticast mode [ 610.849210][ T49] bridge_slave_1: left promiscuous mode [ 610.855082][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 610.877357][T12618] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2414'. [ 610.888981][ T49] bridge_slave_0: left allmulticast mode [ 610.894813][ T49] bridge_slave_0: left promiscuous mode [ 610.909340][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 610.936802][ T49] veth1_macvtap: left promiscuous mode [ 610.943724][ T49] veth0_macvtap: left promiscuous mode [ 610.951319][ T49] veth1_vlan: left promiscuous mode [ 610.956875][ T49] veth0_vlan: left promiscuous mode [ 613.450708][ T49] team0 (unregistering): Port device macvlan1 removed [ 614.023642][ T49] team0 (unregistering): Port device team_slave_1 removed [ 614.092321][ T49] team0 (unregistering): Port device team_slave_0 removed [ 614.136917][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 614.191572][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 614.543425][ T49] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 614.552800][ T49] bond0 (unregistering): Released all slaves [ 614.652922][T12464] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 614.664315][T12626] netlink: 'syz.3.2417': attribute type 10 has an invalid length. [ 614.675616][T12630] netlink: 'syz.1.2418': attribute type 15 has an invalid length. [ 614.702262][T12630] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2418'. [ 614.775522][T12631] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 614.928387][T12637] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2420'. [ 615.116432][T12642] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2422'. [ 615.136965][T12464] 8021q: adding VLAN 0 to HW filter on device bond0 [ 615.168081][T12642] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2422'. [ 615.213688][T12642] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2422'. [ 615.253671][T12464] 8021q: adding VLAN 0 to HW filter on device team0 [ 615.292510][T12594] bridge0: port 1(bridge_slave_0) entered blocking state [ 615.299939][T12594] bridge0: port 1(bridge_slave_0) entered forwarding state [ 615.331167][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 615.338413][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 615.375450][T12645] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2423'. [ 616.297666][T12659] netlink: 'syz.2.2426': attribute type 10 has an invalid length. [ 616.699468][T12673] netlink: 'syz.1.2428': attribute type 15 has an invalid length. [ 616.707452][T12673] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2428'. [ 618.061464][T12673] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 618.098659][T12464] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.263349][T12464] veth0_vlan: entered promiscuous mode [ 618.325118][T12464] veth1_vlan: entered promiscuous mode [ 618.425768][T12684] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2430'. [ 618.466465][T12464] veth0_macvtap: entered promiscuous mode [ 618.481409][T12464] veth1_macvtap: entered promiscuous mode [ 618.520381][T12464] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 618.540441][T12464] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 618.556358][T12464] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 618.575241][T12464] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 618.600758][T12464] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 618.640295][T12464] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 618.674310][T12464] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 618.694332][T12464] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 618.716961][T12464] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 618.745286][T12464] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 618.787329][T12691] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2432'. [ 618.809709][T12691] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2432'. [ 618.855981][T12691] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2432'. [ 618.940952][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 618.948897][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 619.105707][T12702] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2433'. [ 619.141625][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 619.186326][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 620.223611][ T1316] wlan1: Trigger new scan to find an IBSS to join [ 620.411922][T12708] netlink: 'syz.3.2437': attribute type 10 has an invalid length. [ 620.670640][T12728] netlink: 'syz.1.2438': attribute type 15 has an invalid length. [ 620.694448][T12728] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2438'. [ 620.724783][T12729] netlink: 'syz.0.2372': attribute type 10 has an invalid length. [ 620.781612][T12729] bridge0: port 2(bridge_slave_1) entered disabled state [ 620.789692][T12729] bridge0: port 1(bridge_slave_0) entered disabled state [ 620.845653][T12731] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2440'. [ 621.136355][T12729] bridge0: port 2(bridge_slave_1) entered blocking state [ 621.143918][T12729] bridge0: port 2(bridge_slave_1) entered forwarding state [ 621.151885][T12729] bridge0: port 1(bridge_slave_0) entered blocking state [ 621.159453][T12729] bridge0: port 1(bridge_slave_0) entered forwarding state [ 621.194666][T12729] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 621.336855][T12728] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 621.789247][T12747] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2442'. [ 621.872007][T12747] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2442'. [ 621.901778][T12751] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2442'. [ 622.005800][T12145] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 622.029397][T12145] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 622.040898][T12145] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 622.060500][T12145] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 622.072932][T12145] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 622.089545][T12145] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 622.114338][ T62] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 622.204903][T12761] netlink: 'syz.0.2447': attribute type 10 has an invalid length. [ 622.222434][T12761] macvlan1: entered allmulticast mode [ 622.241478][T12761] veth1_vlan: entered allmulticast mode [ 622.283114][T12761] team0: Port device macvlan1 added [ 623.081536][T12769] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2448'. [ 624.140338][ T5783] Bluetooth: hci2: command tx timeout [ 624.703424][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.711204][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.976728][ T62] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.100152][ T62] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.180567][T12594] wlan1: Trigger new scan to find an IBSS to join [ 625.212611][ T62] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 625.281782][T12789] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2449'. [ 625.347894][T12794] netlink: 'syz.1.2450': attribute type 10 has an invalid length. [ 625.356548][T12794] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.364026][T12794] bridge0: port 1(bridge_slave_0) entered disabled state [ 625.508297][T12799] netlink: 'syz.2.2452': attribute type 15 has an invalid length. [ 625.517091][T12799] netlink: 168 bytes leftover after parsing attributes in process `syz.2.2452'. [ 625.659654][T12799] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 625.756207][T12805] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2454'. [ 625.795956][T12805] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2454'. [ 625.815405][T12805] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2454'. [ 625.877596][T12754] chnl_net:caif_netlink_parms(): no params data found [ 626.219339][ T5783] Bluetooth: hci2: command tx timeout [ 627.184760][T12830] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2459'. [ 628.299135][ T5783] Bluetooth: hci2: command tx timeout [ 628.817291][ T11] wlan1: Creating new IBSS network, BSSID e2:2a:b8:da:9f:ab [ 628.837422][T12813] netlink: 'syz.0.2457': attribute type 10 has an invalid length. [ 628.874204][T12813] veth1_vlan: left allmulticast mode [ 629.113815][T12838] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2460'. [ 629.133832][ T62] smc: removing net device  with user defined pnetid CONFIG [ 629.150734][T12754] bridge0: port 1(bridge_slave_0) entered blocking state [ 629.163259][T12754] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.172485][T12754] bridge_slave_0: entered allmulticast mode [ 629.180619][T12754] bridge_slave_0: entered promiscuous mode [ 629.203661][T12754] bridge0: port 2(bridge_slave_1) entered blocking state [ 629.229973][T12754] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.238052][T12754] bridge_slave_1: entered allmulticast mode [ 629.264402][T12754] bridge_slave_1: entered promiscuous mode [ 629.440095][T12754] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 629.459348][T12848] netlink: 'syz.0.2463': attribute type 10 has an invalid length. [ 629.468569][T12853] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2465'. [ 629.487022][T12848] bridge0: port 2(bridge_slave_1) entered disabled state [ 629.494784][T12848] bridge0: port 1(bridge_slave_0) entered disabled state [ 629.594966][T12850] netlink: 'syz.1.2464': attribute type 15 has an invalid length. [ 629.610258][T12850] netlink: 168 bytes leftover after parsing attributes in process `syz.1.2464'. [ 629.625119][T12754] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 629.706928][T12853] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2465'. [ 629.727658][T12857] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2465'. [ 629.837613][T12854] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 630.007247][T12754] team0: Port device team_slave_0 added [ 630.067657][T12754] team0: Port device team_slave_1 added [ 630.215074][T12871] netlink: 'syz.0.2467': attribute type 10 has an invalid length. [ 630.239510][T12754] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 630.264146][T12754] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 630.394389][ T5783] Bluetooth: hci2: command tx timeout [ 630.509516][T12754] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 630.631873][T12754] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 630.717980][T12754] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 630.938224][T12754] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 631.291618][T12877] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2469'. [ 632.219744][ T33] wlan1: Trigger new scan to find an IBSS to join [ 632.686842][T12754] hsr_slave_0: entered promiscuous mode [ 632.697469][T12754] hsr_slave_1: entered promiscuous mode [ 632.730204][T12754] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 632.749883][T12754] Cannot create hsr debugfs directory [ 632.950076][T12881] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2470'. [ 633.184963][T12890] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2473'. [ 633.218941][T12892] netlink: 'syz.1.2474': attribute type 10 has an invalid length. [ 633.239701][T12890] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2473'. [ 633.306305][T12895] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2473'. [ 633.527420][T12898] mac80211_hwsim hwsim5 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 633.861702][T12907] netlink: 'syz.0.2478': attribute type 10 has an invalid length. [ 634.136653][T12914] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2479'. [ 635.259583][ T59] wlan1: Trigger new scan to find an IBSS to join [ 636.177140][ T62] hsr_slave_0: left promiscuous mode [ 636.206505][ T62] hsr_slave_1: left promiscuous mode [ 636.267670][ T62] bridge_slave_1: left allmulticast mode [ 636.273711][ T62] bridge_slave_1: left promiscuous mode [ 636.280484][ T62] bridge0: port 2(bridge_slave_1) entered disabled state [ 636.299470][ T62] bridge_slave_0: left allmulticast mode [ 636.305403][ T62] bridge_slave_0: left promiscuous mode [ 636.319405][ T62] bridge0: port 1(bridge_slave_0) entered disabled state [ 636.445023][T12927] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2481'. [ 636.542522][T12930] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2482'. [ 636.608299][T12933] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2483'. [ 636.986508][ T62] team0 (unregistering): Port device team_slave_1 removed [ 637.035620][ T62] team0 (unregistering): Port device team_slave_0 removed [ 637.088226][ T62] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 637.151498][ T62] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 637.487436][ T62] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 637.496846][ T62] bond0 (unregistering): Released all slaves [ 637.632986][T12933] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2483'. [ 637.662813][T12936] netlink: 'syz.2.2484': attribute type 10 has an invalid length. [ 638.229306][T12835] wlan1: Trigger new scan to find an IBSS to join [ 639.385925][ T49] wlan1: Creating new IBSS network, BSSID e2:d8:12:9d:c3:7a [ 639.459528][T12942] mac80211_hwsim hwsim16 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 639.699513][T12956] netlink: 'syz.0.2489': attribute type 10 has an invalid length. [ 639.745314][T12957] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2491'. [ 639.811676][T12961] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2490'. [ 640.127532][T12965] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2492'. [ 642.037152][T12982] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2494'. [ 642.073602][T12982] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2494'. [ 642.086108][T12986] netlink: 'syz.2.2495': attribute type 10 has an invalid length. [ 642.128154][T12982] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2494'. [ 642.223364][ T1316] wlan1: Trigger new scan to find an IBSS to join [ 642.224469][T12985] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 642.282892][T12754] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 642.333871][T12754] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 642.357428][T12754] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 642.405846][T12754] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 642.618341][T12994] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2499'. [ 642.837693][T13000] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2500'. [ 642.848731][T12754] 8021q: adding VLAN 0 to HW filter on device bond0 [ 642.957778][T12754] 8021q: adding VLAN 0 to HW filter on device team0 [ 643.034274][T12835] bridge0: port 1(bridge_slave_0) entered blocking state [ 643.041695][T12835] bridge0: port 1(bridge_slave_0) entered forwarding state [ 643.068480][ T62] bridge0: port 2(bridge_slave_1) entered blocking state [ 643.077025][ T62] bridge0: port 2(bridge_slave_1) entered forwarding state [ 643.747330][T12754] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 643.864063][T12754] veth0_vlan: entered promiscuous mode [ 643.890930][T12754] veth1_vlan: entered promiscuous mode [ 643.953346][T12754] veth0_macvtap: entered promiscuous mode [ 643.974355][T12754] veth1_macvtap: entered promiscuous mode [ 644.017733][T12754] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 644.033957][T12754] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.044654][T12754] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 644.061478][T12754] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.078150][T12754] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 644.107559][T12754] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 644.128472][T12754] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.144588][T12754] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 644.155826][T12754] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 644.170396][T12754] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 644.193111][T12754] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.203544][T12754] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.217124][T12754] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.232928][ T62] wlan1: Trigger new scan to find an IBSS to join [ 644.248472][T12754] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 644.991736][T13022] netlink: 'syz.2.2501': attribute type 10 has an invalid length. [ 645.024749][ T1316] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.073855][ T1316] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.246696][ T62] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.280694][ T62] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.293617][T13030] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2503'. [ 645.504193][T13033] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2504'. [ 645.524030][T13033] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2504'. [ 645.550758][T13033] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2504'. [ 645.799135][T13037] netlink: 'syz.1.2505': attribute type 10 has an invalid length. [ 646.809455][T13053] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 647.047188][T13063] netlink: 'syz.3.2509': attribute type 15 has an invalid length. [ 647.073240][T13063] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2509'. [ 647.263191][ T49] wlan1: Trigger new scan to find an IBSS to join [ 648.154046][T13077] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2512'. [ 648.167713][T13077] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2512'. [ 648.194900][T13077] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2512'. [ 648.392891][T13081] netlink: 'syz.1.2513': attribute type 10 has an invalid length. [ 648.521386][ T11] wlan1: Creating new IBSS network, BSSID 12:28:26:8a:d5:77 [ 648.560146][T13081] macvlan1: entered allmulticast mode [ 648.641836][T13081] veth1_vlan: entered allmulticast mode [ 648.716450][T12145] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 648.729762][T12145] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 648.741596][T12145] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 648.756218][T12145] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 648.769881][T12145] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 648.777467][T12145] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 648.846763][T13081] team0: Port device macvlan1 added [ 649.262660][ T1316] wlan1: Trigger new scan to find an IBSS to join [ 649.888299][T13099] netlink: 'syz.3.2514': attribute type 15 has an invalid length. [ 649.939175][T13099] netlink: 168 bytes leftover after parsing attributes in process `syz.3.2514'. [ 649.977031][T13101] netlink: 'syz.0.2515': attribute type 10 has an invalid length. [ 650.001468][T13086] chnl_net:caif_netlink_parms(): no params data found [ 650.085197][T13110] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2516'. [ 650.187904][ T1316] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.258517][T13112] netlink: 'syz.0.2517': attribute type 15 has an invalid length. [ 650.267392][T13112] netlink: 168 bytes leftover after parsing attributes in process `syz.0.2517'. [ 650.327642][ T1316] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.518400][T13117] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 650.579094][T13112] mac80211_hwsim hwsim16 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 650.642384][ T1316] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.801798][ T1316] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.854133][T13086] bridge0: port 1(bridge_slave_0) entered blocking state [ 650.869447][ T5783] Bluetooth: hci3: command tx timeout [ 650.883323][T13086] bridge0: port 1(bridge_slave_0) entered disabled state [ 650.916353][T13086] bridge_slave_0: entered allmulticast mode [ 650.924181][T13086] bridge_slave_0: entered promiscuous mode [ 650.934402][T13086] bridge0: port 2(bridge_slave_1) entered blocking state [ 650.946113][T13086] bridge0: port 2(bridge_slave_1) entered disabled state [ 650.966575][T13086] bridge_slave_1: entered allmulticast mode [ 650.974656][T13086] bridge_slave_1: entered promiscuous mode [ 651.008188][T13130] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2520'. [ 651.060850][T13130] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2520'. [ 651.100203][T13132] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2520'. [ 651.178764][T13086] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 651.348128][T13086] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 651.572463][T13144] netlink: 'syz.0.2523': attribute type 10 has an invalid length. [ 651.657223][T13086] team0: Port device team_slave_0 added [ 651.712764][T13086] team0: Port device team_slave_1 added [ 652.057098][T13086] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 652.099403][T13086] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 652.206421][T13086] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 652.229900][T13150] netlink: 'syz.1.2524': attribute type 10 has an invalid length. [ 652.241361][ T59] wlan1: Trigger new scan to find an IBSS to join [ 652.942705][ T5783] Bluetooth: hci3: command tx timeout [ 653.260931][ T62] wlan1: Trigger new scan to find an IBSS to join [ 653.267655][ T49] wlan1: Trigger new scan to find an IBSS to join [ 653.884190][ T11] wlan1: Creating new IBSS network, BSSID 7a:bf:51:c1:73:af [ 653.962177][T13086] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 653.969915][T13086] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 654.010334][T13086] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 654.352739][T13159] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.2525'. [ 654.392507][T13086] hsr_slave_0: entered promiscuous mode [ 654.439673][T13086] hsr_slave_1: entered promiscuous mode [ 654.622847][T13165] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 654.788303][T13175] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2528'. [ 654.867329][ T1316] smc: removing net device  with user defined pnetid CONFIG [ 654.908925][T13178] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2530'. [ 655.004162][T13178] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2530'. [ 655.016608][T13181] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2530'. [ 655.026934][ T5783] Bluetooth: hci3: command tx timeout [ 655.205417][T13183] netlink: 'syz.0.2531': attribute type 10 has an invalid length. [ 655.287965][T13189] netlink: 'syz.1.2532': attribute type 10 has an invalid length. [ 655.303023][T13189] veth1_vlan: left allmulticast mode [ 656.947454][T13199] netlink: 'syz.0.2534': attribute type 10 has an invalid length. [ 657.100637][ T5783] Bluetooth: hci3: command tx timeout [ 657.188150][ T33] wlan1: Trigger new scan to find an IBSS to join [ 657.256808][T13204] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 657.546626][T13210] netlink: 'syz.1.2536': attribute type 28 has an invalid length. [ 657.580102][T13210] netlink: 'syz.1.2536': attribute type 29 has an invalid length. [ 657.589572][T13210] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2536'. [ 657.936042][T13223] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2539'. [ 658.180740][T13225] netlink: 'syz.0.2540': attribute type 1 has an invalid length. [ 658.223908][T12594] wlan1: Trigger new scan to find an IBSS to join [ 658.240583][T13223] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2539'. [ 658.329557][T13227] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2539'. [ 658.572025][T13235] delete_channel: no stack [ 658.587212][T13235] delete_channel: no stack [ 659.714404][ T33] wlan1: Creating new IBSS network, BSSID ba:9e:f9:c8:ea:39 [ 660.737421][T13257] netlink: 'syz.0.2544': attribute type 10 has an invalid length. [ 660.964711][T13270] netlink: 'syz.1.2545': attribute type 10 has an invalid length. [ 661.033513][ T1316] hsr_slave_0: left promiscuous mode [ 661.043976][ T1316] hsr_slave_1: left promiscuous mode [ 661.051946][ T1316] bridge_slave_1: left allmulticast mode [ 661.057830][ T1316] bridge_slave_1: left promiscuous mode [ 661.069957][ T1316] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.080421][ T1316] bridge_slave_0: left allmulticast mode [ 661.086162][ T1316] bridge_slave_0: left promiscuous mode [ 661.093357][ T1316] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.138258][ T1316] veth1_macvtap: left promiscuous mode [ 661.147687][ T1316] veth0_macvtap: left promiscuous mode [ 661.259973][ T59] wlan1: Trigger new scan to find an IBSS to join [ 662.063581][ T1316] team0 (unregistering): Port device team_slave_1 removed [ 662.113000][ T1316] team0 (unregistering): Port device team_slave_0 removed [ 662.163749][ T1316] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 662.218398][ T1316] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 662.227585][T12835] wlan1: Trigger new scan to find an IBSS to join [ 662.589234][ T1316] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 662.598317][ T1316] bond0 (unregistering): Released all slaves [ 662.694961][T13272] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 662.726203][T13086] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 662.773247][T13086] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 662.831200][T13086] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 662.856239][T13280] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2550'. [ 662.875196][T13280] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2550'. [ 662.899206][T13278] wlan0: mtu greater than device maximum [ 662.904987][T13086] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 662.952339][T13280] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2550'. [ 662.981676][T13278] netlink: 'syz.3.2548': attribute type 4 has an invalid length. [ 663.188591][T13286] netlink: 152 bytes leftover after parsing attributes in process `syz.0.2551'. [ 663.206174][T13286] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2551'. [ 663.217504][T12835] wlan1: Creating new IBSS network, BSSID 12:1c:f9:60:95:f3 [ 663.248960][T13086] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.473190][T13086] 8021q: adding VLAN 0 to HW filter on device team0 [ 663.562250][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 663.569568][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 663.729551][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 663.736903][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 664.303406][T13086] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 664.407783][T13086] veth0_vlan: entered promiscuous mode [ 664.444290][T13086] veth1_vlan: entered promiscuous mode [ 664.532413][T13086] veth0_macvtap: entered promiscuous mode [ 664.554628][T13086] veth1_macvtap: entered promiscuous mode [ 664.603064][T13086] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 664.629397][T13086] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.649411][T13086] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 664.669136][T13086] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.689127][T13086] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 664.709225][T13086] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.730746][T13086] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 664.758130][T13086] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.779280][T13086] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.799284][T13086] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.829268][T13086] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.849213][T13086] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 664.869126][T13086] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 664.891976][T13086] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 664.913694][T13086] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.929116][T13086] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.937884][T13086] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.969109][T13086] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.179737][ T49] wlan1: Trigger new scan to find an IBSS to join [ 665.550845][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 665.558777][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 665.625202][T13300] netlink: 'syz.3.2554': attribute type 10 has an invalid length. [ 665.656912][T13300] macvlan1: entered allmulticast mode [ 665.690826][T13300] veth1_vlan: entered allmulticast mode [ 665.772096][T13300] team0: Port device macvlan1 added [ 665.899737][T13304] netlink: 'syz.0.2556': attribute type 10 has an invalid length. [ 666.942113][T13302] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 667.037614][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 667.057409][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 667.240104][T13312] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2558'. [ 667.263941][T13312] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2558'. [ 667.275530][T13313] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.2510'. [ 667.291355][T13312] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2558'. [ 667.454445][T13319] IPv6: NLM_F_CREATE should be specified when creating new route [ 669.181485][T12835] wlan1: Trigger new scan to find an IBSS to join [ 669.188368][ T33] wlan1: Trigger new scan to find an IBSS to join [ 670.548120][T12594] wlan1: Creating new IBSS network, BSSID de:16:32:5a:99:cc [ 670.986899][T13336] netlink: 'syz.0.2565': attribute type 10 has an invalid length. [ 671.030880][T13333] netlink: 164 bytes leftover after parsing attributes in process `syz.1.2564'. [ 671.411363][T13341] netlink: 'syz.3.2566': attribute type 10 has an invalid length. [ 671.471987][T13341] veth1_vlan: left allmulticast mode [ 673.118038][T13331] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 673.125732][T13331] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 673.135518][T13331] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 673.147760][T13331] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 673.189297][ T11] wlan1: Trigger new scan to find an IBSS to join [ 673.265418][T13348] mac80211_hwsim hwsim16 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 673.346671][T13354] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2569'. [ 673.412181][T13357] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2570'. [ 673.422381][T13357] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2570'. [ 673.434395][T13357] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2570'. [ 673.688891][T13362] netlink: 'syz.3.2573': attribute type 4 has an invalid length. [ 674.283995][ T1316] wlan1: Creating new IBSS network, BSSID c2:b8:25:fd:18:0a [ 674.292775][T13371] netlink: 'syz.3.2575': attribute type 10 has an invalid length. [ 674.311671][T13371] bridge0: port 2(bridge_slave_1) entered disabled state [ 674.320186][T13371] bridge0: port 1(bridge_slave_0) entered disabled state [ 674.371002][T13371] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.378347][T13371] bridge0: port 2(bridge_slave_1) entered forwarding state [ 674.386104][T13371] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.393454][T13371] bridge0: port 1(bridge_slave_0) entered forwarding state [ 674.419377][T13371] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 674.722911][T13378] mac80211_hwsim hwsim20 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 674.965212][T13387] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2581'. [ 675.240925][T13389] IPv6: NLM_F_CREATE should be specified when creating new route [ 675.357177][T13388] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 675.391398][T13388] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 675.497101][T13388] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 675.594530][T13398] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2583'. [ 675.604498][T13388] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 676.128344][T13398] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2583'. [ 676.153362][T13404] wlan0: mtu greater than device maximum [ 676.162714][T13401] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2583'. [ 676.225735][T13403] netlink: 'syz.2.2585': attribute type 4 has an invalid length. [ 676.331633][T13409] netlink: 'syz.1.2587': attribute type 10 has an invalid length. [ 676.614894][T13415] mac80211_hwsim hwsim20 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 676.679909][T13417] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.2591'. [ 676.934390][T13427] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2595'. [ 676.950638][T13427] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2595'. [ 676.975130][T13427] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2595'. [ 677.244483][T13432] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.2597'. [ 677.265799][ T59] wlan1: Trigger new scan to find an IBSS to join [ 677.526514][T13437] IPv6: NLM_F_CREATE should be specified when creating new route [ 678.009703][T13441] netlink: 'syz.2.2599': attribute type 10 has an invalid length. [ 678.050416][T13441] bridge0: port 2(bridge_slave_1) entered disabled state [ 678.058354][T13441] bridge0: port 1(bridge_slave_0) entered disabled state [ 678.093139][T13441] bridge0: port 2(bridge_slave_1) entered blocking state [ 678.100517][T13441] bridge0: port 2(bridge_slave_1) entered forwarding state [ 678.108136][T13441] bridge0: port 1(bridge_slave_0) entered blocking state [ 678.115466][T13441] bridge0: port 1(bridge_slave_0) entered forwarding state [ 678.171400][T13441] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 678.218468][T13448] wlan0: mtu greater than device maximum [ 678.374381][T13450] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.2601'. [ 678.403585][T13446] netlink: 'syz.1.2600': attribute type 4 has an invalid length. [ 678.777599][T13447] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 678.843074][T13447] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 678.961978][T13447] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 679.019527][T13447] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 679.204096][T12594] wlan1: Trigger new scan to find an IBSS to join [ 679.392139][T13463] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2605'. [ 679.419002][T13458] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 679.461311][T13463] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2605'. [ 680.207346][T13485] wlan0: mtu greater than device maximum [ 680.313630][T13486] netlink: 'syz.3.2612': attribute type 4 has an invalid length. [ 680.956976][T13490] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 681.240145][T13500] mac80211_hwsim hwsim16 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 681.481416][T13506] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 681.492189][T13506] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 681.507206][T13506] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 681.517096][T13506] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 682.070618][T13508] mac80211_hwsim hwsim16 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 682.156308][T13510] __nla_validate_parse: 6 callbacks suppressed [ 682.156352][T13510] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.2621'. [ 682.220020][T12835] wlan1: Trigger new scan to find an IBSS to join [ 682.345813][T13517] wlan0: mtu greater than device maximum [ 682.400075][T13517] netlink: 'syz.0.2622': attribute type 4 has an invalid length. [ 682.471864][T13519] netlink: 'syz.1.2624': attribute type 10 has an invalid length. [ 682.564064][T13524] wlan0: mtu greater than device maximum [ 682.587602][T13526] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2625'. [ 682.613452][T13526] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2625'. [ 682.643325][T13524] netlink: 'syz.0.2626': attribute type 4 has an invalid length. [ 682.678695][T13529] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2625'. [ 683.225386][ T11] wlan1: Trigger new scan to find an IBSS to join [ 683.232247][ T1081] wlan1: Trigger new scan to find an IBSS to join [ 683.870889][T13545] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.2636'. [ 684.068959][T13536] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 684.123419][ T1081] wlan1: Creating new IBSS network, BSSID f2:6d:b0:1d:dd:5b [ 684.221239][ T1081] wlan1: Trigger new scan to find an IBSS to join [ 684.453772][T13560] wlan0: mtu greater than device maximum [ 684.500245][T13562] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2641'. [ 684.509510][T13562] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2641'. [ 684.520540][T13562] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2641'. [ 684.555778][T13556] netlink: 'syz.2.2639': attribute type 4 has an invalid length. [ 685.158862][T13575] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 685.385605][T13580] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.2648'. [ 685.707976][T13595] FAULT_INJECTION: forcing a failure. [ 685.707976][T13595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 685.735777][T13595] CPU: 1 PID: 13595 Comm: syz.3.2654 Not tainted syzkaller #0 [ 685.743350][T13595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 685.753558][T13595] Call Trace: [ 685.756978][T13595] [ 685.759958][T13595] dump_stack_lvl+0x18c/0x250 [ 685.764721][T13595] ? show_regs_print_info+0x20/0x20 [ 685.770180][T13595] ? load_image+0x420/0x420 [ 685.774756][T13595] ? __might_fault+0xaa/0x120 [ 685.779510][T13595] ? __lock_acquire+0x7d80/0x7d80 [ 685.784606][T13595] ? rawv6_sendmsg+0x1229/0x1740 [ 685.789714][T13595] ? __virt_addr_valid+0x10c/0x380 [ 685.794896][T13595] should_fail_ex+0x394/0x4c0 [ 685.799681][T13595] _copy_from_user+0x2f/0xe0 [ 685.804518][T13595] csum_and_copy_from_iter+0x46e/0x1480 [ 685.810145][T13595] ? iov_iter_get_pages_alloc2+0xc0/0xc0 [ 685.815873][T13595] ? __kmem_cache_alloc_node+0x194/0x250 [ 685.821585][T13595] ? __alloc_skb+0x138/0x2c0 [ 685.826234][T13595] ? rcu_is_watching+0x15/0xb0 [ 685.831071][T13595] ip_generic_getfrag+0x163/0x2f0 [ 685.836237][T13595] ? ip_skb_dst_mtu+0x9c0/0x9c0 [ 685.841135][T13595] ? raw6_getfrag+0x11d/0x390 [ 685.845863][T13595] ? __alloc_skb+0x1b2/0x2c0 [ 685.850498][T13595] ? skb_put+0x112/0x210 [ 685.854804][T13595] __ip6_append_data+0x2f0e/0x3ca0 [ 685.860104][T13595] ? rawv6_send_hdrinc+0x1660/0x1660 [ 685.865452][T13595] ? ip6_mtu+0x7d/0x3f0 [ 685.869670][T13595] ? ip6_setup_cork+0xff0/0xff0 [ 685.874573][T13595] ip6_append_data+0x1b0/0x350 [ 685.879393][T13595] ? rawv6_send_hdrinc+0x1660/0x1660 [ 685.884723][T13595] rawv6_sendmsg+0x1229/0x1740 [ 685.889541][T13595] ? compat_rawv6_ioctl+0x70/0x70 [ 685.894614][T13595] ? aa_sk_perm+0x83c/0x970 [ 685.899165][T13595] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 685.905651][T13595] ? inet_sendmsg+0x7e/0x2a0 [ 685.910315][T13595] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 685.915650][T13595] ? inet_send_prepare+0x250/0x250 [ 685.920809][T13595] ____sys_sendmsg+0x61b/0x980 [ 685.925630][T13595] ? __sys_sendmsg_sock+0x30/0x30 [ 685.930700][T13595] ? __import_iovec+0x3fa/0x850 [ 685.935603][T13595] ? import_iovec+0x73/0xa0 [ 685.940192][T13595] ___sys_sendmsg+0x2a6/0x360 [ 685.944946][T13595] ? get_pid_task+0x20/0x1e0 [ 685.949608][T13595] ? __sys_sendmsg+0x2b0/0x2b0 [ 685.954521][T13595] ? __lock_acquire+0x7d80/0x7d80 [ 685.959631][T13595] __se_sys_sendmsg+0x1d0/0x2c0 [ 685.964542][T13595] ? __x64_sys_sendmsg+0x80/0x80 [ 685.969551][T13595] ? lockdep_hardirqs_on+0x98/0x150 [ 685.974795][T13595] do_syscall_64+0x55/0xb0 [ 685.979269][T13595] ? clear_bhb_loop+0x40/0x90 [ 685.983975][T13595] ? clear_bhb_loop+0x40/0x90 [ 685.988692][T13595] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 685.994636][T13595] RIP: 0033:0x7f318579de59 [ 685.999094][T13595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 686.018747][T13595] RSP: 002b:00007f318671f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 686.027203][T13595] RAX: ffffffffffffffda RBX: 00007f3185a25fa0 RCX: 00007f318579de59 [ 686.035214][T13595] RDX: 000000000000ff00 RSI: 0000200000001180 RDI: 0000000000000003 [ 686.043225][T13595] RBP: 00007f318671f090 R08: 0000000000000000 R09: 0000000000000000 [ 686.051319][T13595] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 686.059359][T13595] R13: 00007f3185a26038 R14: 00007f3185a25fa0 R15: 00007ffde34363d8 [ 686.067386][T13595] [ 686.143427][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.152986][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.237064][T13605] wlan0: mtu greater than device maximum [ 686.327114][T13601] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 686.347546][T13605] netlink: 'syz.3.2657': attribute type 4 has an invalid length. [ 686.468783][T13610] netlink: 'syz.2.2659': attribute type 10 has an invalid length. [ 686.480392][T13610] macvlan1: entered allmulticast mode [ 686.499648][T13610] veth1_vlan: entered allmulticast mode [ 686.527191][T13610] team0: Port device macvlan1 added [ 687.259515][ T1316] wlan1: Trigger new scan to find an IBSS to join [ 688.228873][ T1316] wlan1: Trigger new scan to find an IBSS to join [ 688.839485][T13626] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 688.976299][T13629] netlink: 'syz.0.2674': attribute type 10 has an invalid length. [ 688.996314][T13631] wlan0: mtu greater than device maximum [ 689.046679][T13633] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.2665'. [ 689.089513][T13631] netlink: 'syz.2.2666': attribute type 4 has an invalid length. [ 690.630218][T13641] mac80211_hwsim hwsim14 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 691.182431][ T59] wlan1: Trigger new scan to find an IBSS to join [ 692.219303][T12594] wlan1: Creating new IBSS network, BSSID 3e:b0:99:51:b8:cb [ 692.421983][T12835] wlan1: Creating new IBSS network, BSSID 1e:66:e1:41:28:8e [ 692.433819][T13657] mac80211_hwsim hwsim20 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 692.466829][T13664] wlan0: mtu greater than device maximum [ 692.500127][T13665] netlink: 'syz.1.2678': attribute type 4 has an invalid length. [ 692.749043][T13673] netlink: 'syz.2.2681': attribute type 10 has an invalid length. [ 692.829706][T13673] veth1_vlan: left allmulticast mode [ 693.260157][T12835] wlan1: Trigger new scan to find an IBSS to join [ 695.264487][T12594] wlan1: Trigger new scan to find an IBSS to join [ 696.219397][T13677] wlan0: mtu greater than device maximum [ 696.293485][T13681] FAULT_INJECTION: forcing a failure. [ 696.293485][T13681] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 696.309605][T13681] CPU: 1 PID: 13681 Comm: syz.0.2684 Not tainted syzkaller #0 [ 696.318132][T13681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 696.328805][T13681] Call Trace: [ 696.332253][T13681] [ 696.335291][T13681] dump_stack_lvl+0x18c/0x250 [ 696.340264][T13681] ? show_regs_print_info+0x20/0x20 [ 696.345752][T13681] ? load_image+0x420/0x420 [ 696.350391][T13681] ? __might_fault+0xaa/0x120 [ 696.355374][T13681] ? __lock_acquire+0x7d80/0x7d80 [ 696.360945][T13681] should_fail_ex+0x394/0x4c0 [ 696.365714][T13681] _copy_from_user+0x2f/0xe0 [ 696.373675][T13681] ___sys_sendmsg+0x1c7/0x360 [ 696.381904][T13681] ? __sys_sendmsg+0x2b0/0x2b0 [ 696.388063][T13681] ? __lock_acquire+0x7d80/0x7d80 [ 696.393640][T13681] __se_sys_sendmsg+0x1d0/0x2c0 [ 696.400689][T13681] ? perf_trace_preemptirq_template+0x269/0x330 [ 696.408206][T13681] ? __x64_sys_sendmsg+0x80/0x80 [ 696.413509][T13681] ? lockdep_hardirqs_on+0x98/0x150 [ 696.419433][T13681] do_syscall_64+0x55/0xb0 [ 696.423939][T13681] ? clear_bhb_loop+0x40/0x90 [ 696.429533][T13681] ? clear_bhb_loop+0x40/0x90 [ 696.435338][T13681] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 696.441343][T13681] RIP: 0033:0x7fb427d9de59 [ 696.446054][T13681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 696.466724][T13681] RSP: 002b:00007fb428c9f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 696.475583][T13681] RAX: ffffffffffffffda RBX: 00007fb428025fa0 RCX: 00007fb427d9de59 [ 696.484518][T13681] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 0000000000000006 [ 696.492648][T13681] RBP: 00007fb428c9f090 R08: 0000000000000000 R09: 0000000000000000 [ 696.500799][T13681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 696.509222][T13681] R13: 00007fb428026038 R14: 00007fb428025fa0 R15: 00007ffe3d70a1c8 [ 696.518006][T13681] [ 696.766234][T13684] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.2686'. [ 696.896493][T13693] netlink: 'syz.0.2690': attribute type 10 has an invalid length. [ 697.737766][T13691] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 698.229159][T12594] wlan1: Trigger new scan to find an IBSS to join [ 698.702283][T12145] Bluetooth: hci4: command 0x0406 tx timeout [ 699.260792][ T59] wlan1: Trigger new scan to find an IBSS to join [ 699.811186][T12835] wlan1: Creating new IBSS network, BSSID a2:30:5c:93:49:7a [ 699.831735][T13703] mac80211_hwsim hwsim18 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 699.850498][T13710] wlan0: mtu greater than device maximum [ 699.879714][T13711] netlink: 'syz.0.2693': attribute type 4 has an invalid length. [ 699.970572][T13718] wlan0: mtu greater than device maximum [ 700.021119][T13718] netlink: 'syz.3.2695': attribute type 4 has an invalid length. [ 700.056310][T13722] netlink: 'syz.0.2697': attribute type 10 has an invalid length. [ 701.372837][T12835] wlan1: Creating new IBSS network, BSSID 7a:44:18:25:69:35 [ 701.398364][T13730] mac80211_hwsim hwsim20 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 701.406334][T12835] ------------[ cut here ]------------ [ 701.413918][T12835] WARNING: CPU: 1 PID: 12835 at net/wireless/ibss.c:37 __cfg80211_ibss_joined+0x3cb/0x430 [ 701.425622][T12835] Modules linked in: [ 701.430404][T12835] CPU: 1 PID: 12835 Comm: kworker/u4:7 Not tainted syzkaller #0 [ 701.438580][T12835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 701.449593][T12835] Workqueue: cfg80211 cfg80211_event_work [ 701.453323][T13733] netlink: 'syz.3.2702': attribute type 10 has an invalid length. [ 701.455656][T12835] RIP: 0010:__cfg80211_ibss_joined+0x3cb/0x430 [ 701.471875][T12835] Code: 04 25 28 00 00 00 48 3b 44 24 60 75 57 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2e c9 9a f7 0f 0b eb bf e8 25 c9 9a f7 <0f> 0b eb b6 e8 1c c9 9a f7 0f 0b e9 e2 fd ff ff e8 10 c9 9a f7 0f [ 701.492202][T12835] RSP: 0000:ffffc90003447a40 EFLAGS: 00010293 [ 701.498510][T12835] RAX: ffffffff89ec1c2b RBX: dffffc0000000000 RCX: ffff88802746da00 [ 701.511380][T12835] RDX: 0000000000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1cf820 [ 701.520873][T12835] RBP: ffffc90003447af8 R08: ffffffff911e756f R09: 1ffffffff223cead [ 701.530566][T12835] R10: dffffc0000000000 R11: fffffbfff223ceae R12: ffff888025080d10 [ 701.539741][T12835] R13: ffff888059beb618 R14: 1ffff92000688f4c R15: 000000000000001f [ 701.547801][T12835] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 701.560697][T12835] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 701.567361][T12835] CR2: 000055ae355a1cf0 CR3: 000000000cf32000 CR4: 00000000003506e0 [ 701.576243][T12835] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 701.584912][T12835] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 701.593203][T12835] Call Trace: [ 701.596550][T12835] [ 701.599615][T12835] ? trace_rdev_return_void+0x1c0/0x1c0 [ 701.605704][T12835] cfg80211_process_wdev_events+0x396/0x500 [ 701.612363][T12835] cfg80211_process_rdev_events+0xa1/0x110 [ 701.618249][T12835] cfg80211_event_work+0x2f/0x40 [ 701.623346][T12835] ? process_scheduled_works+0x975/0x1600 [ 701.629711][T12835] process_scheduled_works+0xa60/0x1600 [ 701.636047][T12835] ? worker_attach_to_pool+0x370/0x370 [ 701.642419][T12835] ? assign_work+0x3cc/0x5d0 [ 701.647264][T12835] worker_thread+0xa5e/0xfe0 [ 701.652325][T12835] ? _raw_spin_unlock+0x40/0x40 [ 701.657398][T12835] ? __kthread_parkme+0x71/0x1c0 [ 701.662529][T12835] kthread+0x2fa/0x390 [ 701.666779][T12835] ? pr_cont_work+0x550/0x550 [ 701.671772][T12835] ? kthread_blkcg+0xd0/0xd0 [ 701.676526][T12835] ret_from_fork+0x48/0x80 [ 701.681303][T12835] ? kthread_blkcg+0xd0/0xd0 [ 701.686009][T12835] ret_from_fork_asm+0x11/0x20 [ 701.691047][T12835] [ 701.694180][T12835] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 701.701612][T12835] CPU: 1 PID: 12835 Comm: kworker/u4:7 Not tainted syzkaller #0 [ 701.709310][T12835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 701.719424][T12835] Workqueue: cfg80211 cfg80211_event_work [ 701.725213][T12835] Call Trace: [ 701.728549][T12835] [ 701.731521][T12835] dump_stack_lvl+0x18c/0x250 [ 701.736873][T12835] ? show_regs_print_info+0x20/0x20 [ 701.742134][T12835] ? load_image+0x420/0x420 [ 701.746729][T12835] panic+0x2ca/0x720 [ 701.750695][T12835] ? bpf_jit_dump+0xd0/0xd0 [ 701.755281][T12835] ? ret_from_fork_asm+0x11/0x20 [ 701.760281][T12835] __warn+0x2e0/0x470 [ 701.764307][T12835] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 701.769904][T12835] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 701.775501][T12835] report_bug+0x2be/0x4f0 [ 701.779954][T12835] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 701.785547][T12835] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 701.791150][T12835] ? __cfg80211_ibss_joined+0x3cd/0x430 [ 701.796737][T12835] handle_bug+0xcf/0x120 [ 701.801218][T12835] exc_invalid_op+0x1a/0x50 [ 701.805864][T12835] asm_exc_invalid_op+0x1a/0x20 [ 701.810939][T12835] RIP: 0010:__cfg80211_ibss_joined+0x3cb/0x430 [ 701.817140][T12835] Code: 04 25 28 00 00 00 48 3b 44 24 60 75 57 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 2e c9 9a f7 0f 0b eb bf e8 25 c9 9a f7 <0f> 0b eb b6 e8 1c c9 9a f7 0f 0b e9 e2 fd ff ff e8 10 c9 9a f7 0f [ 701.836884][T12835] RSP: 0000:ffffc90003447a40 EFLAGS: 00010293 [ 701.843014][T12835] RAX: ffffffff89ec1c2b RBX: dffffc0000000000 RCX: ffff88802746da00 [ 701.851045][T12835] RDX: 0000000000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1cf820 [ 701.859057][T12835] RBP: ffffc90003447af8 R08: ffffffff911e756f R09: 1ffffffff223cead [ 701.867077][T12835] R10: dffffc0000000000 R11: fffffbfff223ceae R12: ffff888025080d10 [ 701.875100][T12835] R13: ffff888059beb618 R14: 1ffff92000688f4c R15: 000000000000001f [ 701.883131][T12835] ? __cfg80211_ibss_joined+0x3cb/0x430 [ 701.888777][T12835] ? trace_rdev_return_void+0x1c0/0x1c0 [ 701.894973][T12835] cfg80211_process_wdev_events+0x396/0x500 [ 701.900933][T12835] cfg80211_process_rdev_events+0xa1/0x110 [ 701.906829][T12835] cfg80211_event_work+0x2f/0x40 [ 701.911918][T12835] ? process_scheduled_works+0x975/0x1600 [ 701.917695][T12835] process_scheduled_works+0xa60/0x1600 [ 701.923316][T12835] ? worker_attach_to_pool+0x370/0x370 [ 701.928885][T12835] ? assign_work+0x3cc/0x5d0 [ 701.933672][T12835] worker_thread+0xa5e/0xfe0 [ 701.938332][T12835] ? _raw_spin_unlock+0x40/0x40 [ 701.943228][T12835] ? __kthread_parkme+0x71/0x1c0 [ 701.948211][T12835] kthread+0x2fa/0x390 [ 701.952432][T12835] ? pr_cont_work+0x550/0x550 [ 701.957236][T12835] ? kthread_blkcg+0xd0/0xd0 [ 701.961972][T12835] ret_from_fork+0x48/0x80 [ 701.966522][T12835] ? kthread_blkcg+0xd0/0xd0 [ 701.971238][T12835] ret_from_fork_asm+0x11/0x20 [ 701.976316][T12835] [ 701.979942][T12835] Kernel Offset: disabled [ 701.984376][T12835] Rebooting in 86400 seconds..