last executing test programs: 39m18.919467277s ago: executing program 1 (id=905): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0xf, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000020000000000000060b4000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014001000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 39m18.853644718s ago: executing program 1 (id=906): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0x9, &(0x7f0000000400)=@raw=[@generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x3f}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 39m18.752792291s ago: executing program 1 (id=907): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xb, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa10000000000000701"], 0x0, 0xfffff7ff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1900000004000000080000000a"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x9, 0x2, 0x56d, 0x2}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000000100000000000000000000850000007500000095"], 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 39m18.720431661s ago: executing program 1 (id=908): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000009e00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @fallback=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001980)=ANY=[@ANYBLOB="0e00000004000000080000000a"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000057f18110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 39m18.652577203s ago: executing program 1 (id=909): bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000010000000000000000000000711819000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x3, '\x00', 0x0, @cgroup_sock_addr=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 39m18.544626836s ago: executing program 1 (id=910): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f00"], 0x0, 0xfffffdfe, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x410, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0x0, 0x56}, 0x28) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x22, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00010000000000000010000000000000000040f900"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000580), 0x0}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000b00)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6493790710000000000080000b2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249f21c6eee84309e7a23c19a394830f2539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bfb1c0e6b1244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbb888b0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f94479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b844139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323478a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526894aa7fe5e68949a3b304723177d356c4604bca492ecec37e83efceefd78a2533659edc8bef9cb85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e5a61561a9845e4ff29e2bd43b5b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c3c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebcef5af469abe753314fae31a09c3a041a1e7b55c4e81dba1e12289ee34463aaf28345bde0c195bc9f022ca8ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a0600adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa7000008000000000000117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cd50feeb7bfad9b7be3283b6450d34264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5a71e0d7696caba172745c7dd919ffb631820420b75b6522c0e21c882c66f4f25ffb6d95e07e068000000000000eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff201000000000000002e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa66237e0dacc107f532348cc2116473381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6f0100000000000000f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d174b0000000000000000000000fa08ad0731ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282b6caa2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae0533496b6d58da50ee80a6b9a7438978c5465113f668eb4484350048289d07dbef325d3221a7cb35f812f257941a9781e3214c2a3dcf89d99844b762a9cf17548c54fccad2c7ae8072b82e0880815daf966bd5343c1635e123f868a7167cfcff33320253af570f4ef9c0254afdd89ac3943562b530dd88da8a94013bbaf204bebc38055adc39f07f7c22711f4d1f6dcc928d1578a093c072e0b92babc76f47ee367e745a024a2278319d9a4d1378482b74c516647652bfb6e93002494a5cd74e2a9a4734487062437da23e1efa6ef7674108aaa3ffac859c3577c2637bb3bdc69bc365b1f20dba96b8acca62f3f80045318de0facf2ed44b814e842c2a520159bb6c320cec0910c0b8bd3d547bdfba2e09d24d117ed0388afd37affbad2f9c77c9c1314a16ffe64f5e3744a2fffd7039670f5706e589a4c3868db06fd892d68a547477f8ef686ff0dba7b8c18c94d5a89b0567a851750a35d9cc2217db890d89385fcaa00f0f2e524672e6f4c8bedfd5da5b157709b8265cf511dc5846ab1d85916c4a6b2d1b408575982e11230cbac0a9c6eaa03c945645581f678403c2a936c53ae72940aa92bcf22b82c6bc028e0acdddf9fef595f0f7a9f80c0e4c659ced769ec463d26a81e468846761a8e1efd6a031ab7adc8665e267be0065cc315aa23012423ec8b8492d9b50fa4d8c5891959b761eec6dc988532782fda13239c948e27853606e26225c796b79cc04f3d1a5a13000000001e301d82a27010d3ac6119d2b12caf282413672d20c852c50084d7b2d50754775ed63bc18023c31351af76e24788d96103455693b34e09a163a9f613a7e5530222cebd7fa0fbff32dc98088f9fab33648cc38e87dd2dd6ee157f5f018702696915661715c979b7796d4f101a257688af7c148e8615c938c4ca8a69f6fc585ec1dd1857a501f90b161eff23181a11a2b0da4c58d459cbf9db"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000600)={0x5, 0x80, 0xff, 0xfe, 0x0, 0x0, 0x0, 0x401, 0x80260, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x3, @perf_bp={0x0, 0x4}, 0x8e00, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f00000004c0), 0x4}, 0x4105, 0x0, 0x3}, 0x0, 0xfeffffffffffffff, 0xffffffffffffffff, 0x2) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000780)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd11=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x33, &(0x7f0000000040), 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x400800, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000001c0), 0x4) openat$cgroup_ro(r5, &(0x7f0000000080)='memory.numa_stat\x00', 0x80040, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r8, 0x18000000000002a0, 0xfb, 0x0, &(0x7f0000000100)="b9ff03076044238cb89e14f008000de0ffff00184000632f77fbac141412e000002062079f4b4d2f87e5feca6aab845013f2325f1a3903050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000", 0x0, 0xfe, 0x60000000, 0x3f, 0x4c, &(0x7f0000000040)="ded6e0966ec1cf6ba4b897a54e4e062b311453dcbb62932a01105d0a8066ca8e5e1f2f575d0d6e996b57fd408d420abb7337934e59815d75b4eb3e7206afce", &(0x7f0000000380)="af5fa441b438b5156d8a9fcc090f586e979858f64170cde36889dcc8539ffcca62621a4c3ea3f7acee366e6fb0b94314f90931dec60fed6c9fee64af416c29f65e47110b81f6b4da06db5e1a", 0x0, 0x3}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r7) syz_clone(0x40100000, 0x0, 0x0, 0x0, 0x0, 0x0) 39m3.412967085s ago: executing program 32 (id=910): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x13, 0x5, &(0x7f0000000440)=ANY=[@ANYBLOB="1809000000ffffff00000000000000008510000002000000850000000f00"], 0x0, 0xfffffdfe, 0x0, 0x0, 0x727c45cd4283345, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) r0 = perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x410, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0x0, 0x56}, 0x28) r2 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x22, &(0x7f00000000c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00010000000000000010000000000000000040f900"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r1}, &(0x7f0000000580), 0x0}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000000b00)=ANY=[@ANYBLOB="850000002a00000025000000000000009500000000000000afcd48d6493790710000000000080000b2c6161dba392176dd2963038e1d69ba7ea94c500dc4ef2fad96ed406f21caf5adcf920569c00cc1199684fa7c93836d9ea2cfb0e60436e05425cc4686b066707de94a4f4d5fc79c987d669f381faca0f9d9924be41a9169bdfaf16da915b2e249f21c6eee84309e7a23c19a394830f2539fcb4e0b6eab1aa7d55545a34effa077faa55c59e88254f54077f799bf168301000000bfb1c0e6b1244d35b213bda84cc172afcc2e47a7d8b85a5e3d77ac463920e231b7ae0da8616d2b7958f91f5da6c025d060ab186d94af98af1da2b5952eb15855933a212304e035f7a35dfc72c81256a55a25f8fe3b28d7e53c78fbb888b0255f347160ec83070000000000004015cf10453f6c0b973b81a484ebad04859d928365a7ea3fab2e4b380a00d72bc0480f94479757306720399379d9271cf555c14d56b51c2298237bebfc08e0d5976a942b844139f1111f2dc5e46ac1c60a9b030074bfbcd4b09012175484135f0e519f0b1e4aaa026d570ecb5e8cddbed65ff702000000a3ff4f8a4cf796b07a6ff61c5552417fd703f7f14d8b78a602ca3cdf6a662d8bc9c89c9120072a5d00dcdd8595356c9b2492aaf1264d4ef4a410c882834867bcd2b6e558d17879570c8ad943e392955f4f979ea13201bafe4f0f6ea508000000a0c548552b571bed5647323478a996810000000571cbb17d9f37282462f0e9c147c0d497c61433c6ccc35601eef97ee611be8c97f4151fcda6cb799c6e924966a7f90bf8fd1e75ee76bd72346cfbb526894aa7fe5e68949a3b304723177d356c4604bca492ecec37e83efceefd78a2533659edc8bef9cb85451c6a145074343caea5c4bf690441974b155f5adc681a03c0bbb8358856175e2ce8b0cbbbe3c033e54ffcebde1d9d3d350000000000000000e0f209150a07682c4e14e3a83558df6f3fc97f1730a136bdee07e98cb984b2e2304a1b63afefdb636e56bbaae4e62136574bc6371a0bb2be1a962aae9c1258da6ef590e1d85ea9e12b3025f43e7e08ccffc5064dea4c39cf4b98e1fc6efb5978f51e16b678eca0b658a56008948e5a61561a9845e4ff29e2bd43b5b923b272341c5e093fd66a2946501559335781092cf8ce987c56cd31121624d7455f2a3666276c3c0e812b28e2f30d035cee5d0e77a3c72208ec651cc0ae637fa474816bc59d2e2a00092419304b338a987e9d3044d856ce24f370030be3b5f79f030b8d3ebcef5af469abe753314fae31a09c3a041a1e7b55c4e81dba1e12289ee34463aaf28345bde0c195bc9f022ca8ce37ed85464c31679053e7f9d04bb5cb51da0b7958989fd70f241262d0af3246eb4fc4bda345360200000001fbddeacd3adaa4d2715e21c772ccd44341f7fd53df58ae791ee8b489a7c9efe3625a9d971b5997485d6a063dc6f7359e2eccc2fb39d419de1a7b5c9dc22c96295a0600adf59d44e58eb1c60b3475be31a9b7cf42b6402312d2725b8d9fa7000008000000000000117ca65fc86c2dce97aa03279a66ec87122219b0f796ab92b1adecae50fdb408c8a80f7f02f750d6c977a1919f9f69a6cfefdf879d447df53f3b9b70d10355b07466d1ef0056b5af553d18a6cd50feeb7bfad9b7be3283b6450d34264e7712d2f1d7004548b19162cef04d18d4f5987baab97a9bfbd8f185b5a71e0d7696caba172745c7dd919ffb631820420b75b6522c0e21c882c66f4f25ffb6d95e07e068000000000000eb5b63e45d5d80fe52734093ae5aa3c0b4f3f45bfff201000000000000002e31560e5b741445ea2a1acee2e98c9f3427834ba0a765d20b30f87af976a46f9a9a1ac7dea1ea6845f9aa66237e0dacc107f532348cc2116473381e961f3d9c8c21578fe3245097c280abe51427b9f6cd72b5da6d0252803c66730cd5eac907f09b9695906313f8873522608c6f0100000000000000f721303e6b89e5c54d680ac66d09af90dbf50ee69a39265964279d174b0000000000000000000000fa08ad0731ba49fbf981f8265e7f1f4c2d97f4680b135f87c228ce69418a282b6caa2481a0df1774fa7d94944bb92d2b89f73f0e8b63f6316c5762f3288bc970720f48b5647dd177db6810fae0533496b6d58da50ee80a6b9a7438978c5465113f668eb4484350048289d07dbef325d3221a7cb35f812f257941a9781e3214c2a3dcf89d99844b762a9cf17548c54fccad2c7ae8072b82e0880815daf966bd5343c1635e123f868a7167cfcff33320253af570f4ef9c0254afdd89ac3943562b530dd88da8a94013bbaf204bebc38055adc39f07f7c22711f4d1f6dcc928d1578a093c072e0b92babc76f47ee367e745a024a2278319d9a4d1378482b74c516647652bfb6e93002494a5cd74e2a9a4734487062437da23e1efa6ef7674108aaa3ffac859c3577c2637bb3bdc69bc365b1f20dba96b8acca62f3f80045318de0facf2ed44b814e842c2a520159bb6c320cec0910c0b8bd3d547bdfba2e09d24d117ed0388afd37affbad2f9c77c9c1314a16ffe64f5e3744a2fffd7039670f5706e589a4c3868db06fd892d68a547477f8ef686ff0dba7b8c18c94d5a89b0567a851750a35d9cc2217db890d89385fcaa00f0f2e524672e6f4c8bedfd5da5b157709b8265cf511dc5846ab1d85916c4a6b2d1b408575982e11230cbac0a9c6eaa03c945645581f678403c2a936c53ae72940aa92bcf22b82c6bc028e0acdddf9fef595f0f7a9f80c0e4c659ced769ec463d26a81e468846761a8e1efd6a031ab7adc8665e267be0065cc315aa23012423ec8b8492d9b50fa4d8c5891959b761eec6dc988532782fda13239c948e27853606e26225c796b79cc04f3d1a5a13000000001e301d82a27010d3ac6119d2b12caf282413672d20c852c50084d7b2d50754775ed63bc18023c31351af76e24788d96103455693b34e09a163a9f613a7e5530222cebd7fa0fbff32dc98088f9fab33648cc38e87dd2dd6ee157f5f018702696915661715c979b7796d4f101a257688af7c148e8615c938c4ca8a69f6fc585ec1dd1857a501f90b161eff23181a11a2b0da4c58d459cbf9db"], &(0x7f0000000000)='GPL\x00', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r3) r4 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000600)={0x5, 0x80, 0xff, 0xfe, 0x0, 0x0, 0x0, 0x401, 0x80260, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x3, @perf_bp={0x0, 0x4}, 0x8e00, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f00000004c0), 0x4}, 0x4105, 0x0, 0x3}, 0x0, 0xfeffffffffffffff, 0xffffffffffffffff, 0x2) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000780)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x3b, &(0x7f0000000000)='/proc/sys/net/ipv4\x00\x00s/sync_\x00le\xf44.\xab%nN\xd4\xa2\x88\x00\xd11=\x11\xc8\xdd\x15\xcc\xd2\xf1d\'%\x11c\x91l,'}, 0x30) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r6, 0x1, 0x33, &(0x7f0000000040), 0x4) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x400800, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000001c0), 0x4) openat$cgroup_ro(r5, &(0x7f0000000080)='memory.numa_stat\x00', 0x80040, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000c80)=ANY=[@ANYBLOB], &(0x7f0000000340)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r8, 0x18000000000002a0, 0xfb, 0x0, &(0x7f0000000100)="b9ff03076044238cb89e14f008000de0ffff00184000632f77fbac141412e000002062079f4b4d2f87e5feca6aab845013f2325f1a3903050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000", 0x0, 0xfe, 0x60000000, 0x3f, 0x4c, &(0x7f0000000040)="ded6e0966ec1cf6ba4b897a54e4e062b311453dcbb62932a01105d0a8066ca8e5e1f2f575d0d6e996b57fd408d420abb7337934e59815d75b4eb3e7206afce", &(0x7f0000000380)="af5fa441b438b5156d8a9fcc090f586e979858f64170cde36889dcc8539ffcca62621a4c3ea3f7acee366e6fb0b94314f90931dec60fed6c9fee64af416c29f65e47110b81f6b4da06db5e1a", 0x0, 0x3}, 0x50) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, r7) syz_clone(0x40100000, 0x0, 0x0, 0x0, 0x0, 0x0) 7.068122753s ago: executing program 4 (id=13953): perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext={0x0, 0x3}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000500)=ANY=[], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001780)={0x0, 0xfffffffffffffddf, 0x0}, 0x20000041) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000001c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x30, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, 0x0}, 0x0) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000001700)={0x0, 0x0, 0x0}, 0x20000010) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000002"], 0x48) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x890b, &(0x7f0000000100)) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x890c, &(0x7f0000000100)) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0x0, 0x0, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) sendmsg$inet(0xffffffffffffffff, 0x0, 0x3) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x40000100) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8800) socket$kcm(0x10, 0x3, 0x10) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x40107447, &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b6a3e31400000000dd0a00000000000073013c00fff300870095000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000}, 0x48) perf_event_open(0x0, 0x0, 0x100000000, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) 6.858243208s ago: executing program 4 (id=13955): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1b00000d00000000000000000080000000000000", @ANYRES32, @ANYBLOB="0300"/15, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1f, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="180000007f000000000000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000001008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020002010000008500000084000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000020000200000000002000000850000002000000085000000a000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b70400000000"], 0x0, 0x100}, 0x94) socketpair(0x1, 0x2, 0x0, &(0x7f00000002c0)) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'], 0x30}, 0x890) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x49c8, 0x0, 0xfffffffc, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0600000004000000080000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000500000000000000000000000000000000000000d883ea2360d14def1fa85ed6677c5e79608078df7699aa1bcce9a8d91eb0eebf4141bdd18819d724070a3ab02fc707433168e3f4131600074930"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000001280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r5, 0x2000002, 0xe, 0xfffffffffffffda9, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42082, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xffffffffffffffc1, 0xa5}, 0x0, 0x10, 0x4, 0x8, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000780)={0x5, 0x80, 0x6, 0xf5, 0x5, 0x9, 0x0, 0x1, 0x2, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0x8}, 0x1192b, 0x8, 0xa, 0x4, 0x318, 0x8ebc, 0x9, 0x0, 0x93b1, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x89a0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89a2, &(0x7f0000000080)) 6.636566053s ago: executing program 4 (id=13960): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1b00000d00000000000000000080000000000000", @ANYRES32, @ANYBLOB="0300"/15, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1f, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="180000007f000000000000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000001008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020002010000008500000084000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000020000200000000002000000850000002000000085000000a000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b70400000000"], 0x0, 0x100}, 0x94) socketpair(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r4, &(0x7f0000000140)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'], 0x30}, 0x890) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x49c8, 0x0, 0xfffffffc, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0600000004000000080000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000500000000000000000000000000000000000000d883ea2360d14def1fa85ed6677c5e79608078df7699aa1bcce9a8d91eb0eebf4141bdd18819d724070a3ab02fc707433168e3f4131600074930"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0xa, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000001280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42082, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xffffffffffffffc1, 0xa5}, 0x0, 0x10, 0x4, 0x8, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000780)={0x5, 0x80, 0x6, 0xf5, 0x5, 0x9, 0x0, 0x1, 0x2, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0x8}, 0x1192b, 0x8, 0xa, 0x4, 0x318, 0x8ebc, 0x9, 0x0, 0x93b1, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89a2, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89a1, &(0x7f0000000080)) 5.834234252s ago: executing program 4 (id=13967): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d08000b000000e8fe55a1180015000600142603600e1209000d0000000401a80016000a00014006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4ed", 0xcb}], 0x1}, 0x0) 5.671444966s ago: executing program 4 (id=13970): r0 = socket$kcm(0x2, 0x3, 0x106) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0xfffd, @remote}, 0x10, &(0x7f0000000c00)=[{&(0x7f0000000700)="fbd2b9ed29d8974a6ce75f08916a", 0xe}, {&(0x7f00000007c0)}], 0x2}, 0x0) 5.48523829s ago: executing program 4 (id=13973): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) syz_clone(0x62005000, 0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x0, 0x9922, 0x2, 0x0, 0x0, 0xe, 0x0, 0x6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x1) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={0xffffffffffffffff, 0x27, 0x2, 0x0, &(0x7f0000000180)="0005", 0x0, 0x405, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0}, 0x50) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[@ANYRES8=r1], 0x9a) 2.000501023s ago: executing program 0 (id=13985): perf_event_open(&(0x7f0000000680)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, @perf_config_ext={0x0, 0x3}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000880)={0x18, 0x3, &(0x7f0000000500)=ANY=[], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001780)={0x0, 0xfffffffffffffddf, 0x0}, 0x20000041) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000001c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x30, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, 0x0}, 0x0) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x400000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$inet(r2, &(0x7f0000001700)={0x0, 0x0, 0x0}, 0x20000010) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="000000000000000002"], 0x48) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x890b, &(0x7f0000000100)) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x890c, &(0x7f0000000100)) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext, 0x108282, 0x0, 0x0, 0x1, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) sendmsg$inet(0xffffffffffffffff, 0x0, 0x3) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) recvmsg(0xffffffffffffffff, 0x0, 0x40000100) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x8800) socket$kcm(0x10, 0x3, 0x10) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x40107447, &(0x7f0000000180)) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b6a3e31400000000dd0a00000000000073013c00fff300870095000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x68000000}, 0x48) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) 1.634036011s ago: executing program 0 (id=13987): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d08000b000000e8fe55a1180015000600142603600e1209000d0000000401a80016000a00014006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4ed", 0xcb}], 0x1}, 0x0) 1.531324694s ago: executing program 0 (id=13988): perf_event_open(&(0x7f0000000140)={0x4, 0x80, 0x1c, 0x1, 0x2, 0x58, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x19, 0x1, @perf_config_ext={0x100000005}, 0x10c002, 0x400, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000050000000000000080000000850000007b00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000018000007b8af8ff00000000bfa200000000000007020000f8ffffffb703dc0008000000b70400000200000085000000a60000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000a40)={0xffffffffffffffff, 0xe0, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000400), &(0x7f0000000440)=[0x0], 0x0, 0x5a, 0x0, 0x0, 0x10, &(0x7f0000000100), &(0x7f0000000680), 0x8, 0x10d8, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0x5, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2}, 0x94) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x101ea8, 0x2f}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socket$kcm(0x10, 0x3, 0x10) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000080)={0x0, 0xfede, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848420000005e140602000000000e000a0010000000028000001294", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[], 0x0, 0x51}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) sendmsg$unix(0xffffffffffffffff, &(0x7f0000002200)={&(0x7f00000004c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x4000010}, 0x891) r6 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_attach_bpf(r6, 0x88, 0x67, 0x0, 0x0) syz_clone(0x41064400, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8947, &(0x7f00000002c0)={'bond0\x00', @random="d8b301000100"}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x2400, 0x6) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r3, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8005d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xb}, 0x100100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='blkio.bfq.io_merged\x00', 0x275a, 0x0) 1.443289645s ago: executing program 3 (id=13989): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80010, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, @perf_config_ext={0xffffffffffffffff, 0x5d}, 0x0, 0xca, 0x1, 0x0, 0x3, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x6c6}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107983, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x9, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)) r2 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r2, 0x0, 0xfe33) close(r1) perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xc2ba}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x11, 0xa, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x99, 0x1, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x100e68, 0x0, 0x4000, 0x0, 0x7}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r3, &(0x7f00000002c0)=ANY=[@ANYRES8=r1, @ANYRES8=r4], 0x12) 1.176213842s ago: executing program 2 (id=13990): perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xe4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x104, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x3, 0xc2ba, 0x0, 0x4000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000380)={&(0x7f0000000040)={0xa, 0xfffd, @local}, 0x1b, &(0x7f0000000180)=[{&(0x7f0000000080)="a2", 0xff0e}], 0x4, 0x0, 0x0, 0xa6820000}, 0xff00) 1.000742576s ago: executing program 3 (id=13991): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1b00000d00000000000000000080000000000000", @ANYRES32, @ANYBLOB="0300"/15, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1f, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="180000007f000000000000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000001008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020002010000008500000084000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000020000200000000002000000850000002000000085000000a000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b70400000000"], 0x0, 0x100}, 0x94) socketpair(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r4, &(0x7f0000000140)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'], 0x30}, 0x890) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x49c8, 0x0, 0xfffffffc, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0600000004000000080000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000500000000000000000000000000000000000000d883ea2360d14def1fa85ed6677c5e79608078df7699aa1bcce9a8d91eb0eebf4141bdd18819d724070a3ab02fc707433168e3f4131600074930"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42082, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xffffffffffffffc1, 0xa5}, 0x0, 0x10, 0x4, 0x8, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000780)={0x5, 0x80, 0x6, 0xf5, 0x5, 0x9, 0x0, 0x1, 0x2, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0x8}, 0x1192b, 0x8, 0xa, 0x4, 0x318, 0x8ebc, 0x9, 0x0, 0x93b1, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89a2, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89a1, &(0x7f0000000080)) 957.548397ms ago: executing program 2 (id=13992): bpf$MAP_CREATE(0x0, &(0x7f0000001440)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x16, 0x11, &(0x7f0000000680)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0x10, 0x10, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 788.813231ms ago: executing program 2 (id=13993): r0 = socket$kcm(0x2, 0x3, 0x106) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000380)={0x2, 0xfffd, @remote}, 0x10, &(0x7f0000000c00)=[{&(0x7f0000000700)="fbd2b9ed29d8974a6ce75f08916a", 0xe}, {&(0x7f00000007c0)}], 0x2}, 0x0) 754.705352ms ago: executing program 2 (id=13994): socket$kcm(0x2, 0x200000000000001, 0x0) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) setsockopt$sock_attach_bpf(r0, 0x29, 0x38, 0x0, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f00000000c0)="d80000001c0081044e81f782db44b9040a1d080214000000020009a118000c000300000001000e1208000f0100910401a8001600200001400300000203600c00b94dcf5c0461c1d67f6f94007134cf6ee080000000000000000091643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68765730d16a4683f5aeb4edb49905025ccca9e00360db70100000000008008", 0x92}, {&(0x7f0000000240)="fa50b01a81228e0726cf56459007fcb60ba6d75d1e30d4284b219e41cfc97a61568ba88139c2d52bf489c59c3327928bb1354b510db26fbeafd86711065eb109ac3678726462", 0x46}], 0x2, 0x0, 0x0, 0x7400}, 0x404a880) 618.472785ms ago: executing program 2 (id=13995): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x800}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x48) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="1b00000d00000000000000000080000000000000", @ANYRES32, @ANYBLOB="0300"/15, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1f, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="180000007f000000000000000400000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000001008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020002010000008500000084000000b70000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x3, 0x5, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000020000200000000002000000850000002000000085000000a000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2f, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000002100b70400000000"], 0x0, 0x100}, 0x94) socketpair(0x1, 0x2, 0x0, &(0x7f00000002c0)) r3 = socket$kcm(0x2, 0x1000000000000002, 0x0) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00'], 0x30}, 0x890) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x3, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x49c8, 0x0, 0xfffffffc, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="0600000004000000080000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000500000000000000000000000000000000000000d883ea2360d14def1fa85ed6677c5e79608078df7699aa1bcce9a8d91eb0eebf4141bdd18819d724070a3ab02fc707433168e3f4131600074930"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000002, 0xe, 0xfffffffffffffda9, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x3, 0x42082, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0xffffffffffffffc1, 0xa5}, 0x0, 0x10, 0x4, 0x8, 0x2, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000780)={0x5, 0x80, 0x6, 0xf5, 0x5, 0x9, 0x0, 0x1, 0x2, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x4, @perf_config_ext={0x8}, 0x1192b, 0x8, 0xa, 0x4, 0x318, 0x8ebc, 0x9, 0x0, 0x93b1, 0x0, 0x101}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socketpair(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89a0, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89a2, &(0x7f0000000080)) 594.392046ms ago: executing program 3 (id=13996): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d08000b000000e8fe55a1180015000600142603600e1209000d0000000401a80016000a00014006000000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a9295", 0xd2}], 0x1}, 0x0) 516.716747ms ago: executing program 0 (id=13997): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff) r1 = openat$cgroup(r0, &(0x7f0000000280)='syz0\x00', 0x200002, 0x0) r2 = openat$cgroup_type(r1, &(0x7f0000000040), 0x2, 0x0) write$cgroup_type(r2, &(0x7f00000000c0), 0x9) r3 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r3, &(0x7f0000000140), 0x9) 440.180069ms ago: executing program 3 (id=13998): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000000c0)='devices.allow\x00', 0x2, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_clone(0x200c8000, 0x0, 0x0, 0x0, 0x0, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000080)='syz0\x00', 0x1ff) r1 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_type(r1, &(0x7f00000000c0), 0x9) 343.000342ms ago: executing program 0 (id=13999): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xd}, 0x10c002, 0xac5d, 0x0, 0x0, 0x200000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x22a82, 0x0) r1 = socket$kcm(0xa, 0x2, 0x11) setsockopt$sock_attach_bpf(r1, 0x1, 0x3d, &(0x7f00000002c0), 0x8) r2 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x300, &(0x7f00000001c0)=[{&(0x7f0000000940)="2e00000010008188e6b62aa73772cc9f1ba1f8482e0000005e140602000000000e000a001000000002800000128c", 0x2e}], 0x1}, 0x0) ioctl$PERF_EVENT_IOC_DISABLE(r0, 0x2401, 0x9) 260.810034ms ago: executing program 2 (id=14000): socketpair$unix(0x1, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000800), 0x0}, 0x20) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x24080, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x3}, 0x58c8, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0xc026, 0xac5d, 0xffffffff, 0x3, 0x0, 0x7, 0x0, 0x0, 0xfffffffc}, 0x0, 0xffffffffffffffff, r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x4f}, 0xfffffffffffffe77) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000dc0)="5c00000014006b02c84e21000af32c6e0a0601000100000044000100fc000e000000004e0033df090e8497b1ed90d3d376bd5f6ffe5aa677b1c6f99b214460bc24f65ee2f308ff9d4f5a60eab556a705251e618294010000003b48df", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x80000) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0e00009bd029ef8020ab070004000523a608463a3f"], 0xfe33) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r1, 0xe0, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300), ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0], 0x0, 0x33, &(0x7f00000003c0), 0x0, 0x10, &(0x7f0000000400), &(0x7f0000000440), 0x8, 0x2f, 0x8, 0x8, &(0x7f0000000580)}}, 0x10) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000700), 0x4) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0xb, 0x494d, 0x5, 0x5, 0x40a00, 0xffffffffffffffff, 0x2, '\x00', r4, r5, 0x4, 0x3, 0x4}, 0x50) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.dequeue\x00', 0x26e1, 0x0) close(r6) socket$kcm(0x2b, 0x1, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8b19, &(0x7f0000000000)={'wlan0\x00', @random="7cf1e97c9e4f"}) 160.455316ms ago: executing program 3 (id=14001): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000980)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0}, 0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000680)="76389e6a65585578f830e9000000", 0x0, 0x10001, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 19.888879ms ago: executing program 3 (id=14002): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB], 0x37) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000cc0)={0x3, 0xd, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000800000095"], &(0x7f00000008c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x4002000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 0s ago: executing program 0 (id=14003): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000004000000080000000a"], 0x48) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000e00000001000000000000010400000020000001000000000000000d01000000050000000000000c020000000a0000000000000c0200000000696e74006d61696e0073"], 0x0, 0x5a}, 0x28) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={0xffffffffffffffff, 0x0, 0x5, 0x0, &(0x7f0000000608)="0900000004", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0xb, &(0x7f0000000400)=ANY=[@ANYBLOB="18110000", @ANYRES32=r0, @ANYBLOB="000000000000000018420000060000000000000000000000b703000000000000b70400000000000085000000b5000000b7000000000000009500000000000000b7000000000000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x1, 0x100000, &(0x7f0000000700)=""/1048576, 0x0, 0x0, '\x00', 0x0, @fallback, r1, 0x8, &(0x7f0000000600)={0x0, 0x3}, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x80) kernel console output (not intermixed with test programs): e_1 [ 2521.219447][T11599] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2521.236635][T11599] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2521.253787][T11599] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2521.267290][T11599] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2521.282759][T11599] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2521.295532][T11599] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2521.330682][T11599] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2521.347779][T11599] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2521.364264][T11599] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2521.374894][T11599] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2521.504065][T32089] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2521.529722][T32089] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2521.573895][T32084] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2521.582354][T17202] Bluetooth: hci2: command tx timeout [ 2521.595176][T32084] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2521.810377][T11734] netlink: 'syz.2.12921': attribute type 6 has an invalid length. [ 2521.839476][T11734] netlink: 164 bytes leftover after parsing attributes in process `syz.2.12921'. [ 2522.430045][T11734] netlink: 105120 bytes leftover after parsing attributes in process `syz.2.12921'. [ 2522.482888][T11734] netlink: 'syz.2.12921': attribute type 2 has an invalid length. [ 2522.685677][T11756] netlink: 'syz.0.12917': attribute type 21 has an invalid length. [ 2522.716701][T11756] netlink: 128 bytes leftover after parsing attributes in process `syz.0.12917'. [ 2522.726675][T11756] netlink: 'syz.0.12917': attribute type 4 has an invalid length. [ 2522.750137][T11756] netlink: 3 bytes leftover after parsing attributes in process `syz.0.12917'. [ 2523.596369][T11778] netlink: 'syz.0.12931': attribute type 21 has an invalid length. [ 2523.605993][T11778] netlink: 128 bytes leftover after parsing attributes in process `syz.0.12931'. [ 2523.623996][T11778] netlink: 'syz.0.12931': attribute type 4 has an invalid length. [ 2523.632277][T11778] netlink: 3 bytes leftover after parsing attributes in process `syz.0.12931'. [ 2523.659764][T17202] Bluetooth: hci2: command tx timeout [ 2524.920334][T11807] netlink: 'syz.4.12941': attribute type 21 has an invalid length. [ 2524.928391][T11807] netlink: 128 bytes leftover after parsing attributes in process `syz.4.12941'. [ 2524.953379][T11807] netlink: 'syz.4.12941': attribute type 4 has an invalid length. [ 2524.968104][T11807] netlink: 3 bytes leftover after parsing attributes in process `syz.4.12941'. [ 2525.281639][T11811] netlink: 'syz.2.12944': attribute type 10 has an invalid length. [ 2525.447269][T11811] team0: Device vxcan1 is of different type [ 2525.931784][T11834] netlink: 'syz.0.12953': attribute type 21 has an invalid length. [ 2525.969375][T11834] netlink: 128 bytes leftover after parsing attributes in process `syz.0.12953'. [ 2525.979034][T11834] netlink: 3 bytes leftover after parsing attributes in process `syz.0.12953'. [ 2526.084534][T11836] syzkaller0: entered promiscuous mode [ 2526.090960][T11836] syzkaller0: entered allmulticast mode [ 2529.223932][T11874] validate_nla: 3 callbacks suppressed [ 2529.223951][T11874] netlink: 'syz.3.12966': attribute type 10 has an invalid length. [ 2529.256200][T11874] __nla_validate_parse: 7 callbacks suppressed [ 2529.256217][T11874] netlink: 210880 bytes leftover after parsing attributes in process `syz.3.12966'. [ 2529.278933][T11876] netlink: 'syz.3.12966': attribute type 10 has an invalid length. [ 2529.295362][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.4.12967'. [ 2529.305758][T11876] netlink: 210880 bytes leftover after parsing attributes in process `syz.3.12966'. [ 2529.319025][T11881] netlink: 'syz.2.12968': attribute type 21 has an invalid length. [ 2529.327423][T11881] netlink: 128 bytes leftover after parsing attributes in process `syz.2.12968'. [ 2529.337622][T11881] netlink: 'syz.2.12968': attribute type 4 has an invalid length. [ 2529.351565][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 2529.351680][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 2529.369608][T11881] netlink: 3 bytes leftover after parsing attributes in process `syz.2.12968'. [ 2529.378913][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.4.12967'. [ 2529.391651][T11882] netlink: 60 bytes leftover after parsing attributes in process `syz.4.12967'. [ 2529.403827][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.4.12967'. [ 2529.414792][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.4.12967'. [ 2529.535525][T11885] netlink: 'syz.2.12969': attribute type 10 has an invalid length. [ 2529.545469][T11885] netlink: 210880 bytes leftover after parsing attributes in process `syz.2.12969'. [ 2531.419519][T22718] Bluetooth: hci0: command 0x0406 tx timeout [ 2531.528744][T11904] netlink: 'syz.0.12977': attribute type 21 has an invalid length. [ 2531.537845][T11904] netlink: 'syz.0.12977': attribute type 4 has an invalid length. [ 2531.771774][T11910] netlink: 'syz.3.12979': attribute type 10 has an invalid length. [ 2531.887716][T11910] team0: Device vxcan1 is of different type [ 2532.208549][T11922] netlink: 'syz.2.12984': attribute type 10 has an invalid length. [ 2532.679822][T11934] netlink: 'syz.0.12990': attribute type 21 has an invalid length. [ 2533.585092][T11947] team0: Device vxcan1 is of different type [ 2534.000854][T11969] FAULT_INJECTION: forcing a failure. [ 2534.000854][T11969] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2534.043149][T11969] CPU: 1 PID: 11969 Comm: syz.2.13007 Not tainted syzkaller #0 [ 2534.050780][T11969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2534.060886][T11969] Call Trace: [ 2534.064213][T11969] [ 2534.067196][T11969] dump_stack_lvl+0x18c/0x250 [ 2534.071944][T11969] ? show_regs_print_info+0x20/0x20 [ 2534.077197][T11969] ? load_image+0x420/0x420 [ 2534.081749][T11969] ? __might_fault+0xaa/0x120 [ 2534.086477][T11969] ? __lock_acquire+0x7d80/0x7d80 [ 2534.091564][T11969] should_fail_ex+0x394/0x4c0 [ 2534.096303][T11969] _copy_from_user+0x2f/0xe0 [ 2534.100962][T11969] ___sys_recvmsg+0x174/0x590 [ 2534.105698][T11969] ? __sys_recvmsg+0x2a0/0x2a0 [ 2534.110531][T11969] ? ksys_write+0x1d2/0x260 [ 2534.115129][T11969] ? __fget_files+0x3fc/0x460 [ 2534.119880][T11969] __x64_sys_recvmsg+0x21e/0x2f0 [ 2534.124882][T11969] ? ___sys_recvmsg+0x590/0x590 [ 2534.129838][T11969] ? lockdep_hardirqs_on+0x98/0x150 [ 2534.135115][T11969] do_syscall_64+0x55/0xb0 [ 2534.139584][T11969] ? clear_bhb_loop+0x40/0x90 [ 2534.144322][T11969] ? clear_bhb_loop+0x40/0x90 [ 2534.149065][T11969] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2534.155014][T11969] RIP: 0033:0x7f943f39e159 [ 2534.159483][T11969] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2534.179147][T11969] RSP: 002b:00007f944026d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 2534.187732][T11969] RAX: ffffffffffffffda RBX: 00007f943f625fa0 RCX: 00007f943f39e159 [ 2534.195778][T11969] RDX: 0000000000012022 RSI: 00002000000030c0 RDI: 0000000000000003 [ 2534.203917][T11969] RBP: 00007f944026d090 R08: 0000000000000000 R09: 0000000000000000 [ 2534.212202][T11969] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2534.220223][T11969] R13: 00007f943f626038 R14: 00007f943f625fa0 R15: 00007fff3e598588 [ 2534.228265][T11969] [ 2534.281629][T11973] __nla_validate_parse: 33 callbacks suppressed [ 2534.281648][T11973] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13008'. [ 2534.312141][T11972] validate_nla: 5 callbacks suppressed [ 2534.312162][T11972] netlink: 'syz.3.13006': attribute type 21 has an invalid length. [ 2534.337153][T11973] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13008'. [ 2534.360020][T11973] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13008'. [ 2534.380228][T11973] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13008'. [ 2534.400627][T11973] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13008'. [ 2534.498779][T11976] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13009'. [ 2534.531276][T11976] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13009'. [ 2534.602320][T11978] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13009'. [ 2534.640934][T11976] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13009'. [ 2534.660284][T11976] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13009'. [ 2534.726708][T11982] netlink: 'syz.3.13012': attribute type 21 has an invalid length. [ 2534.755953][T11982] netlink: 'syz.3.13012': attribute type 4 has an invalid length. [ 2534.958065][T11991] netlink: 'syz.4.13015': attribute type 10 has an invalid length. [ 2535.032133][T11991] team0: Device wg1 is of different type [ 2535.383205][T12003] FAULT_INJECTION: forcing a failure. [ 2535.383205][T12003] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2535.409499][T12003] CPU: 0 PID: 12003 Comm: syz.4.13021 Not tainted syzkaller #0 [ 2535.417161][T12003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2535.427293][T12003] Call Trace: [ 2535.430651][T12003] [ 2535.433649][T12003] dump_stack_lvl+0x18c/0x250 [ 2535.438430][T12003] ? show_regs_print_info+0x20/0x20 [ 2535.443730][T12003] ? load_image+0x420/0x420 [ 2535.448348][T12003] ? __might_fault+0xaa/0x120 [ 2535.453115][T12003] ? __lock_acquire+0x7d80/0x7d80 [ 2535.458404][T12003] should_fail_ex+0x394/0x4c0 [ 2535.463209][T12003] _copy_from_user+0x2f/0xe0 [ 2535.467893][T12003] ___sys_sendmsg+0x1c7/0x360 [ 2535.472663][T12003] ? get_pid_task+0x20/0x1e0 [ 2535.477366][T12003] ? __sys_sendmsg+0x2b0/0x2b0 [ 2535.482305][T12003] ? __lock_acquire+0x7d80/0x7d80 [ 2535.487516][T12003] __se_sys_sendmsg+0x1d0/0x2c0 [ 2535.492467][T12003] ? __x64_sys_sendmsg+0x80/0x80 [ 2535.497548][T12003] ? lockdep_hardirqs_on+0x98/0x150 [ 2535.502853][T12003] do_syscall_64+0x55/0xb0 [ 2535.507354][T12003] ? clear_bhb_loop+0x40/0x90 [ 2535.512108][T12003] ? clear_bhb_loop+0x40/0x90 [ 2535.516848][T12003] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2535.522797][T12003] RIP: 0033:0x7f51b599e159 [ 2535.527263][T12003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2535.547016][T12003] RSP: 002b:00007f51b68e1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2535.555485][T12003] RAX: ffffffffffffffda RBX: 00007f51b5c25fa0 RCX: 00007f51b599e159 [ 2535.563528][T12003] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 2535.571549][T12003] RBP: 00007f51b68e1090 R08: 0000000000000000 R09: 0000000000000000 [ 2535.579572][T12003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2535.587706][T12003] R13: 00007f51b5c26038 R14: 00007f51b5c25fa0 R15: 00007ffd435253e8 [ 2535.595794][T12003] [ 2536.014198][T12008] netlink: 'syz.4.13024': attribute type 21 has an invalid length. [ 2536.027697][T12008] netlink: 'syz.4.13024': attribute type 4 has an invalid length. [ 2536.079585][T12009] netlink: 'syz.0.13023': attribute type 10 has an invalid length. [ 2536.616969][T12022] FAULT_INJECTION: forcing a failure. [ 2536.616969][T12022] name failslab, interval 1, probability 0, space 0, times 0 [ 2536.708265][T12022] CPU: 1 PID: 12022 Comm: syz.4.13030 Not tainted syzkaller #0 [ 2536.715914][T12022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2536.726039][T12022] Call Trace: [ 2536.729377][T12022] [ 2536.732373][T12022] dump_stack_lvl+0x18c/0x250 [ 2536.737136][T12022] ? show_regs_print_info+0x20/0x20 [ 2536.742419][T12022] ? load_image+0x420/0x420 [ 2536.747000][T12022] ? __might_sleep+0xe0/0xe0 [ 2536.751671][T12022] ? __lock_acquire+0x7d80/0x7d80 [ 2536.756782][T12022] should_fail_ex+0x394/0x4c0 [ 2536.761546][T12022] should_failslab+0x9/0x20 [ 2536.766125][T12022] slab_pre_alloc_hook+0x59/0x300 [ 2536.771242][T12022] ? __lock_acquire+0x7d80/0x7d80 [ 2536.776361][T12022] kmem_cache_alloc_node+0x5e/0x310 [ 2536.782609][T12022] ? __alloc_skb+0x103/0x2c0 [ 2536.787290][T12022] __alloc_skb+0x103/0x2c0 [ 2536.791791][T12022] netlink_sendmsg+0x66a/0xbf0 [ 2536.796674][T12022] ? netlink_getsockopt+0x590/0x590 [ 2536.801955][T12022] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2536.807582][T12022] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2536.812952][T12022] ? security_socket_sendmsg+0x80/0xa0 [ 2536.818479][T12022] ? netlink_getsockopt+0x590/0x590 [ 2536.823752][T12022] ____sys_sendmsg+0x61b/0x980 [ 2536.828606][T12022] ? __asan_memset+0x22/0x40 [ 2536.833355][T12022] ? __sys_sendmsg_sock+0x30/0x30 [ 2536.838452][T12022] ? __import_iovec+0x5f2/0x850 [ 2536.843396][T12022] ? import_iovec+0x73/0xa0 [ 2536.847976][T12022] ___sys_sendmsg+0x2a6/0x360 [ 2536.852736][T12022] ? __sys_sendmsg+0x2b0/0x2b0 [ 2536.857890][T12022] ? __lock_acquire+0x7d80/0x7d80 [ 2536.863054][T12022] __se_sys_sendmsg+0x1d0/0x2c0 [ 2536.867988][T12022] ? __x64_sys_sendmsg+0x80/0x80 [ 2536.873037][T12022] ? lockdep_hardirqs_on+0x98/0x150 [ 2536.878330][T12022] do_syscall_64+0x55/0xb0 [ 2536.882825][T12022] ? clear_bhb_loop+0x40/0x90 [ 2536.887568][T12022] ? clear_bhb_loop+0x40/0x90 [ 2536.892327][T12022] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2536.898294][T12022] RIP: 0033:0x7f51b599e159 [ 2536.902783][T12022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2536.922550][T12022] RSP: 002b:00007f51b68e1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2536.931044][T12022] RAX: ffffffffffffffda RBX: 00007f51b5c25fa0 RCX: 00007f51b599e159 [ 2536.939097][T12022] RDX: 0000000000000000 RSI: 00002000000003c0 RDI: 0000000000000004 [ 2536.947137][T12022] RBP: 00007f51b68e1090 R08: 0000000000000000 R09: 0000000000000000 [ 2536.955180][T12022] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2536.963226][T12022] R13: 00007f51b5c26038 R14: 00007f51b5c25fa0 R15: 00007ffd435253e8 [ 2536.971321][T12022] [ 2537.368825][T12029] syzkaller0: entered promiscuous mode [ 2537.383717][T12029] syzkaller0: entered allmulticast mode [ 2537.556484][T12037] netlink: 'syz.3.13036': attribute type 21 has an invalid length. [ 2537.619584][T12037] netlink: 'syz.3.13036': attribute type 4 has an invalid length. [ 2537.629205][T12033] netlink: 'syz.4.13033': attribute type 10 has an invalid length. [ 2537.644650][T12033] hsr0: entered promiscuous mode [ 2537.674834][T12033] bridge0: port 3(hsr0) entered blocking state [ 2537.692030][T12033] bridge0: port 3(hsr0) entered disabled state [ 2537.708653][T12033] hsr0: entered allmulticast mode [ 2537.715010][T12033] hsr_slave_0: entered allmulticast mode [ 2537.722222][T12033] hsr_slave_1: entered allmulticast mode [ 2537.772415][T12033] bridge0: port 3(hsr0) entered blocking state [ 2537.779415][T12033] bridge0: port 3(hsr0) entered forwarding state [ 2539.800588][T12052] netlink: 'syz.4.13040': attribute type 10 has an invalid length. [ 2539.819318][T12052] __nla_validate_parse: 15 callbacks suppressed [ 2539.819339][T12052] netlink: 210880 bytes leftover after parsing attributes in process `syz.4.13040'. [ 2542.140168][T12058] netlink: 'syz.3.13041': attribute type 21 has an invalid length. [ 2542.176815][T12058] netlink: 128 bytes leftover after parsing attributes in process `syz.3.13041'. [ 2542.186640][T12058] netlink: 'syz.3.13041': attribute type 4 has an invalid length. [ 2542.204751][T12058] netlink: 3 bytes leftover after parsing attributes in process `syz.3.13041'. [ 2542.380041][T12055] netlink: 'syz.0.13049': attribute type 10 has an invalid length. [ 2542.394372][T12055] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13049'. [ 2542.501887][T12066] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13046'. [ 2542.519176][T12066] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13046'. [ 2542.536239][T12066] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13046'. [ 2542.548995][T12066] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13046'. [ 2542.568798][T12066] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13046'. [ 2542.578616][T12070] netlink: 'syz.0.13047': attribute type 21 has an invalid length. [ 2542.619730][T12070] netlink: 128 bytes leftover after parsing attributes in process `syz.0.13047'. [ 2542.628981][T12070] netlink: 'syz.0.13047': attribute type 4 has an invalid length. [ 2542.982616][T12078] netlink: 'syz.0.13051': attribute type 10 has an invalid length. [ 2543.397837][T12086] netlink: 'syz.3.13055': attribute type 2 has an invalid length. [ 2543.432080][T12080] netlink: 'syz.4.13053': attribute type 10 has an invalid length. [ 2543.490482][T12088] netlink: 'syz.2.13056': attribute type 21 has an invalid length. [ 2544.945144][T12126] validate_nla: 6 callbacks suppressed [ 2544.945186][T12126] netlink: 'syz.3.13069': attribute type 10 has an invalid length. [ 2544.964602][T12126] __nla_validate_parse: 31 callbacks suppressed [ 2544.964639][T12126] netlink: 210880 bytes leftover after parsing attributes in process `syz.3.13069'. [ 2545.069935][T12123] netlink: 'syz.2.13066': attribute type 10 has an invalid length. [ 2545.119501][T12123] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13066'. [ 2545.224820][T12131] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13071'. [ 2545.234283][T12131] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13071'. [ 2545.256922][T12131] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13071'. [ 2545.279814][T12131] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13071'. [ 2545.315778][T12131] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13071'. [ 2545.773514][T12140] netlink: 'syz.2.13075': attribute type 19 has an invalid length. [ 2545.870175][T12140] netlink: 3890 bytes leftover after parsing attributes in process `syz.2.13075'. [ 2545.998942][T12149] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13078'. [ 2546.008399][T12149] netlink: 60 bytes leftover after parsing attributes in process `syz.4.13078'. [ 2546.057445][T12150] netlink: 'syz.0.13079': attribute type 21 has an invalid length. [ 2546.087797][T12150] netlink: 'syz.0.13079': attribute type 4 has an invalid length. [ 2546.188887][T12145] netlink: 'syz.3.13077': attribute type 10 has an invalid length. [ 2546.612525][T12152] netlink: 'syz.4.13080': attribute type 10 has an invalid length. [ 2546.707788][T12156] netlink: 'syz.0.13082': attribute type 10 has an invalid length. [ 2546.870415][T12169] netlink: 'syz.4.13086': attribute type 10 has an invalid length. [ 2547.030906][T12166] netlink: 'syz.3.13085': attribute type 10 has an invalid length. [ 2550.019998][T12239] validate_nla: 14 callbacks suppressed [ 2550.020017][T12239] netlink: 'syz.3.13115': attribute type 19 has an invalid length. [ 2550.078752][T12239] __nla_validate_parse: 59 callbacks suppressed [ 2550.078790][T12239] netlink: 3890 bytes leftover after parsing attributes in process `syz.3.13115'. [ 2550.831941][T12243] netlink: 'syz.3.13117': attribute type 10 has an invalid length. [ 2550.875315][T12243] netlink: 2 bytes leftover after parsing attributes in process `syz.3.13117'. [ 2551.545797][T12259] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13121'. [ 2551.585237][T12259] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13121'. [ 2551.602804][T12262] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13121'. [ 2551.616256][T12259] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13121'. [ 2551.651233][T12259] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13121'. [ 2551.685885][T12265] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13123'. [ 2551.696355][T12265] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13123'. [ 2551.707775][T12265] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13123'. [ 2551.875986][T12273] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2551.903657][T22718] Bluetooth: hci4: command 0x0406 tx timeout [ 2551.941800][T12269] netlink: 'syz.2.13125': attribute type 10 has an invalid length. [ 2551.995526][T12269] geneve0: entered promiscuous mode [ 2552.132838][T12269] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 2552.239180][T12281] netlink: 'syz.3.13130': attribute type 10 has an invalid length. [ 2552.354165][T12278] netlink: 'syz.0.13129': attribute type 10 has an invalid length. [ 2552.962025][T12306] netlink: 'syz.2.13141': attribute type 10 has an invalid length. [ 2553.243013][T12308] netlink: 'syz.3.13142': attribute type 10 has an invalid length. [ 2553.745957][T12336] netlink: 'syz.3.13153': attribute type 10 has an invalid length. [ 2554.285861][T12343] netlink: 'syz.4.13156': attribute type 10 has an invalid length. [ 2554.581613][T12359] FAULT_INJECTION: forcing a failure. [ 2554.581613][T12359] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2554.639470][T12359] CPU: 0 PID: 12359 Comm: syz.4.13163 Not tainted syzkaller #0 [ 2554.647110][T12359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2554.657232][T12359] Call Trace: [ 2554.660564][T12359] [ 2554.663538][T12359] dump_stack_lvl+0x18c/0x250 [ 2554.668265][T12359] ? show_regs_print_info+0x20/0x20 [ 2554.673506][T12359] ? load_image+0x420/0x420 [ 2554.678046][T12359] ? __might_fault+0xaa/0x120 [ 2554.682752][T12359] ? __lock_acquire+0x7d80/0x7d80 [ 2554.687812][T12359] should_fail_ex+0x394/0x4c0 [ 2554.692531][T12359] _copy_from_user+0x2f/0xe0 [ 2554.697156][T12359] sk_setsockopt+0x2b9/0x2b20 [ 2554.701871][T12359] ? sockopt_capable+0x60/0x60 [ 2554.706668][T12359] ? aa_sk_perm+0x83c/0x970 [ 2554.711291][T12359] ? __fget_files+0x28/0x460 [ 2554.715950][T12359] ? aa_af_perm+0x330/0x330 [ 2554.720514][T12359] ? __fget_files+0x28/0x460 [ 2554.725139][T12359] ? aa_sock_opt_perm+0x74/0x100 [ 2554.730107][T12359] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 2554.735693][T12359] ? security_socket_setsockopt+0x7e/0xa0 [ 2554.741444][T12359] do_sock_setsockopt+0x11b/0x1a0 [ 2554.746530][T12359] __x64_sys_setsockopt+0x182/0x200 [ 2554.751864][T12359] do_syscall_64+0x55/0xb0 [ 2554.756317][T12359] ? clear_bhb_loop+0x40/0x90 [ 2554.761028][T12359] ? clear_bhb_loop+0x40/0x90 [ 2554.765741][T12359] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2554.771671][T12359] RIP: 0033:0x7f51b599e159 [ 2554.776119][T12359] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2554.795901][T12359] RSP: 002b:00007f51b68e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2554.804370][T12359] RAX: ffffffffffffffda RBX: 00007f51b5c25fa0 RCX: 00007f51b599e159 [ 2554.812384][T12359] RDX: 000000000000002c RSI: 0000000000000001 RDI: 0000000000000005 [ 2554.820418][T12359] RBP: 00007f51b68e1090 R08: 0000000000000004 R09: 0000000000000000 [ 2554.828434][T12359] R10: 0000200000001140 R11: 0000000000000246 R12: 0000000000000001 [ 2554.836442][T12359] R13: 00007f51b5c26038 R14: 00007f51b5c25fa0 R15: 00007ffd435253e8 [ 2554.844519][T12359] [ 2555.006597][T12364] netlink: 'syz.2.13164': attribute type 10 has an invalid length. [ 2555.461853][T12380] netlink: 'syz.0.13177': attribute type 10 has an invalid length. [ 2555.483270][T12380] __nla_validate_parse: 41 callbacks suppressed [ 2555.483289][T12380] netlink: 210880 bytes leftover after parsing attributes in process `syz.0.13177'. [ 2555.515406][T12377] netlink: 212424 bytes leftover after parsing attributes in process `syz.4.13169'. [ 2555.548982][T12374] netlink: 'syz.2.13168': attribute type 10 has an invalid length. [ 2555.565687][T12374] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13168'. [ 2556.248007][T12405] FAULT_INJECTION: forcing a failure. [ 2556.248007][T12405] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2556.290372][T12405] CPU: 0 PID: 12405 Comm: syz.3.13179 Not tainted syzkaller #0 [ 2556.298012][T12405] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2556.308126][T12405] Call Trace: [ 2556.311540][T12405] [ 2556.314508][T12405] dump_stack_lvl+0x18c/0x250 [ 2556.319417][T12405] ? show_regs_print_info+0x20/0x20 [ 2556.324676][T12405] ? load_image+0x420/0x420 [ 2556.329225][T12405] ? __lock_acquire+0x7d80/0x7d80 [ 2556.334314][T12405] should_fail_ex+0x394/0x4c0 [ 2556.339055][T12405] _copy_from_user+0x2f/0xe0 [ 2556.343701][T12405] bpf_test_init+0xde/0x140 [ 2556.348258][T12405] bpf_prog_test_run_xdp+0x4cd/0x1140 [ 2556.353674][T12405] ? __lock_acquire+0x7d80/0x7d80 [ 2556.358842][T12405] ? dev_put+0x80/0x80 [ 2556.362959][T12405] ? dev_put+0x80/0x80 [ 2556.367061][T12405] bpf_prog_test_run+0x31f/0x390 [ 2556.372033][T12405] __sys_bpf+0x49d/0x890 [ 2556.376310][T12405] ? bpf_link_show_fdinfo+0x390/0x390 [ 2556.381733][T12405] ? lock_chain_count+0x20/0x20 [ 2556.386634][T12405] __x64_sys_bpf+0x7c/0x90 [ 2556.391098][T12405] do_syscall_64+0x55/0xb0 [ 2556.395545][T12405] ? clear_bhb_loop+0x40/0x90 [ 2556.400260][T12405] ? clear_bhb_loop+0x40/0x90 [ 2556.404973][T12405] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2556.410895][T12405] RIP: 0033:0x7f2b6879e159 [ 2556.415343][T12405] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2556.435346][T12405] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2556.443822][T12405] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2556.451825][T12405] RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a [ 2556.459833][T12405] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2556.467919][T12405] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2556.476009][T12405] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2556.484019][T12405] [ 2556.691885][T12410] netlink: 'syz.4.13181': attribute type 10 has an invalid length. [ 2556.716326][T12410] netlink: 210880 bytes leftover after parsing attributes in process `syz.4.13181'. [ 2557.011314][T12413] netlink: 'syz.3.13182': attribute type 10 has an invalid length. [ 2557.030338][T12413] netlink: 2 bytes leftover after parsing attributes in process `syz.3.13182'. [ 2557.525360][T12430] netlink: 'syz.3.13197': attribute type 10 has an invalid length. [ 2557.535667][T12430] netlink: 2 bytes leftover after parsing attributes in process `syz.3.13197'. [ 2557.745644][T12444] netlink: 'syz.4.13195': attribute type 10 has an invalid length. [ 2557.754461][T12444] netlink: 210880 bytes leftover after parsing attributes in process `syz.4.13195'. [ 2558.231818][T12459] netlink: 'syz.0.13198': attribute type 10 has an invalid length. [ 2558.250051][T12459] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13198'. [ 2558.592893][T12470] FAULT_INJECTION: forcing a failure. [ 2558.592893][T12470] name failslab, interval 1, probability 0, space 0, times 0 [ 2558.626577][T12470] CPU: 1 PID: 12470 Comm: syz.3.13205 Not tainted syzkaller #0 [ 2558.634233][T12470] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2558.644355][T12470] Call Trace: [ 2558.647672][T12470] [ 2558.650641][T12470] dump_stack_lvl+0x18c/0x250 [ 2558.655375][T12470] ? show_regs_print_info+0x20/0x20 [ 2558.660624][T12470] ? load_image+0x420/0x420 [ 2558.665215][T12470] ? __might_sleep+0xe0/0xe0 [ 2558.669912][T12470] ? __lock_acquire+0x7d80/0x7d80 [ 2558.675057][T12470] should_fail_ex+0x394/0x4c0 [ 2558.679849][T12470] should_failslab+0x9/0x20 [ 2558.684444][T12470] slab_pre_alloc_hook+0x59/0x300 [ 2558.689558][T12470] ? rcu_is_watching+0x15/0xb0 [ 2558.694422][T12470] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 2558.700765][T12470] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 2558.707101][T12470] __kmem_cache_alloc_node+0x53/0x250 [ 2558.712591][T12470] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 2558.718920][T12470] __kmalloc+0xa7/0x240 [ 2558.723188][T12470] ? __netlink_dump_start+0xf4/0x7a0 [ 2558.728563][T12470] genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 2558.734753][T12470] genl_start+0x180/0x6c0 [ 2558.739223][T12470] __netlink_dump_start+0x43c/0x7a0 [ 2558.744552][T12470] genl_family_rcv_msg_dumpit+0x214/0x310 [ 2558.750373][T12470] ? genl_rcv_msg+0x7a0/0x7a0 [ 2558.755126][T12470] ? genl_get_cmd+0x4aa/0x930 [ 2558.759964][T12470] ? genl_family_rcv_msg_doit+0x310/0x310 [ 2558.765768][T12470] ? genl_start+0x6c0/0x6c0 [ 2558.770385][T12470] ? genl_dumpit+0x1a0/0x1a0 [ 2558.775124][T12470] genl_rcv_msg+0x5de/0x7a0 [ 2558.779740][T12470] ? genl_bind+0x360/0x360 [ 2558.784270][T12470] ? devlink_nl_trap_fill+0x570/0x570 [ 2558.789859][T12470] ? perf_trace_lock+0x303/0x3b0 [ 2558.794925][T12470] netlink_rcv_skb+0x235/0x4c0 [ 2558.799792][T12470] ? genl_bind+0x360/0x360 [ 2558.804388][T12470] ? netlink_ack+0x1160/0x1160 [ 2558.809288][T12470] ? __lock_acquire+0x7d80/0x7d80 [ 2558.814490][T12470] ? net_generic+0x1e/0x240 [ 2558.819169][T12470] ? down_read+0x1ac/0x2e0 [ 2558.823699][T12470] genl_rcv+0x28/0x40 [ 2558.827763][T12470] netlink_unicast+0x7b1/0x930 [ 2558.832666][T12470] netlink_sendmsg+0x8d0/0xbf0 [ 2558.837541][T12470] ? netlink_getsockopt+0x590/0x590 [ 2558.842836][T12470] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2558.848473][T12470] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2558.853846][T12470] ? security_socket_sendmsg+0x80/0xa0 [ 2558.859382][T12470] ? netlink_getsockopt+0x590/0x590 [ 2558.864674][T12470] ____sys_sendmsg+0x61b/0x980 [ 2558.869552][T12470] ? __asan_memset+0x22/0x40 [ 2558.874229][T12470] ? __sys_sendmsg_sock+0x30/0x30 [ 2558.879358][T12470] ? __import_iovec+0x5f2/0x850 [ 2558.884336][T12470] ? import_iovec+0x73/0xa0 [ 2558.888947][T12470] ___sys_sendmsg+0x2a6/0x360 [ 2558.893924][T12470] ? __sys_sendmsg+0x2b0/0x2b0 [ 2558.898954][T12470] ? __lock_acquire+0x7d80/0x7d80 [ 2558.904423][T12470] __se_sys_sendmsg+0x1d0/0x2c0 [ 2558.909377][T12470] ? __x64_sys_sendmsg+0x80/0x80 [ 2558.914474][T12470] ? lockdep_hardirqs_on+0x98/0x150 [ 2558.919778][T12470] do_syscall_64+0x55/0xb0 [ 2558.924280][T12470] ? clear_bhb_loop+0x40/0x90 [ 2558.929044][T12470] ? clear_bhb_loop+0x40/0x90 [ 2558.933813][T12470] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2558.939812][T12470] RIP: 0033:0x7f2b6879e159 [ 2558.944332][T12470] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2558.964281][T12470] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2558.972788][T12470] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2558.980846][T12470] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 2558.989070][T12470] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2558.997116][T12470] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2559.005338][T12470] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2559.013456][T12470] [ 2559.074253][T12467] netlink: 'syz.4.13204': attribute type 10 has an invalid length. [ 2559.092685][T12467] geneve0: entered promiscuous mode [ 2559.156070][T12472] netlink: 'syz.2.13207': attribute type 10 has an invalid length. [ 2559.186813][T12472] netlink: 210880 bytes leftover after parsing attributes in process `syz.2.13207'. [ 2559.237050][T12467] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 2559.610230][T12479] netlink: 'syz.0.13209': attribute type 10 has an invalid length. [ 2559.628733][T12479] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13209'. [ 2561.094675][T12531] validate_nla: 2 callbacks suppressed [ 2561.094717][T12531] netlink: 'syz.4.13230': attribute type 10 has an invalid length. [ 2561.256841][T12526] netlink: 'syz.2.13228': attribute type 10 has an invalid length. [ 2561.267888][T12526] __nla_validate_parse: 3 callbacks suppressed [ 2561.268088][T12526] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13228'. [ 2561.318663][T12533] netlink: 'syz.0.13231': attribute type 10 has an invalid length. [ 2561.377973][T12533] geneve0: entered promiscuous mode [ 2561.405613][T12538] netlink: 'syz.3.13232': attribute type 10 has an invalid length. [ 2561.430748][T12538] netlink: 210880 bytes leftover after parsing attributes in process `syz.3.13232'. [ 2561.500522][T12533] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 2561.914428][T12553] FAULT_INJECTION: forcing a failure. [ 2561.914428][T12553] name failslab, interval 1, probability 0, space 0, times 0 [ 2561.949700][T12553] CPU: 1 PID: 12553 Comm: syz.4.13248 Not tainted syzkaller #0 [ 2561.957341][T12553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2561.967462][T12553] Call Trace: [ 2561.970789][T12553] [ 2561.973765][T12553] dump_stack_lvl+0x18c/0x250 [ 2561.978503][T12553] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2561.984724][T12553] ? show_regs_print_info+0x20/0x20 [ 2561.989984][T12553] ? load_image+0x420/0x420 [ 2561.994548][T12553] should_fail_ex+0x394/0x4c0 [ 2561.999288][T12553] should_failslab+0x9/0x20 [ 2562.003854][T12553] slab_pre_alloc_hook+0x59/0x300 [ 2562.008940][T12553] ? bpf_prog_test_run_skb+0x242/0x18f0 [ 2562.014548][T12553] ? bpf_prog_test_run_skb+0x242/0x18f0 [ 2562.020158][T12553] __kmem_cache_alloc_node+0x53/0x250 [ 2562.025628][T12553] ? bpf_prog_test_run_skb+0x242/0x18f0 [ 2562.031228][T12553] __kmalloc+0xa7/0x240 [ 2562.035448][T12553] bpf_prog_test_run_skb+0x242/0x18f0 [ 2562.040886][T12553] ? __fget_files+0x28/0x460 [ 2562.045506][T12553] ? __fget_files+0x3fc/0x460 [ 2562.050238][T12553] ? cpu_online+0x60/0x60 [ 2562.054628][T12553] bpf_prog_test_run+0x31f/0x390 [ 2562.059806][T12553] __sys_bpf+0x49d/0x890 [ 2562.064109][T12553] ? bpf_link_show_fdinfo+0x390/0x390 [ 2562.069536][T12553] ? lock_chain_count+0x20/0x20 [ 2562.074425][T12553] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 2562.080468][T12553] __x64_sys_bpf+0x7c/0x90 [ 2562.084924][T12553] do_syscall_64+0x55/0xb0 [ 2562.089373][T12553] ? clear_bhb_loop+0x40/0x90 [ 2562.094080][T12553] ? clear_bhb_loop+0x40/0x90 [ 2562.098794][T12553] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2562.104727][T12553] RIP: 0033:0x7f51b599e159 [ 2562.109173][T12553] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2562.128904][T12553] RSP: 002b:00007f51b68e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2562.137366][T12553] RAX: ffffffffffffffda RBX: 00007f51b5c25fa0 RCX: 00007f51b599e159 [ 2562.145387][T12553] RDX: 0000000000000050 RSI: 0000200000000540 RDI: 000000000000000a [ 2562.153411][T12553] RBP: 00007f51b68e1090 R08: 0000000000000000 R09: 0000000000000000 [ 2562.161417][T12553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2562.169418][T12553] R13: 00007f51b5c26038 R14: 00007f51b5c25fa0 R15: 00007ffd435253e8 [ 2562.177439][T12553] [ 2562.260275][T12556] netlink: 'syz.3.13240': attribute type 10 has an invalid length. [ 2562.311116][T12556] geneve0: entered promiscuous mode [ 2562.466274][T12556] bond0: (slave geneve0): Enslaving as an active interface with an up link [ 2562.477604][T12561] IPv6: Can't replace route, no match found [ 2562.514059][T12559] netlink: 'syz.0.13242': attribute type 10 has an invalid length. [ 2562.524320][T12559] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13242'. [ 2562.696803][T12566] netlink: 'syz.2.13244': attribute type 10 has an invalid length. [ 2562.705688][T12566] netlink: 210880 bytes leftover after parsing attributes in process `syz.2.13244'. [ 2563.513975][T12597] netlink: 'syz.4.13256': attribute type 10 has an invalid length. [ 2563.587817][T12595] netlink: 'syz.2.13255': attribute type 10 has an invalid length. [ 2563.599171][T12595] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13255'. [ 2563.697401][T12603] FAULT_INJECTION: forcing a failure. [ 2563.697401][T12603] name failslab, interval 1, probability 0, space 0, times 0 [ 2563.742624][T12603] CPU: 0 PID: 12603 Comm: syz.0.13258 Not tainted syzkaller #0 [ 2563.750264][T12603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2563.760359][T12603] Call Trace: [ 2563.763672][T12603] [ 2563.766632][T12603] dump_stack_lvl+0x18c/0x250 [ 2563.771350][T12603] ? show_regs_print_info+0x20/0x20 [ 2563.776581][T12603] ? load_image+0x420/0x420 [ 2563.781134][T12603] ? __might_sleep+0xe0/0xe0 [ 2563.785757][T12603] ? __lock_acquire+0x7d80/0x7d80 [ 2563.790816][T12603] should_fail_ex+0x394/0x4c0 [ 2563.795617][T12603] should_failslab+0x9/0x20 [ 2563.800157][T12603] slab_pre_alloc_hook+0x59/0x300 [ 2563.805223][T12603] ? __get_vm_area_node+0x125/0x370 [ 2563.810463][T12603] __kmem_cache_alloc_node+0x53/0x250 [ 2563.815870][T12603] ? __get_vm_area_node+0x125/0x370 [ 2563.821120][T12603] kmalloc_node_trace+0x26/0xe0 [ 2563.826030][T12603] __get_vm_area_node+0x125/0x370 [ 2563.831195][T12603] __vmalloc_node_range+0x36f/0x1320 [ 2563.836527][T12603] ? netlink_sendmsg+0x602/0xbf0 [ 2563.841496][T12603] ? netlink_insert+0x1094/0x1390 [ 2563.846678][T12603] ? netlink_insert+0x2ba/0x1390 [ 2563.851667][T12603] ? free_vm_area+0x50/0x50 [ 2563.856230][T12603] ? netlink_sendmsg+0x602/0xbf0 [ 2563.861202][T12603] vmalloc+0x79/0x90 [ 2563.865144][T12603] ? netlink_sendmsg+0x602/0xbf0 [ 2563.870117][T12603] netlink_sendmsg+0x602/0xbf0 [ 2563.874933][T12603] ? netlink_getsockopt+0x590/0x590 [ 2563.880175][T12603] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2563.885755][T12603] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2563.891081][T12603] ? security_socket_sendmsg+0x80/0xa0 [ 2563.896563][T12603] sock_write_iter+0x2dc/0x420 [ 2563.901360][T12603] ? sock_read_iter+0x3f0/0x3f0 [ 2563.906253][T12603] ? common_file_perm+0x198/0x1f0 [ 2563.911316][T12603] vfs_write+0x474/0x9a0 [ 2563.915604][T12603] ? file_end_write+0x250/0x250 [ 2563.920488][T12603] ? __fget_files+0x3fc/0x460 [ 2563.925202][T12603] ? __fdget_pos+0x1d8/0x330 [ 2563.929829][T12603] ? ksys_write+0x74/0x260 [ 2563.934288][T12603] ksys_write+0x151/0x260 [ 2563.938655][T12603] ? __ia32_sys_read+0x90/0x90 [ 2563.943561][T12603] ? syscall_enter_from_user_mode+0x2e/0x80 [ 2563.949503][T12603] do_syscall_64+0x55/0xb0 [ 2563.954043][T12603] ? clear_bhb_loop+0x40/0x90 [ 2563.958760][T12603] ? clear_bhb_loop+0x40/0x90 [ 2563.963485][T12603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2563.969422][T12603] RIP: 0033:0x7f37bc39e159 [ 2563.973913][T12603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2563.993658][T12603] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2564.002117][T12603] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2564.010146][T12603] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000006 [ 2564.018159][T12603] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2564.026154][T12603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2564.034154][T12603] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2564.042172][T12603] [ 2564.060587][T12603] syz.0.13258: vmalloc error: size 65408, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz0,mems_allowed=0-1 [ 2564.102355][T12605] netlink: 'syz.4.13259': attribute type 10 has an invalid length. [ 2564.111452][T12605] netlink: 210880 bytes leftover after parsing attributes in process `syz.4.13259'. [ 2564.137673][T12603] CPU: 1 PID: 12603 Comm: syz.0.13258 Not tainted syzkaller #0 [ 2564.145314][T12603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2564.155421][T12603] Call Trace: [ 2564.158747][T12603] [ 2564.161728][T12603] dump_stack_lvl+0x18c/0x250 [ 2564.166478][T12603] ? show_regs_print_info+0x20/0x20 [ 2564.171740][T12603] ? load_image+0x420/0x420 [ 2564.176308][T12603] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 2564.182791][T12603] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 2564.189351][T12603] warn_alloc+0x246/0x340 [ 2564.193735][T12603] ? __get_vm_area_node+0x125/0x370 [ 2564.198998][T12603] ? zone_watermark_ok_safe+0x230/0x230 [ 2564.204578][T12603] ? rcu_is_watching+0x15/0xb0 [ 2564.209373][T12603] ? __get_vm_area_node+0x356/0x370 [ 2564.214622][T12603] __vmalloc_node_range+0x394/0x1320 [ 2564.219965][T12603] ? netlink_insert+0x1094/0x1390 [ 2564.225029][T12603] ? netlink_insert+0x2ba/0x1390 [ 2564.230053][T12603] ? free_vm_area+0x50/0x50 [ 2564.234623][T12603] ? netlink_sendmsg+0x602/0xbf0 [ 2564.239602][T12603] vmalloc+0x79/0x90 [ 2564.243534][T12603] ? netlink_sendmsg+0x602/0xbf0 [ 2564.248505][T12603] netlink_sendmsg+0x602/0xbf0 [ 2564.253395][T12603] ? netlink_getsockopt+0x590/0x590 [ 2564.258630][T12603] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2564.264212][T12603] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2564.269709][T12603] ? security_socket_sendmsg+0x80/0xa0 [ 2564.275210][T12603] sock_write_iter+0x2dc/0x420 [ 2564.280017][T12603] ? sock_read_iter+0x3f0/0x3f0 [ 2564.284907][T12603] ? common_file_perm+0x198/0x1f0 [ 2564.289980][T12603] vfs_write+0x474/0x9a0 [ 2564.294277][T12603] ? file_end_write+0x250/0x250 [ 2564.299170][T12603] ? __fget_files+0x3fc/0x460 [ 2564.303891][T12603] ? __fdget_pos+0x1d8/0x330 [ 2564.308528][T12603] ? ksys_write+0x74/0x260 [ 2564.313001][T12603] ksys_write+0x151/0x260 [ 2564.317377][T12603] ? __ia32_sys_read+0x90/0x90 [ 2564.322182][T12603] ? syscall_enter_from_user_mode+0x2e/0x80 [ 2564.328124][T12603] do_syscall_64+0x55/0xb0 [ 2564.332579][T12603] ? clear_bhb_loop+0x40/0x90 [ 2564.337307][T12603] ? clear_bhb_loop+0x40/0x90 [ 2564.342034][T12603] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2564.347962][T12603] RIP: 0033:0x7f37bc39e159 [ 2564.352422][T12603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2564.372062][T12603] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2564.380507][T12603] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2564.388501][T12603] RDX: 000000000000fe33 RSI: 0000200000000000 RDI: 0000000000000006 [ 2564.396501][T12603] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2564.404584][T12603] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2564.412592][T12603] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2564.420602][T12603] [ 2564.454374][T12603] Mem-Info: [ 2564.458005][T12603] active_anon:5829 inactive_anon:0 isolated_anon:0 [ 2564.458005][T12603] active_file:19486 inactive_file:40944 isolated_file:0 [ 2564.458005][T12603] unevictable:768 dirty:314 writeback:0 [ 2564.458005][T12603] slab_reclaimable:11589 slab_unreclaimable:94096 [ 2564.458005][T12603] mapped:24997 shmem:1373 pagetables:605 [ 2564.458005][T12603] sec_pagetables:0 bounce:0 [ 2564.458005][T12603] kernel_misc_reclaimable:0 [ 2564.458005][T12603] free:1330638 free_pcp:14143 free_cma:0 [ 2564.518972][T12603] Node 0 active_anon:23316kB inactive_anon:0kB active_file:77944kB inactive_file:163576kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:99988kB dirty:1256kB writeback:0kB shmem:3956kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:11072kB pagetables:2420kB sec_pagetables:0kB all_unreclaimable? no [ 2564.577182][T12603] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 2564.644497][T12603] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 2564.695287][T12603] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 2564.703675][T12603] Node 0 DMA32 free:1423512kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:23080kB inactive_anon:0kB active_file:77944kB inactive_file:162752kB unevictable:1536kB writepending:1256kB present:3129332kB managed:2586820kB mlocked:0kB bounce:0kB free_pcp:30632kB local_pcp:10388kB free_cma:0kB [ 2564.739875][T12603] lowmem_reserve[]: 0 0 0 0 0 [ 2564.744683][T12603] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:36kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:12kB local_pcp:12kB free_cma:0kB [ 2564.779568][T12603] lowmem_reserve[]: 0 0 0 0 0 [ 2564.785115][T12603] Node 1 Normal free:3883936kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:26720kB local_pcp:10596kB free_cma:0kB [ 2564.815700][T12603] lowmem_reserve[]: 0 0 0 0 0 [ 2564.826827][T12603] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 2564.840536][T12603] Node 0 DMA32: 691*4kB (U) 2160*8kB (UME) 1477*16kB (UME) 1010*32kB (UME) 1417*64kB (UME) 757*128kB (UME) 302*256kB (UME) 140*512kB (UME) 61*1024kB (UME) 33*2048kB (UM) 215*4096kB (UM) = 1423260kB [ 2564.892822][T12603] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 2564.958201][T12603] Node 1 Normal: 160*4kB (UME) 28*8kB (UME) 20*16kB (UME) 40*32kB (UME) 16*64kB (UE) 2*128kB (UM) 1*256kB (U) 2*512kB (ME) 2*1024kB (UE) 1*2048kB (E) 946*4096kB (M) = 3883936kB [ 2565.022052][T12603] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2565.053940][T12603] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2565.070044][T12603] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 2565.113328][T12603] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 2565.182335][T12603] 61803 total pagecache pages [ 2565.202573][T12603] 0 pages in swap cache [ 2565.216075][T12603] Free swap = 124996kB [ 2565.236165][T12603] Total swap = 124996kB [ 2565.252533][T12603] 2097051 pages RAM [ 2565.267414][T12603] 0 pages HighMem/MovableOnly [ 2565.281629][T12603] 416960 pages reserved [ 2565.286123][T12603] 0 pages cma reserved [ 2565.755033][T12635] netlink: 210880 bytes leftover after parsing attributes in process `syz.4.13272'. [ 2565.795250][T12638] netlink: 212424 bytes leftover after parsing attributes in process `syz.3.13270'. [ 2565.836045][T12631] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13271'. [ 2566.653576][T12660] validate_nla: 2 callbacks suppressed [ 2566.653597][T12660] netlink: 'syz.3.13282': attribute type 10 has an invalid length. [ 2566.699580][T12660] netlink: 210880 bytes leftover after parsing attributes in process `syz.3.13282'. [ 2567.156923][T12662] netlink: 'syz.0.13283': attribute type 10 has an invalid length. [ 2567.206162][T12662] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13283'. [ 2567.233602][T12672] netlink: 64985 bytes leftover after parsing attributes in process `syz.2.13285'. [ 2567.283002][T12670] netlink: 'syz.3.13284': attribute type 10 has an invalid length. [ 2567.341428][T12673] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13285'. [ 2567.370059][T12672] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13285'. [ 2567.394949][T12672] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.13285'. [ 2567.417313][T12678] netlink: 830 bytes leftover after parsing attributes in process `syz.0.13287'. [ 2567.521802][T12680] netlink: 4 bytes leftover after parsing attributes in process `syz.3.13288'. [ 2567.549078][T12681] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.13287'. [ 2567.574784][T12678] netlink: 65039 bytes leftover after parsing attributes in process `syz.0.13287'. [ 2567.801533][T12687] FAULT_INJECTION: forcing a failure. [ 2567.801533][T12687] name failslab, interval 1, probability 0, space 0, times 0 [ 2567.829505][T12687] CPU: 1 PID: 12687 Comm: syz.2.13291 Not tainted syzkaller #0 [ 2567.837174][T12687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2567.847315][T12687] Call Trace: [ 2567.850674][T12687] [ 2567.853675][T12687] dump_stack_lvl+0x18c/0x250 [ 2567.858469][T12687] ? trace_event_raw_event_lock+0x240/0x240 [ 2567.864467][T12687] ? show_regs_print_info+0x20/0x20 [ 2567.869770][T12687] ? load_image+0x420/0x420 [ 2567.874421][T12687] should_fail_ex+0x394/0x4c0 [ 2567.879336][T12687] should_failslab+0x9/0x20 [ 2567.883942][T12687] slab_pre_alloc_hook+0x59/0x300 [ 2567.889073][T12687] ? proc_self_get_link+0xe5/0x180 [ 2567.894285][T12687] __kmem_cache_alloc_node+0x53/0x250 [ 2567.899750][T12687] ? proc_self_get_link+0xe5/0x180 [ 2567.904924][T12687] kmalloc_trace+0x2a/0xe0 [ 2567.909421][T12687] proc_self_get_link+0xe5/0x180 [ 2567.914429][T12687] ? proc_setup_self+0x2c0/0x2c0 [ 2567.919445][T12687] pick_link+0x6a8/0xdd0 [ 2567.923783][T12687] step_into+0xc18/0xee0 [ 2567.928136][T12687] ? set_root+0x3a0/0x3a0 [ 2567.932553][T12687] ? lookup_fast+0x14a/0x4c0 [ 2567.937317][T12687] ? security_inode_permission+0xb0/0xf0 [ 2567.943041][T12687] link_path_walk+0x748/0xe40 [ 2567.947827][T12687] ? handle_lookup_down+0x130/0x130 [ 2567.953120][T12687] path_openat+0x291/0x3270 [ 2567.957710][T12687] ? trace_call_bpf+0xc3/0x6c0 [ 2567.962633][T12687] ? do_filp_open+0x430/0x430 [ 2567.967407][T12687] ? perf_trace_lock+0x303/0x3b0 [ 2567.972474][T12687] do_filp_open+0x1f2/0x430 [ 2567.977066][T12687] ? vfs_tmpfile+0x620/0x620 [ 2567.981790][T12687] ? _raw_spin_unlock+0x28/0x40 [ 2567.986697][T12687] ? alloc_fd+0x590/0x640 [ 2567.991117][T12687] do_sys_openat2+0x134/0x1d0 [ 2567.995857][T12687] ? atomic_notifier_call_chain+0x16e/0x180 [ 2568.001812][T12687] ? do_sys_open+0xe0/0xe0 [ 2568.006285][T12687] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 2568.012318][T12687] ? srcu_init_notifier_head+0x90/0x90 [ 2568.017833][T12687] ? lock_chain_count+0x20/0x20 [ 2568.022753][T12687] __x64_sys_openat+0x139/0x160 [ 2568.027673][T12687] do_syscall_64+0x55/0xb0 [ 2568.032168][T12687] ? clear_bhb_loop+0x40/0x90 [ 2568.036900][T12687] ? clear_bhb_loop+0x40/0x90 [ 2568.041638][T12687] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2568.047589][T12687] RIP: 0033:0x7f943f35e98e [ 2568.052055][T12687] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2568.071728][T12687] RSP: 002b:00007f944026cec8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 2568.080234][T12687] RAX: ffffffffffffffda RBX: 00007f944026d6c0 RCX: 00007f943f35e98e [ 2568.088262][T12687] RDX: 0000000000000002 RSI: 00007f944026cf90 RDI: ffffffffffffff9c [ 2568.096293][T12687] RBP: 00007f944026d090 R08: 0000000000000000 R09: 0000000000000000 [ 2568.104323][T12687] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2568.112348][T12687] R13: 00007f943f626038 R14: 00007f943f625fa0 R15: 00007fff3e598588 [ 2568.120412][T12687] [ 2568.666477][T12700] netlink: 'syz.2.13295': attribute type 10 has an invalid length. [ 2568.712671][T12705] netlink: 'syz.0.13296': attribute type 10 has an invalid length. [ 2569.025525][T12715] bond0: (slave bond_slave_0): Releasing backup interface [ 2569.260529][T12715] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 2570.464088][T12741] netlink: 'syz.2.13307': attribute type 10 has an invalid length. [ 2570.610683][T12744] netlink: 'syz.4.13309': attribute type 10 has an invalid length. [ 2571.410511][T12766] bond0: (slave bond_slave_0): Releasing backup interface [ 2571.591033][T12766] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 2572.192780][T12777] netlink: 'syz.2.13317': attribute type 10 has an invalid length. [ 2572.229739][T12777] __nla_validate_parse: 26 callbacks suppressed [ 2572.230552][T12777] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13317'. [ 2572.443803][T12789] netlink: 'syz.4.13322': attribute type 10 has an invalid length. [ 2572.452493][T12789] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13322'. [ 2573.310123][T12799] netlink: 830 bytes leftover after parsing attributes in process `syz.3.13326'. [ 2573.345560][T12799] netlink: 152 bytes leftover after parsing attributes in process `syz.3.13326'. [ 2573.389730][T12799] bond0: (slave bond_slave_0): Releasing backup interface [ 2573.456076][T12799] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 2573.557627][T12808] netlink: 212424 bytes leftover after parsing attributes in process `syz.0.13324'. [ 2573.638278][T12811] FAULT_INJECTION: forcing a failure. [ 2573.638278][T12811] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2573.657154][T12811] CPU: 1 PID: 12811 Comm: syz.4.13327 Not tainted syzkaller #0 [ 2573.664777][T12811] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2573.674880][T12811] Call Trace: [ 2573.678204][T12811] [ 2573.681179][T12811] dump_stack_lvl+0x18c/0x250 [ 2573.686014][T12811] ? show_regs_print_info+0x20/0x20 [ 2573.691271][T12811] ? load_image+0x420/0x420 [ 2573.695833][T12811] ? __lock_acquire+0x7d80/0x7d80 [ 2573.700915][T12811] ? snprintf+0xe9/0x140 [ 2573.705215][T12811] should_fail_ex+0x394/0x4c0 [ 2573.709968][T12811] _copy_to_user+0x2f/0xa0 [ 2573.714441][T12811] simple_read_from_buffer+0xe7/0x150 [ 2573.719899][T12811] proc_fail_nth_read+0x1e8/0x260 [ 2573.725008][T12811] ? proc_fault_inject_write+0x360/0x360 [ 2573.730721][T12811] ? fsnotify_perm+0x271/0x5e0 [ 2573.735542][T12811] ? proc_fault_inject_write+0x360/0x360 [ 2573.741236][T12811] vfs_read+0x298/0x990 [ 2573.745475][T12811] ? kernel_read+0x1e0/0x1e0 [ 2573.750133][T12811] ? __fget_files+0x28/0x460 [ 2573.754789][T12811] ? __fget_files+0x3fc/0x460 [ 2573.759549][T12811] ? __fdget_pos+0x2a3/0x330 [ 2573.764208][T12811] ? ksys_read+0x74/0x260 [ 2573.768599][T12811] ksys_read+0x151/0x260 [ 2573.772912][T12811] ? vfs_write+0x9a0/0x9a0 [ 2573.777415][T12811] ? lockdep_hardirqs_on+0x98/0x150 [ 2573.782682][T12811] do_syscall_64+0x55/0xb0 [ 2573.787147][T12811] ? clear_bhb_loop+0x40/0x90 [ 2573.791879][T12811] ? clear_bhb_loop+0x40/0x90 [ 2573.796644][T12811] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2573.802609][T12811] RIP: 0033:0x7f51b595e98e [ 2573.807106][T12811] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2573.826776][T12811] RSP: 002b:00007f51b689efe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2573.835253][T12811] RAX: ffffffffffffffda RBX: 00007f51b689f6c0 RCX: 00007f51b595e98e [ 2573.843280][T12811] RDX: 000000000000000f RSI: 00007f51b689f0a0 RDI: 000000000000000e [ 2573.851307][T12811] RBP: 00007f51b689f090 R08: 0000000000000000 R09: 0000000000000000 [ 2573.859333][T12811] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2573.867356][T12811] R13: 00007f51b5c26218 R14: 00007f51b5c26180 R15: 00007ffd435253e8 [ 2573.875401][T12811] [ 2573.921610][T12804] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13326'. [ 2573.946298][T12799] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13326'. [ 2574.613599][T12826] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13331'. [ 2574.693559][T12833] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13331'. [ 2574.705007][T12826] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13331'. [ 2574.738734][T12831] netlink: 'syz.4.13335': attribute type 10 has an invalid length. [ 2575.272726][T12839] netlink: 'syz.0.13336': attribute type 10 has an invalid length. [ 2575.814774][T12849] netlink: 'syz.0.13339': attribute type 10 has an invalid length. [ 2575.997083][T12863] FAULT_INJECTION: forcing a failure. [ 2575.997083][T12863] name failslab, interval 1, probability 0, space 0, times 0 [ 2576.010613][T12863] CPU: 1 PID: 12863 Comm: syz.3.13343 Not tainted syzkaller #0 [ 2576.018232][T12863] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2576.028358][T12863] Call Trace: [ 2576.031694][T12863] [ 2576.034684][T12863] dump_stack_lvl+0x18c/0x250 [ 2576.039452][T12863] ? show_regs_print_info+0x20/0x20 [ 2576.044724][T12863] ? load_image+0x420/0x420 [ 2576.049308][T12863] ? __might_sleep+0xe0/0xe0 [ 2576.053980][T12863] ? __lock_acquire+0x7d80/0x7d80 [ 2576.059089][T12863] should_fail_ex+0x394/0x4c0 [ 2576.063857][T12863] should_failslab+0x9/0x20 [ 2576.068439][T12863] slab_pre_alloc_hook+0x59/0x300 [ 2576.073534][T12863] ? __lock_acquire+0x7d80/0x7d80 [ 2576.078640][T12863] ? dev_ethtool+0x129/0x18d0 [ 2576.083403][T12863] __kmem_cache_alloc_node+0x53/0x250 [ 2576.088859][T12863] ? __might_fault+0xaa/0x120 [ 2576.093580][T12863] ? dev_ethtool+0x129/0x18d0 [ 2576.098311][T12863] kmalloc_trace+0x2a/0xe0 [ 2576.102784][T12863] dev_ethtool+0x129/0x18d0 [ 2576.107347][T12863] ? ethtool_get_module_eeprom_call+0x170/0x170 [ 2576.113637][T12863] ? __lock_acquire+0x7d80/0x7d80 [ 2576.118704][T12863] ? __might_fault+0xaa/0x120 [ 2576.123414][T12863] ? full_name_hash+0x92/0xe0 [ 2576.128139][T12863] ? dev_load+0x21/0x1f0 [ 2576.132434][T12863] dev_ioctl+0x392/0x1140 [ 2576.136815][T12863] sock_do_ioctl+0x239/0x310 [ 2576.141462][T12863] ? sock_show_fdinfo+0xb0/0xb0 [ 2576.146382][T12863] sock_ioctl+0x5be/0x7e0 [ 2576.150761][T12863] ? sock_poll+0x3e0/0x3e0 [ 2576.155265][T12863] ? bpf_lsm_file_ioctl+0x9/0x10 [ 2576.160248][T12863] ? security_file_ioctl+0x80/0xa0 [ 2576.165417][T12863] ? sock_poll+0x3e0/0x3e0 [ 2576.169875][T12863] __se_sys_ioctl+0xfd/0x170 [ 2576.174510][T12863] do_syscall_64+0x55/0xb0 [ 2576.178961][T12863] ? clear_bhb_loop+0x40/0x90 [ 2576.183705][T12863] ? clear_bhb_loop+0x40/0x90 [ 2576.188425][T12863] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2576.194360][T12863] RIP: 0033:0x7f2b6879e159 [ 2576.198904][T12863] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2576.218557][T12863] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2576.227020][T12863] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2576.235037][T12863] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000011 [ 2576.243044][T12863] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2576.251061][T12863] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2576.259063][T12863] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2576.267099][T12863] [ 2576.459173][T12861] netlink: 'syz.0.13342': attribute type 10 has an invalid length. [ 2576.857172][T12872] netlink: 'syz.3.13345': attribute type 10 has an invalid length. [ 2577.281732][T12889] netlink: 'syz.2.13352': attribute type 10 has an invalid length. [ 2578.436015][T12911] FAULT_INJECTION: forcing a failure. [ 2578.436015][T12911] name failslab, interval 1, probability 0, space 0, times 0 [ 2578.479014][T12911] CPU: 1 PID: 12911 Comm: syz.3.13358 Not tainted syzkaller #0 [ 2578.486665][T12911] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2578.496781][T12911] Call Trace: [ 2578.500123][T12911] [ 2578.503116][T12911] dump_stack_lvl+0x18c/0x250 [ 2578.507873][T12911] ? show_regs_print_info+0x20/0x20 [ 2578.513144][T12911] ? load_image+0x420/0x420 [ 2578.517753][T12911] ? __might_sleep+0xe0/0xe0 [ 2578.522419][T12911] ? __lock_acquire+0x7d80/0x7d80 [ 2578.527546][T12911] should_fail_ex+0x394/0x4c0 [ 2578.532330][T12911] should_failslab+0x9/0x20 [ 2578.536909][T12911] slab_pre_alloc_hook+0x59/0x300 [ 2578.542006][T12911] ? __lock_acquire+0x7d80/0x7d80 [ 2578.547101][T12911] ? dev_ethtool+0x129/0x18d0 [ 2578.551857][T12911] __kmem_cache_alloc_node+0x53/0x250 [ 2578.557297][T12911] ? __might_fault+0xaa/0x120 [ 2578.562049][T12911] ? dev_ethtool+0x129/0x18d0 [ 2578.566803][T12911] kmalloc_trace+0x2a/0xe0 [ 2578.571302][T12911] dev_ethtool+0x129/0x18d0 [ 2578.575894][T12911] ? ethtool_get_module_eeprom_call+0x170/0x170 [ 2578.582234][T12911] ? __lock_acquire+0x7d80/0x7d80 [ 2578.587333][T12911] ? __might_fault+0xaa/0x120 [ 2578.592073][T12911] ? full_name_hash+0x92/0xe0 [ 2578.596825][T12911] ? dev_load+0x21/0x1f0 [ 2578.601151][T12911] dev_ioctl+0x392/0x1140 [ 2578.605571][T12911] sock_do_ioctl+0x239/0x310 [ 2578.610245][T12911] ? sock_show_fdinfo+0xb0/0xb0 [ 2578.615177][T12911] sock_ioctl+0x5be/0x7e0 [ 2578.619556][T12911] ? sock_poll+0x3e0/0x3e0 [ 2578.624073][T12911] ? bpf_lsm_file_ioctl+0x9/0x10 [ 2578.624895][T12908] netlink: 'syz.2.13356': attribute type 10 has an invalid length. [ 2578.629048][T12911] ? security_file_ioctl+0x80/0xa0 [ 2578.629089][T12911] ? sock_poll+0x3e0/0x3e0 [ 2578.637765][T12908] __nla_validate_parse: 7 callbacks suppressed [ 2578.637806][T12908] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13356'. [ 2578.642124][T12911] __se_sys_ioctl+0xfd/0x170 [ 2578.642170][T12911] do_syscall_64+0x55/0xb0 [ 2578.642199][T12911] ? clear_bhb_loop+0x40/0x90 [ 2578.675606][T12911] ? clear_bhb_loop+0x40/0x90 [ 2578.680364][T12911] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2578.686327][T12911] RIP: 0033:0x7f2b6879e159 [ 2578.690814][T12911] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2578.710496][T12911] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2578.718966][T12911] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2578.726981][T12911] RDX: 0000200000000080 RSI: 0000000000008946 RDI: 0000000000000012 [ 2578.734983][T12911] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2578.743003][T12911] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2578.751032][T12911] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2578.759052][T12911] [ 2579.231578][T12926] netlink: 830 bytes leftover after parsing attributes in process `syz.4.13363'. [ 2579.253640][T12919] netlink: 'syz.0.13368': attribute type 10 has an invalid length. [ 2579.277367][T12919] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13368'. [ 2579.299712][T12926] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13363'. [ 2579.341150][T12926] bond0: (slave bond_slave_0): Releasing backup interface [ 2579.400219][T12926] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 2579.426416][T12930] netlink: 'syz.2.13364': attribute type 10 has an invalid length. [ 2579.687327][T12940] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.13367'. [ 2580.021588][T12950] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.13373'. [ 2580.185283][T12950] syzkaller0: entered promiscuous mode [ 2580.191405][T12950] syzkaller0: entered allmulticast mode [ 2582.842833][T12957] netlink: 'syz.0.13375': attribute type 10 has an invalid length. [ 2582.861790][T12957] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13375'. [ 2582.892176][T12966] netlink: 'syz.3.13377': attribute type 10 has an invalid length. [ 2582.914378][T12968] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13378'. [ 2582.995661][T12968] netlink: 152 bytes leftover after parsing attributes in process `syz.2.13378'. [ 2583.065520][T12973] FAULT_INJECTION: forcing a failure. [ 2583.065520][T12973] name failslab, interval 1, probability 0, space 0, times 0 [ 2583.098035][T12973] CPU: 1 PID: 12973 Comm: syz.0.13380 Not tainted syzkaller #0 [ 2583.105688][T12973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2583.115807][T12973] Call Trace: [ 2583.119127][T12973] [ 2583.122102][T12973] dump_stack_lvl+0x18c/0x250 [ 2583.126844][T12973] ? show_regs_print_info+0x20/0x20 [ 2583.132100][T12973] ? load_image+0x420/0x420 [ 2583.136663][T12973] ? __might_sleep+0xe0/0xe0 [ 2583.141309][T12973] ? __lock_acquire+0x7d80/0x7d80 [ 2583.146394][T12973] should_fail_ex+0x394/0x4c0 [ 2583.151127][T12973] should_failslab+0x9/0x20 [ 2583.155687][T12973] slab_pre_alloc_hook+0x59/0x300 [ 2583.160756][T12973] ? call_usermodehelper_setup+0x8e/0x260 [ 2583.166510][T12973] __kmem_cache_alloc_node+0x53/0x250 [ 2583.171944][T12973] ? call_usermodehelper_setup+0x8e/0x260 [ 2583.177698][T12973] kmalloc_trace+0x2a/0xe0 [ 2583.182154][T12973] call_usermodehelper_setup+0x8e/0x260 [ 2583.187728][T12973] ? __request_module+0x600/0x600 [ 2583.192792][T12973] __request_module+0x3bb/0x600 [ 2583.197686][T12973] ? module_enforce_rwx_sections+0x150/0x150 [ 2583.203712][T12973] ? bpf_lsm_capable+0x9/0x10 [ 2583.208456][T12973] ? phonet_proto_get+0x27/0x2a0 [ 2583.213425][T12973] pn_socket_create+0x321/0x510 [ 2583.218310][T12973] __sock_create+0x49e/0x940 [ 2583.222940][T12973] __sys_socketpair+0x1c1/0x550 [ 2583.227820][T12973] __x64_sys_socketpair+0x9b/0xb0 [ 2583.232873][T12973] do_syscall_64+0x55/0xb0 [ 2583.237322][T12973] ? clear_bhb_loop+0x40/0x90 [ 2583.242027][T12973] ? clear_bhb_loop+0x40/0x90 [ 2583.246774][T12973] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2583.252712][T12973] RIP: 0033:0x7f37bc39e159 [ 2583.257154][T12973] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2583.276785][T12973] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 [ 2583.285253][T12973] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2583.293257][T12973] RDX: 0000000000000101 RSI: 0000000000000005 RDI: 0000000000000023 [ 2583.301252][T12973] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2583.309344][T12973] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000001 [ 2583.317346][T12973] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2583.325358][T12973] [ 2583.399098][T12977] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.13383'. [ 2583.794575][T12986] netlink: 10 bytes leftover after parsing attributes in process `syz.4.13384'. [ 2583.829853][T12981] netlink: 10 bytes leftover after parsing attributes in process `syz.4.13384'. [ 2583.843326][T12993] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13388'. [ 2583.921031][T12993] netlink: 152 bytes leftover after parsing attributes in process `syz.2.13388'. [ 2584.038108][T12995] netlink: 'syz.0.13389': attribute type 10 has an invalid length. [ 2584.054536][T12995] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13389'. [ 2584.093428][T12996] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13388'. [ 2584.105512][T12993] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13388'. [ 2584.118508][T12998] netlink: 'syz.3.13390': attribute type 10 has an invalid length. [ 2584.418339][T13007] netlink: 830 bytes leftover after parsing attributes in process `syz.4.13394'. [ 2584.453108][T13007] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13394'. [ 2584.955170][T13025] netlink: 'syz.3.13400': attribute type 10 has an invalid length. [ 2584.991810][T13021] netlink: 'syz.4.13399': attribute type 10 has an invalid length. [ 2585.002935][T13021] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13399'. [ 2585.646571][T13044] netlink: 'syz.4.13407': attribute type 2 has an invalid length. [ 2586.016493][T13050] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2586.630580][T13053] netlink: 'syz.0.13412': attribute type 1 has an invalid length. [ 2586.825378][T13059] netlink: 'syz.3.13414': attribute type 10 has an invalid length. [ 2586.918537][T13061] syzkaller0: entered promiscuous mode [ 2586.973496][T13061] syzkaller0: entered allmulticast mode [ 2587.058063][T13061] syzkaller0: left promiscuous mode [ 2587.063516][T13061] syzkaller0: left allmulticast mode [ 2587.088509][T13058] netlink: 'syz.2.13413': attribute type 10 has an invalid length. [ 2587.397403][T13074] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2587.466300][T13079] FAULT_INJECTION: forcing a failure. [ 2587.466300][T13079] name failslab, interval 1, probability 0, space 0, times 0 [ 2587.501984][T13079] CPU: 1 PID: 13079 Comm: syz.4.13418 Not tainted syzkaller #0 [ 2587.509615][T13079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2587.519756][T13079] Call Trace: [ 2587.523071][T13079] [ 2587.526039][T13079] dump_stack_lvl+0x18c/0x250 [ 2587.530774][T13079] ? show_regs_print_info+0x20/0x20 [ 2587.536027][T13079] ? load_image+0x420/0x420 [ 2587.540580][T13079] ? __might_sleep+0xe0/0xe0 [ 2587.545225][T13079] ? __lock_acquire+0x7d80/0x7d80 [ 2587.550308][T13079] should_fail_ex+0x394/0x4c0 [ 2587.555056][T13079] should_failslab+0x9/0x20 [ 2587.559615][T13079] slab_pre_alloc_hook+0x59/0x300 [ 2587.564696][T13079] ? __lock_acquire+0x7d80/0x7d80 [ 2587.569751][T13079] kmem_cache_alloc_node+0x5e/0x310 [ 2587.574987][T13079] ? __alloc_skb+0x103/0x2c0 [ 2587.579618][T13079] __alloc_skb+0x103/0x2c0 [ 2587.584078][T13079] netlink_sendmsg+0x66a/0xbf0 [ 2587.588873][T13079] ? aa_sock_msg_perm+0x94/0x150 [ 2587.593841][T13079] ? netlink_getsockopt+0x590/0x590 [ 2587.599069][T13079] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2587.604646][T13079] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2587.609972][T13079] ? security_socket_sendmsg+0x80/0xa0 [ 2587.615456][T13079] ? netlink_getsockopt+0x590/0x590 [ 2587.620692][T13079] ____sys_sendmsg+0x61b/0x980 [ 2587.625486][T13079] ? __asan_memset+0x22/0x40 [ 2587.630118][T13079] ? __sys_sendmsg_sock+0x30/0x30 [ 2587.635172][T13079] ? __import_iovec+0x5f2/0x850 [ 2587.640064][T13079] ? import_iovec+0x73/0xa0 [ 2587.644604][T13079] ___sys_sendmsg+0x2a6/0x360 [ 2587.649320][T13079] ? get_pid_task+0x20/0x1e0 [ 2587.653946][T13079] ? __sys_sendmsg+0x2b0/0x2b0 [ 2587.658748][T13079] ? __lock_acquire+0x7d80/0x7d80 [ 2587.663817][T13079] __se_sys_sendmsg+0x1d0/0x2c0 [ 2587.668715][T13079] ? __x64_sys_sendmsg+0x80/0x80 [ 2587.673693][T13079] ? lockdep_hardirqs_on+0x98/0x150 [ 2587.678928][T13079] do_syscall_64+0x55/0xb0 [ 2587.683370][T13079] ? clear_bhb_loop+0x40/0x90 [ 2587.688076][T13079] ? clear_bhb_loop+0x40/0x90 [ 2587.692795][T13079] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2587.698713][T13079] RIP: 0033:0x7f51b599e159 [ 2587.703157][T13079] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2587.722793][T13079] RSP: 002b:00007f51b68e1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2587.731238][T13079] RAX: ffffffffffffffda RBX: 00007f51b5c25fa0 RCX: 00007f51b599e159 [ 2587.739243][T13079] RDX: 0000000000000000 RSI: 0000200000000940 RDI: 000000000000000b [ 2587.747287][T13079] RBP: 00007f51b68e1090 R08: 0000000000000000 R09: 0000000000000000 [ 2587.755293][T13079] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2587.763292][T13079] R13: 00007f51b5c26038 R14: 00007f51b5c25fa0 R15: 00007ffd435253e8 [ 2587.771322][T13079] [ 2588.475808][T13096] netlink: 'syz.2.13425': attribute type 10 has an invalid length. [ 2588.804750][T13100] netlink: 'syz.4.13427': attribute type 10 has an invalid length. [ 2588.824464][T13100] __nla_validate_parse: 11 callbacks suppressed [ 2588.824711][T13100] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13427'. [ 2589.008374][T13113] netlink: 830 bytes leftover after parsing attributes in process `syz.0.13430'. [ 2589.055226][T13113] netlink: 152 bytes leftover after parsing attributes in process `syz.0.13430'. [ 2589.072098][T13118] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13433'. [ 2589.086471][T13118] netlink: 152 bytes leftover after parsing attributes in process `syz.2.13433'. [ 2589.279156][T13124] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.13430'. [ 2589.428360][T13119] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.13430'. [ 2589.529863][T13125] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13433'. [ 2589.564117][T13122] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13433'. [ 2590.196719][T13136] netlink: 'syz.2.13440': attribute type 5 has an invalid length. [ 2590.706834][T13145] netlink: 'syz.4.13442': attribute type 10 has an invalid length. [ 2590.719573][T13145] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13442'. [ 2590.784248][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 2590.794166][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 2591.146140][T13158] netlink: 'syz.0.13446': attribute type 10 has an invalid length. [ 2591.203001][T13158] 8021q: adding VLAN 0 to HW filter on device team0 [ 2591.257614][T13158] bond0: (slave team0): Enslaving as an active interface with an up link [ 2591.797625][T13174] FAULT_INJECTION: forcing a failure. [ 2591.797625][T13174] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2591.966873][T13174] CPU: 1 PID: 13174 Comm: syz.0.13451 Not tainted syzkaller #0 [ 2591.974547][T13174] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2591.975769][T13170] netlink: 'syz.2.13450': attribute type 10 has an invalid length. [ 2591.984651][T13174] Call Trace: [ 2591.984669][T13174] [ 2591.984687][T13174] dump_stack_lvl+0x18c/0x250 [ 2591.984741][T13174] ? show_regs_print_info+0x20/0x20 [ 2591.984777][T13174] ? load_image+0x420/0x420 [ 2591.984829][T13174] ? __might_fault+0xaa/0x120 [ 2591.984888][T13174] should_fail_ex+0x394/0x4c0 [ 2591.984961][T13174] copyin+0x1a/0x90 [ 2591.985009][T13174] _copy_from_iter+0x532/0x1290 [ 2591.985081][T13174] ? copyout_mc+0x70/0x70 [ 2591.985119][T13174] ? __virt_addr_valid+0x10c/0x380 [ 2591.985157][T13174] ? __virt_addr_valid+0x10c/0x380 [ 2591.985197][T13174] ? __virt_addr_valid+0x10c/0x380 [ 2591.985249][T13174] ? __check_object_size+0x4fc/0xa40 [ 2591.985298][T13174] netlink_sendmsg+0x76b/0xbf0 [ 2591.985367][T13174] ? netlink_getsockopt+0x590/0x590 [ 2591.985411][T13174] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2591.985455][T13174] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2591.985489][T13174] ? security_socket_sendmsg+0x80/0xa0 [ 2591.985516][T13174] ? netlink_getsockopt+0x590/0x590 [ 2591.985558][T13174] ____sys_sendmsg+0x61b/0x980 [ 2591.985619][T13174] ? __asan_memset+0x22/0x40 [ 2591.985660][T13174] ? __sys_sendmsg_sock+0x30/0x30 [ 2591.985689][T13174] ? __import_iovec+0x3fa/0x850 [ 2591.985762][T13174] ? import_iovec+0x73/0xa0 [ 2591.985817][T13174] ___sys_sendmsg+0x2a6/0x360 [ 2591.985875][T13174] ? __sys_sendmsg+0x2b0/0x2b0 [ 2591.985997][T13174] ? __lock_acquire+0x7d80/0x7d80 [ 2591.986131][T13174] __se_sys_sendmsg+0x1d0/0x2c0 [ 2591.986178][T13174] ? __x64_sys_sendmsg+0x80/0x80 [ 2591.986274][T13174] ? lockdep_hardirqs_on+0x98/0x150 [ 2591.986330][T13174] do_syscall_64+0x55/0xb0 [ 2591.986361][T13174] ? clear_bhb_loop+0x40/0x90 [ 2591.986394][T13174] ? clear_bhb_loop+0x40/0x90 [ 2591.986436][T13174] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2591.986472][T13174] RIP: 0033:0x7f37bc39e159 [ 2591.986503][T13174] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2591.986529][T13174] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2591.986564][T13174] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2591.986587][T13174] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003 [ 2591.986606][T13174] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2591.986626][T13174] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2591.986645][T13174] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2591.986725][T13174] [ 2592.589084][T13178] netlink: 'syz.0.13453': attribute type 10 has an invalid length. [ 2592.942325][T13197] netlink: 'syz.2.13458': attribute type 10 has an invalid length. [ 2592.954281][T13197] netlink: 'syz.2.13458': attribute type 10 has an invalid length. [ 2592.965658][T13192] netlink: 'syz.2.13458': attribute type 10 has an invalid length. [ 2593.311289][T13205] FAULT_INJECTION: forcing a failure. [ 2593.311289][T13205] name failslab, interval 1, probability 0, space 0, times 0 [ 2593.328482][T13205] CPU: 0 PID: 13205 Comm: syz.0.13462 Not tainted syzkaller #0 [ 2593.336107][T13205] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2593.346205][T13205] Call Trace: [ 2593.349524][T13205] [ 2593.352499][T13205] dump_stack_lvl+0x18c/0x250 [ 2593.357331][T13205] ? show_regs_print_info+0x20/0x20 [ 2593.362587][T13205] ? load_image+0x420/0x420 [ 2593.367139][T13205] ? __might_sleep+0xe0/0xe0 [ 2593.371828][T13205] ? __lock_acquire+0x7d80/0x7d80 [ 2593.376921][T13205] should_fail_ex+0x394/0x4c0 [ 2593.381656][T13205] should_failslab+0x9/0x20 [ 2593.386197][T13205] slab_pre_alloc_hook+0x59/0x300 [ 2593.391264][T13205] ? __lock_acquire+0x7d80/0x7d80 [ 2593.396328][T13205] kmem_cache_alloc_node+0x5e/0x310 [ 2593.401564][T13205] ? __alloc_skb+0x103/0x2c0 [ 2593.406189][T13205] __alloc_skb+0x103/0x2c0 [ 2593.410641][T13205] netlink_sendmsg+0x66a/0xbf0 [ 2593.415442][T13205] ? netlink_getsockopt+0x590/0x590 [ 2593.420693][T13205] ? apparmor_socket_sendmsg+0x8e/0x330 [ 2593.426270][T13205] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2593.431591][T13205] ? security_socket_sendmsg+0x80/0xa0 [ 2593.437085][T13205] ? netlink_getsockopt+0x590/0x590 [ 2593.442313][T13205] ____sys_sendmsg+0x61b/0x980 [ 2593.447115][T13205] ? __asan_memset+0x22/0x40 [ 2593.451743][T13205] ? __sys_sendmsg_sock+0x30/0x30 [ 2593.456800][T13205] ? __import_iovec+0x5f2/0x850 [ 2593.461707][T13205] ? import_iovec+0x73/0xa0 [ 2593.466252][T13205] ___sys_sendmsg+0x2a6/0x360 [ 2593.470976][T13205] ? __sys_sendmsg+0x2b0/0x2b0 [ 2593.475819][T13205] ? __lock_acquire+0x7d80/0x7d80 [ 2593.480900][T13205] __se_sys_sendmsg+0x1d0/0x2c0 [ 2593.485783][T13205] ? __x64_sys_sendmsg+0x80/0x80 [ 2593.490767][T13205] ? lockdep_hardirqs_on+0x98/0x150 [ 2593.496010][T13205] do_syscall_64+0x55/0xb0 [ 2593.500453][T13205] ? clear_bhb_loop+0x40/0x90 [ 2593.505164][T13205] ? clear_bhb_loop+0x40/0x90 [ 2593.509874][T13205] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2593.515801][T13205] RIP: 0033:0x7f37bc39e159 [ 2593.520254][T13205] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2593.539896][T13205] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2593.548335][T13205] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2593.556333][T13205] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000004 [ 2593.564333][T13205] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2593.572354][T13205] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2593.580354][T13205] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2593.588365][T13205] [ 2593.643203][T13200] validate_nla: 1 callbacks suppressed [ 2593.643222][T13200] netlink: 'syz.2.13461': attribute type 10 has an invalid length. [ 2593.943581][T13217] __nla_validate_parse: 11 callbacks suppressed [ 2593.943602][T13217] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13464'. [ 2594.013508][T13213] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13464'. [ 2594.477172][T13224] netlink: 'syz.4.13467': attribute type 10 has an invalid length. [ 2594.515385][T13227] syzkaller0: entered promiscuous mode [ 2594.523019][T13227] syzkaller0: entered allmulticast mode [ 2594.564045][T13230] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13472'. [ 2594.637375][T13232] FAULT_INJECTION: forcing a failure. [ 2594.637375][T13232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2594.734391][T13232] CPU: 1 PID: 13232 Comm: syz.3.13470 Not tainted syzkaller #0 [ 2594.742047][T13232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2594.752155][T13232] Call Trace: [ 2594.755490][T13232] [ 2594.758482][T13232] dump_stack_lvl+0x18c/0x250 [ 2594.763407][T13232] ? show_regs_print_info+0x20/0x20 [ 2594.768668][T13232] ? load_image+0x420/0x420 [ 2594.773222][T13232] ? __lock_acquire+0x7d80/0x7d80 [ 2594.778297][T13232] ? snprintf+0xe9/0x140 [ 2594.782597][T13232] should_fail_ex+0x394/0x4c0 [ 2594.787342][T13232] _copy_to_user+0x2f/0xa0 [ 2594.791853][T13232] simple_read_from_buffer+0xe7/0x150 [ 2594.797281][T13232] proc_fail_nth_read+0x1e8/0x260 [ 2594.802371][T13232] ? proc_fault_inject_write+0x360/0x360 [ 2594.808075][T13232] ? fsnotify_perm+0x271/0x5e0 [ 2594.812897][T13232] ? proc_fault_inject_write+0x360/0x360 [ 2594.818602][T13232] vfs_read+0x298/0x990 [ 2594.822826][T13232] ? kernel_read+0x1e0/0x1e0 [ 2594.827480][T13232] ? __fget_files+0x28/0x460 [ 2594.832141][T13232] ? __fget_files+0x3fc/0x460 [ 2594.836880][T13232] ? __fdget_pos+0x2a3/0x330 [ 2594.841517][T13232] ? ksys_read+0x74/0x260 [ 2594.845900][T13232] ksys_read+0x151/0x260 [ 2594.850211][T13232] ? vfs_write+0x9a0/0x9a0 [ 2594.855030][T13232] ? lockdep_hardirqs_on+0x98/0x150 [ 2594.860301][T13232] do_syscall_64+0x55/0xb0 [ 2594.864756][T13232] ? clear_bhb_loop+0x40/0x90 [ 2594.869568][T13232] ? clear_bhb_loop+0x40/0x90 [ 2594.874288][T13232] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2594.880225][T13232] RIP: 0033:0x7f2b6875e98e [ 2594.884683][T13232] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 2594.904335][T13232] RSP: 002b:00007f2b695e4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2594.912798][T13232] RAX: ffffffffffffffda RBX: 00007f2b695e56c0 RCX: 00007f2b6875e98e [ 2594.920899][T13232] RDX: 000000000000000f RSI: 00007f2b695e50a0 RDI: 0000000000000009 [ 2594.928916][T13232] RBP: 00007f2b695e5090 R08: 0000000000000000 R09: 0000000000000000 [ 2594.936956][T13232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2594.944968][T13232] R13: 00007f2b68a26128 R14: 00007f2b68a26090 R15: 00007ffffc7320b8 [ 2594.953011][T13232] [ 2595.008374][T13231] netlink: 'syz.0.13471': attribute type 10 has an invalid length. [ 2595.018080][T13231] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13471'. [ 2595.273734][T13243] netlink: 'syz.0.13479': attribute type 22 has an invalid length. [ 2595.296618][T13243] netlink: 4 bytes leftover after parsing attributes in process `syz.0.13479'. [ 2595.591518][T13240] delete_channel: no stack [ 2595.639436][T13253] netlink: 830 bytes leftover after parsing attributes in process `syz.4.13480'. [ 2595.674625][T13245] netlink: 'syz.3.13478': attribute type 10 has an invalid length. [ 2595.698096][T13245] netlink: 2 bytes leftover after parsing attributes in process `syz.3.13478'. [ 2595.720726][T13253] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13480'. [ 2595.940695][T13263] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.13480'. [ 2596.007656][T13255] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.13480'. [ 2596.164401][T13264] netlink: 'syz.0.13481': attribute type 10 has an invalid length. [ 2596.179529][T13264] netlink: 'syz.0.13481': attribute type 10 has an invalid length. [ 2596.193884][T13258] netlink: 'syz.0.13481': attribute type 10 has an invalid length. [ 2596.310495][T13268] netlink: 'syz.2.13485': attribute type 10 has an invalid length. [ 2596.437407][T13274] FAULT_INJECTION: forcing a failure. [ 2596.437407][T13274] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2596.451744][T13274] CPU: 0 PID: 13274 Comm: syz.0.13486 Not tainted syzkaller #0 [ 2596.459362][T13274] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2596.469479][T13274] Call Trace: [ 2596.472804][T13274] [ 2596.475788][T13274] dump_stack_lvl+0x18c/0x250 [ 2596.480528][T13274] ? show_regs_print_info+0x20/0x20 [ 2596.485780][T13274] ? load_image+0x420/0x420 [ 2596.490359][T13274] ? __might_fault+0xaa/0x120 [ 2596.495090][T13274] ? __lock_acquire+0x7d80/0x7d80 [ 2596.500154][T13274] ? __virt_addr_valid+0x10c/0x380 [ 2596.505343][T13274] should_fail_ex+0x394/0x4c0 [ 2596.510076][T13274] _copy_from_user+0x2f/0xe0 [ 2596.514716][T13274] btf_new_fd+0x366/0x9e0 [ 2596.519158][T13274] ? bpf_btf_show_fdinfo+0x80/0x80 [ 2596.524331][T13274] ? capable+0x88/0xe0 [ 2596.528441][T13274] __sys_bpf+0x670/0x890 [ 2596.532715][T13274] ? bpf_link_show_fdinfo+0x390/0x390 [ 2596.538131][T13274] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2596.544337][T13274] __x64_sys_bpf+0x7c/0x90 [ 2596.548784][T13274] do_syscall_64+0x55/0xb0 [ 2596.553259][T13274] ? clear_bhb_loop+0x40/0x90 [ 2596.558229][T13274] ? clear_bhb_loop+0x40/0x90 [ 2596.562974][T13274] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2596.568909][T13274] RIP: 0033:0x7f37bc39e159 [ 2596.573357][T13274] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2596.592989][T13274] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2596.601438][T13274] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2596.609445][T13274] RDX: 0000000000000028 RSI: 0000200000000200 RDI: 0000000000000012 [ 2596.617440][T13274] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2596.625433][T13274] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2596.633469][T13274] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2596.641485][T13274] [ 2596.841412][T13277] netlink: 'syz.4.13487': attribute type 10 has an invalid length. [ 2598.810507][T13314] FAULT_INJECTION: forcing a failure. [ 2598.810507][T13314] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2598.854729][T13314] CPU: 1 PID: 13314 Comm: syz.3.13498 Not tainted syzkaller #0 [ 2598.862455][T13314] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2598.872571][T13314] Call Trace: [ 2598.875889][T13314] [ 2598.878864][T13314] dump_stack_lvl+0x18c/0x250 [ 2598.883607][T13314] ? show_regs_print_info+0x20/0x20 [ 2598.888867][T13314] ? load_image+0x420/0x420 [ 2598.893428][T13314] ? __might_fault+0xaa/0x120 [ 2598.898163][T13314] should_fail_ex+0x394/0x4c0 [ 2598.902903][T13314] copyout+0x1a/0x90 [ 2598.906852][T13314] _copy_to_iter+0x42b/0x1110 [ 2598.911588][T13314] ? __virt_addr_valid+0x10c/0x380 [ 2598.916765][T13314] ? iov_iter_init+0x1e0/0x1e0 [ 2598.921583][T13314] ? __virt_addr_valid+0x10c/0x380 [ 2598.926754][T13314] ? __virt_addr_valid+0x10c/0x380 [ 2598.931919][T13314] ? __virt_addr_valid+0x10c/0x380 [ 2598.937089][T13314] ? __check_object_size+0x4fc/0xa40 [ 2598.942464][T13314] __skb_datagram_iter+0xdb/0x780 [ 2598.947566][T13314] ? skb_copy_datagram_iter+0x200/0x200 [ 2598.953190][T13314] skb_copy_datagram_iter+0xb1/0x200 [ 2598.958550][T13314] netlink_recvmsg+0x2d4/0xe60 [ 2598.963367][T13314] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 2598.969493][T13314] ? netlink_sendmsg+0xbf0/0xbf0 [ 2598.974485][T13314] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 2598.980355][T13314] ? aa_af_perm+0x330/0x330 [ 2598.984923][T13314] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 2598.990260][T13314] ? security_socket_recvmsg+0x89/0xb0 [ 2598.995764][T13314] ? netlink_sendmsg+0xbf0/0xbf0 [ 2599.000770][T13314] ____sys_recvmsg+0x2bd/0x5d0 [ 2599.005605][T13314] ? __sys_recvmsg_sock+0x50/0x50 [ 2599.010699][T13314] ? import_iovec+0x73/0xa0 [ 2599.015257][T13314] ___sys_recvmsg+0x214/0x590 [ 2599.019994][T13314] ? __sys_recvmsg+0x2a0/0x2a0 [ 2599.024779][T13314] ? ksys_write+0x1d2/0x260 [ 2599.029324][T13314] ? __fget_files+0x3fc/0x460 [ 2599.034087][T13314] __x64_sys_recvmsg+0x21e/0x2f0 [ 2599.039076][T13314] ? ___sys_recvmsg+0x590/0x590 [ 2599.043957][T13314] ? lockdep_hardirqs_on+0x98/0x150 [ 2599.049179][T13314] do_syscall_64+0x55/0xb0 [ 2599.053663][T13314] ? clear_bhb_loop+0x40/0x90 [ 2599.058376][T13314] ? clear_bhb_loop+0x40/0x90 [ 2599.063080][T13314] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2599.069007][T13314] RIP: 0033:0x7f2b6879e159 [ 2599.073443][T13314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2599.093103][T13314] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 2599.101572][T13314] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2599.109596][T13314] RDX: 0000000000010100 RSI: 0000200000000080 RDI: 0000000000000003 [ 2599.117791][T13314] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2599.125779][T13314] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2599.133803][T13314] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2599.141820][T13314] [ 2599.463408][T13316] validate_nla: 1 callbacks suppressed [ 2599.463641][T13316] netlink: 'syz.4.13500': attribute type 10 has an invalid length. [ 2599.484138][T13316] __nla_validate_parse: 12 callbacks suppressed [ 2599.484221][T13316] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13500'. [ 2599.567901][T13319] netlink: 'syz.0.13499': attribute type 10 has an invalid length. [ 2599.577782][T13319] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13499'. [ 2599.836400][T13332] netlink: 'syz.4.13502': attribute type 10 has an invalid length. [ 2599.844680][T13332] netlink: 40 bytes leftover after parsing attributes in process `syz.4.13502'. [ 2599.860816][T13333] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13507'. [ 2599.871877][T13332] netlink: 'syz.4.13502': attribute type 10 has an invalid length. [ 2599.880737][T13332] netlink: 40 bytes leftover after parsing attributes in process `syz.4.13502'. [ 2599.896224][T13333] netlink: 152 bytes leftover after parsing attributes in process `syz.2.13507'. [ 2599.918030][T13325] netlink: 'syz.4.13502': attribute type 10 has an invalid length. [ 2599.959622][T13325] netlink: 40 bytes leftover after parsing attributes in process `syz.4.13502'. [ 2600.109042][T13337] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13507'. [ 2600.135069][T13336] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13507'. [ 2600.967728][T13334] delete_channel: no stack [ 2601.123322][T13344] netlink: 'syz.4.13510': attribute type 10 has an invalid length. [ 2601.149810][T13344] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13510'. [ 2601.539064][T13359] netlink: 'syz.0.13515': attribute type 2 has an invalid length. [ 2601.710573][T13363] FAULT_INJECTION: forcing a failure. [ 2601.710573][T13363] name failslab, interval 1, probability 0, space 0, times 0 [ 2601.755823][T13363] CPU: 0 PID: 13363 Comm: syz.3.13517 Not tainted syzkaller #0 [ 2601.763465][T13363] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2601.773574][T13363] Call Trace: [ 2601.776901][T13363] [ 2601.779880][T13363] dump_stack_lvl+0x18c/0x250 [ 2601.784621][T13363] ? show_regs_print_info+0x20/0x20 [ 2601.789878][T13363] ? load_image+0x420/0x420 [ 2601.794524][T13363] ? __might_sleep+0xe0/0xe0 [ 2601.799171][T13363] ? __lock_acquire+0x7d80/0x7d80 [ 2601.804253][T13363] ? __lock_acquire+0x1262/0x7d80 [ 2601.809333][T13363] should_fail_ex+0x394/0x4c0 [ 2601.814070][T13363] should_failslab+0x9/0x20 [ 2601.818627][T13363] slab_pre_alloc_hook+0x59/0x300 [ 2601.823726][T13363] kmem_cache_alloc_node+0x5e/0x310 [ 2601.828985][T13363] ? __alloc_skb+0x103/0x2c0 [ 2601.833633][T13363] __alloc_skb+0x103/0x2c0 [ 2601.838112][T13363] alloc_skb_with_frags+0xcd/0x7a0 [ 2601.843286][T13363] ? trace_event_raw_event_lock+0x240/0x240 [ 2601.849235][T13363] ? __ipv6_dev_get_saddr+0x404/0x430 [ 2601.854678][T13363] sock_alloc_send_pskb+0x883/0x9a0 [ 2601.859959][T13363] ? sock_kzfree_s+0x50/0x50 [ 2601.864630][T13363] ? ip6_dst_lookup_tail+0xd65/0x1660 [ 2601.870074][T13363] rawv6_send_hdrinc+0x2fc/0x1660 [ 2601.875217][T13363] ? txopt_get+0x7a/0x3f0 [ 2601.879621][T13363] ? txopt_get+0x3f0/0x3f0 [ 2601.884099][T13363] ? txopt_get+0x344/0x3f0 [ 2601.888584][T13363] ? fl6_sock_lookup+0xc0/0xc0 [ 2601.893424][T13363] rawv6_sendmsg+0x128f/0x1740 [ 2601.898276][T13363] ? compat_rawv6_ioctl+0x70/0x70 [ 2601.903390][T13363] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 2601.909878][T13363] ? aa_sock_msg_perm+0x94/0x150 [ 2601.914878][T13363] ? inet_sendmsg+0x7e/0x2a0 [ 2601.919525][T13363] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2601.924861][T13363] ? inet_send_prepare+0x250/0x250 [ 2601.930045][T13363] ____sys_sendmsg+0x61b/0x980 [ 2601.934875][T13363] ? __asan_memset+0x22/0x40 [ 2601.939520][T13363] ? __sys_sendmsg_sock+0x30/0x30 [ 2601.944596][T13363] ? __import_iovec+0x5f2/0x850 [ 2601.949515][T13363] ? import_iovec+0x73/0xa0 [ 2601.954092][T13363] ___sys_sendmsg+0x2a6/0x360 [ 2601.958921][T13363] ? __sys_sendmsg+0x2b0/0x2b0 [ 2601.963772][T13363] ? __lock_acquire+0x7d80/0x7d80 [ 2601.968896][T13363] __se_sys_sendmsg+0x1d0/0x2c0 [ 2601.973897][T13363] ? __x64_sys_sendmsg+0x80/0x80 [ 2601.978912][T13363] ? lockdep_hardirqs_on+0x98/0x150 [ 2601.984179][T13363] do_syscall_64+0x55/0xb0 [ 2601.988646][T13363] ? clear_bhb_loop+0x40/0x90 [ 2601.993390][T13363] ? clear_bhb_loop+0x40/0x90 [ 2601.998135][T13363] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2602.004089][T13363] RIP: 0033:0x7f2b6879e159 [ 2602.008560][T13363] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2602.028230][T13363] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2602.036703][T13363] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2602.044723][T13363] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 2602.052752][T13363] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2602.060774][T13363] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2602.068791][T13363] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2602.076837][T13363] [ 2602.249399][T13372] netlink: 'syz.4.13520': attribute type 39 has an invalid length. [ 2603.160014][T13380] netlink: 'syz.2.13522': attribute type 10 has an invalid length. [ 2603.391621][T13392] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2603.399516][T13392] IPv6: NLM_F_CREATE should be set when creating new route [ 2603.407891][T13392] IPv6: NLM_F_CREATE should be set when creating new route [ 2603.415833][T13392] IPv6: NLM_F_CREATE should be set when creating new route [ 2603.458659][T13394] netlink: 'syz.4.13526': attribute type 9 has an invalid length. [ 2604.481361][T13398] netlink: 'syz.2.13527': attribute type 9 has an invalid length. [ 2604.501581][T13398] __nla_validate_parse: 9 callbacks suppressed [ 2604.501601][T13398] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.13527'. [ 2604.563806][T13402] FAULT_INJECTION: forcing a failure. [ 2604.563806][T13402] name failslab, interval 1, probability 0, space 0, times 0 [ 2604.578354][T13402] CPU: 0 PID: 13402 Comm: syz.3.13529 Not tainted syzkaller #0 [ 2604.586004][T13402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2604.596202][T13402] Call Trace: [ 2604.599523][T13402] [ 2604.602477][T13402] dump_stack_lvl+0x18c/0x250 [ 2604.607190][T13402] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2604.613382][T13402] ? show_regs_print_info+0x20/0x20 [ 2604.618613][T13402] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2604.624808][T13402] ? dump_stack+0x9/0x20 [ 2604.629116][T13402] should_fail_ex+0x394/0x4c0 [ 2604.633841][T13402] should_failslab+0x9/0x20 [ 2604.638386][T13402] slab_pre_alloc_hook+0x59/0x300 [ 2604.643462][T13402] kmem_cache_alloc_node+0x5e/0x310 [ 2604.648723][T13402] ? __alloc_skb+0x103/0x2c0 [ 2604.653348][T13402] __alloc_skb+0x103/0x2c0 [ 2604.657796][T13402] alloc_skb_with_frags+0xcd/0x7a0 [ 2604.662946][T13402] ? __lock_acquire+0x7d80/0x7d80 [ 2604.668012][T13402] ? __ipv6_dev_get_saddr+0x404/0x430 [ 2604.673426][T13402] sock_alloc_send_pskb+0x883/0x9a0 [ 2604.678673][T13402] ? lock_chain_count+0x20/0x20 [ 2604.683573][T13402] ? sock_kzfree_s+0x50/0x50 [ 2604.688203][T13402] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2604.694393][T13402] ? rawv6_send_hdrinc+0x25e/0x1660 [ 2604.699725][T13402] rawv6_send_hdrinc+0x2fc/0x1660 [ 2604.704964][T13402] ? txopt_get+0x3f0/0x3f0 [ 2604.709441][T13402] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2604.715655][T13402] rawv6_sendmsg+0x128f/0x1740 [ 2604.720482][T13402] ? compat_rawv6_ioctl+0x70/0x70 [ 2604.725563][T13402] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 2604.732019][T13402] ? aa_sock_msg_perm+0x94/0x150 [ 2604.737013][T13402] ? inet_sendmsg+0x7e/0x2a0 [ 2604.741633][T13402] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2604.746952][T13402] ? inet_send_prepare+0x250/0x250 [ 2604.752274][T13402] ____sys_sendmsg+0x61b/0x980 [ 2604.757070][T13402] ? __asan_memset+0x22/0x40 [ 2604.761697][T13402] ? __sys_sendmsg_sock+0x30/0x30 [ 2604.766751][T13402] ? __import_iovec+0x5f2/0x850 [ 2604.771654][T13402] ? import_iovec+0x73/0xa0 [ 2604.776207][T13402] ___sys_sendmsg+0x2a6/0x360 [ 2604.781017][T13402] ? __sys_sendmsg+0x2b0/0x2b0 [ 2604.785844][T13402] ? __lock_acquire+0x7d80/0x7d80 [ 2604.790926][T13402] __se_sys_sendmsg+0x1d0/0x2c0 [ 2604.795811][T13402] ? __x64_sys_sendmsg+0x80/0x80 [ 2604.800814][T13402] ? lockdep_hardirqs_on+0x98/0x150 [ 2604.806049][T13402] do_syscall_64+0x55/0xb0 [ 2604.810491][T13402] ? clear_bhb_loop+0x40/0x90 [ 2604.815225][T13402] ? clear_bhb_loop+0x40/0x90 [ 2604.819931][T13402] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2604.825859][T13402] RIP: 0033:0x7f2b6879e159 [ 2604.830307][T13402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2604.849949][T13402] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2604.858388][T13402] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2604.866384][T13402] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 2604.874381][T13402] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2604.882381][T13402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2604.890378][T13402] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2604.898388][T13402] [ 2605.104932][T13411] netlink: 830 bytes leftover after parsing attributes in process `syz.3.13531'. [ 2605.201063][T13411] netlink: 152 bytes leftover after parsing attributes in process `syz.3.13531'. [ 2605.237083][T13414] netlink: 'syz.4.13532': attribute type 9 has an invalid length. [ 2605.251336][T13414] netlink: 209836 bytes leftover after parsing attributes in process `syz.4.13532'. [ 2605.517387][T13415] netlink: 'syz.4.13532': attribute type 9 has an invalid length. [ 2605.525805][T13415] netlink: 652 bytes leftover after parsing attributes in process `syz.4.13532'. [ 2605.864727][T13422] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13535'. [ 2605.901147][T13422] netlink: 152 bytes leftover after parsing attributes in process `syz.2.13535'. [ 2606.056764][T13427] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13535'. [ 2606.124261][T13426] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.13535'. [ 2606.162748][T13433] FAULT_INJECTION: forcing a failure. [ 2606.162748][T13433] name failslab, interval 1, probability 0, space 0, times 0 [ 2606.191669][T13433] CPU: 0 PID: 13433 Comm: syz.3.13538 Not tainted syzkaller #0 [ 2606.199325][T13433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2606.209430][T13433] Call Trace: [ 2606.212755][T13433] [ 2606.215733][T13433] dump_stack_lvl+0x18c/0x250 [ 2606.220477][T13433] ? show_regs_print_info+0x20/0x20 [ 2606.225733][T13433] ? load_image+0x420/0x420 [ 2606.230288][T13433] ? __lock_acquire+0x7d80/0x7d80 [ 2606.235396][T13433] should_fail_ex+0x394/0x4c0 [ 2606.240170][T13433] should_failslab+0x9/0x20 [ 2606.244735][T13433] slab_pre_alloc_hook+0x59/0x300 [ 2606.249837][T13433] ? ip6_setup_cork+0x1d0/0xff0 [ 2606.254796][T13433] __kmem_cache_alloc_node+0x53/0x250 [ 2606.260253][T13433] ? ip6_setup_cork+0x1d0/0xff0 [ 2606.265167][T13433] kmalloc_trace+0x2a/0xe0 [ 2606.269647][T13433] ip6_setup_cork+0x1d0/0xff0 [ 2606.274407][T13433] ip6_append_data+0x21a/0x350 [ 2606.279244][T13433] ? ip_skb_dst_mtu+0x9c0/0x9c0 [ 2606.284198][T13433] l2tp_ip6_sendmsg+0x122c/0x1680 [ 2606.289319][T13433] ? l2tp_ip6_destroy_sock+0x60/0x60 [ 2606.294711][T13433] ? tomoyo_socket_sendmsg_permission+0x216/0x2f0 [ 2606.301196][T13433] ? sock_rps_record_flow+0x19/0x3f0 [ 2606.306549][T13433] ? inet_sendmsg+0x7e/0x2a0 [ 2606.311538][T13433] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 2606.316876][T13433] ? inet_send_prepare+0x250/0x250 [ 2606.322064][T13433] ____sys_sendmsg+0x61b/0x980 [ 2606.326908][T13433] ? __sys_sendmsg_sock+0x30/0x30 [ 2606.332010][T13433] ? __import_iovec+0x3fa/0x850 [ 2606.336948][T13433] ? import_iovec+0x73/0xa0 [ 2606.341514][T13433] ___sys_sendmsg+0x2a6/0x360 [ 2606.346256][T13433] ? __sys_sendmsg+0x2b0/0x2b0 [ 2606.351139][T13433] ? __lock_acquire+0x7d80/0x7d80 [ 2606.356281][T13433] __se_sys_sendmsg+0x1d0/0x2c0 [ 2606.361204][T13433] ? __x64_sys_sendmsg+0x80/0x80 [ 2606.366241][T13433] ? lockdep_hardirqs_on+0x98/0x150 [ 2606.371504][T13433] do_syscall_64+0x55/0xb0 [ 2606.375972][T13433] ? clear_bhb_loop+0x40/0x90 [ 2606.380696][T13433] ? clear_bhb_loop+0x40/0x90 [ 2606.385435][T13433] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2606.391383][T13433] RIP: 0033:0x7f2b6879e159 [ 2606.395851][T13433] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2606.415516][T13433] RSP: 002b:00007f2b69606028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2606.423982][T13433] RAX: ffffffffffffffda RBX: 00007f2b68a25fa0 RCX: 00007f2b6879e159 [ 2606.432046][T13433] RDX: 0000000000000000 RSI: 0000200000001180 RDI: 0000000000000003 [ 2606.440074][T13433] RBP: 00007f2b69606090 R08: 0000000000000000 R09: 0000000000000000 [ 2606.448101][T13433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2606.456118][T13433] R13: 00007f2b68a26038 R14: 00007f2b68a25fa0 R15: 00007ffffc7320b8 [ 2606.464183][T13433] [ 2607.482416][T13451] netlink: 830 bytes leftover after parsing attributes in process `syz.0.13543'. [ 2610.204547][T13465] netlink: 'syz.3.13547': attribute type 10 has an invalid length. [ 2610.252024][T13471] FAULT_INJECTION: forcing a failure. [ 2610.252024][T13471] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2610.265562][T13471] CPU: 0 PID: 13471 Comm: syz.0.13550 Not tainted syzkaller #0 [ 2610.273167][T13471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2610.283268][T13471] Call Trace: [ 2610.286591][T13471] [ 2610.289562][T13471] dump_stack_lvl+0x18c/0x250 [ 2610.294299][T13471] ? show_regs_print_info+0x20/0x20 [ 2610.299563][T13471] ? load_image+0x420/0x420 [ 2610.304117][T13471] ? __might_fault+0xaa/0x120 [ 2610.308849][T13471] ? __lock_acquire+0x7d80/0x7d80 [ 2610.313926][T13471] ? __virt_addr_valid+0x10c/0x380 [ 2610.319098][T13471] should_fail_ex+0x394/0x4c0 [ 2610.323836][T13471] _copy_from_user+0x2f/0xe0 [ 2610.328482][T13471] btf_new_fd+0x366/0x9e0 [ 2610.332877][T13471] ? bpf_btf_show_fdinfo+0x80/0x80 [ 2610.338040][T13471] ? capable+0x88/0xe0 [ 2610.342169][T13471] __sys_bpf+0x670/0x890 [ 2610.346467][T13471] ? bpf_link_show_fdinfo+0x390/0x390 [ 2610.351914][T13471] ? lock_chain_count+0x20/0x20 [ 2610.356832][T13471] __x64_sys_bpf+0x7c/0x90 [ 2610.361303][T13471] do_syscall_64+0x55/0xb0 [ 2610.365776][T13471] ? clear_bhb_loop+0x40/0x90 [ 2610.370511][T13471] ? clear_bhb_loop+0x40/0x90 [ 2610.375241][T13471] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2610.381185][T13471] RIP: 0033:0x7f37bc39e159 [ 2610.385652][T13471] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2610.405319][T13471] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2610.413800][T13471] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2610.421827][T13471] RDX: 0000000000000028 RSI: 00002000000000c0 RDI: 0000000000000012 [ 2610.429852][T13471] RBP: 00007f37bd1a8090 R08: 0000000000000000 R09: 0000000000000000 [ 2610.437869][T13471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2610.445886][T13471] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2610.453928][T13471] [ 2610.596020][T13467] netlink: 'syz.4.13548': attribute type 10 has an invalid length. [ 2610.606007][T13467] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13548'. [ 2610.666122][T13478] netlink: 830 bytes leftover after parsing attributes in process `syz.2.13553'. [ 2610.695835][T13478] netlink: 152 bytes leftover after parsing attributes in process `syz.2.13553'. [ 2611.372628][T13489] netlink: 'syz.0.13563': attribute type 10 has an invalid length. [ 2611.392523][T13489] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13563'. [ 2611.867008][T13503] netlink: 'syz.0.13560': attribute type 10 has an invalid length. [ 2613.825937][T13503] team0: Device wg1 is of different type [ 2613.853539][T13507] netlink: 'syz.3.13559': attribute type 10 has an invalid length. [ 2613.868654][T13507] netlink: 2 bytes leftover after parsing attributes in process `syz.3.13559'. [ 2614.068807][T13521] netlink: 830 bytes leftover after parsing attributes in process `syz.0.13564'. [ 2614.088920][T13524] netlink: 830 bytes leftover after parsing attributes in process `syz.4.13566'. [ 2614.113918][T13525] netlink: 830 bytes leftover after parsing attributes in process `syz.3.13565'. [ 2614.125224][T13521] netlink: 152 bytes leftover after parsing attributes in process `syz.0.13564'. [ 2614.140536][T13525] netlink: 152 bytes leftover after parsing attributes in process `syz.3.13565'. [ 2614.284023][T13518] netlink: 'syz.2.13562': attribute type 10 has an invalid length. [ 2615.934138][T13537] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2616.068593][T13540] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2616.182683][T13541] netlink: 'syz.2.13570': attribute type 10 has an invalid length. [ 2616.200371][T13541] __nla_validate_parse: 6 callbacks suppressed [ 2616.200550][T13541] netlink: 2 bytes leftover after parsing attributes in process `syz.2.13570'. [ 2616.241330][T13548] netlink: 830 bytes leftover after parsing attributes in process `syz.4.13572'. [ 2616.303792][T13548] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13572'. [ 2616.446994][T13556] netlink: 830 bytes leftover after parsing attributes in process `syz.3.13576'. [ 2616.479774][T13557] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.13572'. [ 2616.689889][T13553] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.13572'. [ 2616.780987][T13556] netlink: 152 bytes leftover after parsing attributes in process `syz.3.13576'. [ 2616.881272][T13559] netlink: 14 bytes leftover after parsing attributes in process `syz.2.13575'. [ 2617.046708][T13559] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2617.078575][T13559] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 2617.133762][T13559] bond0 (unregistering): (slave geneve0): Releasing backup interface [ 2617.163616][T13559] bond0 (unregistering): Released all slaves [ 2617.243831][T13552] netlink: 'syz.0.13574': attribute type 10 has an invalid length. [ 2617.265851][T13552] netlink: 2 bytes leftover after parsing attributes in process `syz.0.13574'. [ 2617.285534][T13556] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13576'. [ 2617.426200][T13566] netlink: 'syz.4.13577': attribute type 10 has an invalid length. [ 2618.435334][T13578] netlink: 'syz.4.13582': attribute type 10 has an invalid length. [ 2621.004297][T13595] netlink: 'syz.4.13588': attribute type 10 has an invalid length. [ 2622.296302][T13598] __nla_validate_parse: 10 callbacks suppressed [ 2622.296317][T13598] netlink: 830 bytes leftover after parsing attributes in process `syz.4.13589'. [ 2622.382619][T13598] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13589'. [ 2622.465451][T13600] netlink: 'syz.0.13590': attribute type 10 has an invalid length. [ 2622.576724][T13601] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.13589'. [ 2622.627251][T13598] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.13589'. [ 2622.669095][T13610] netlink: 830 bytes leftover after parsing attributes in process `syz.3.13594'. [ 2622.687641][T13610] netlink: 152 bytes leftover after parsing attributes in process `syz.3.13594'. [ 2622.761138][T13607] netlink: 'syz.2.13593': attribute type 10 has an invalid length. [ 2622.901258][T13612] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13594'. [ 2622.969706][T13613] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13594'. [ 2623.387333][T13617] netlink: 'syz.4.13596': attribute type 10 has an invalid length. [ 2623.454154][T13617] netlink: 2 bytes leftover after parsing attributes in process `syz.4.13596'. [ 2623.915585][T13632] netlink: 'syz.0.13601': attribute type 39 has an invalid length. [ 2624.954523][T13649] hsr0: left allmulticast mode [ 2624.962294][T13649] hsr_slave_0: left allmulticast mode [ 2624.968130][T13649] hsr_slave_1: left allmulticast mode [ 2624.978667][T13649] bridge0: port 3(hsr0) entered disabled state [ 2625.623441][T13649] bridge_slave_0: left allmulticast mode [ 2625.639382][T13649] bridge_slave_0: left promiscuous mode [ 2625.646634][T13649] bridge0: port 1(bridge_slave_0) entered disabled state [ 2625.788067][T13657] netlink: 'syz.3.13610': attribute type 29 has an invalid length. [ 2626.311810][T13657] netlink: 'syz.3.13610': attribute type 29 has an invalid length. [ 2626.563247][T13671] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.13613'. [ 2627.224299][T13684] netlink: 'syz.4.13619': attribute type 39 has an invalid length. [ 2628.014093][T13699] hsr0: left allmulticast mode [ 2628.019888][T13699] hsr_slave_0: left allmulticast mode [ 2628.028897][T13699] hsr_slave_1: left allmulticast mode [ 2628.042342][T13699] bridge0: port 3(hsr0) entered disabled state [ 2628.247936][T13699] bridge_slave_0: left allmulticast mode [ 2628.261585][T13699] bridge_slave_0: left promiscuous mode [ 2628.268388][T13699] bridge0: port 1(bridge_slave_0) entered disabled state [ 2628.701878][T13717] netlink: 'syz.4.13632': attribute type 29 has an invalid length. [ 2628.716788][T13717] netlink: 'syz.4.13632': attribute type 29 has an invalid length. [ 2629.565116][T13723] __nla_validate_parse: 1 callbacks suppressed [ 2629.565137][T13723] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.13642'. [ 2629.833764][T13730] netlink: 'syz.2.13635': attribute type 39 has an invalid length. [ 2630.729143][T13739] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.13639'. [ 2630.772033][T13739] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.13639'. [ 2632.488640][T13774] hsr0: left allmulticast mode [ 2632.516023][T13774] hsr_slave_0: left allmulticast mode [ 2632.549477][T13774] hsr_slave_1: left allmulticast mode [ 2632.574367][T13774] bridge0: port 3(hsr0) entered disabled state [ 2632.601423][T13774] bridge_slave_0: left allmulticast mode [ 2632.637717][T13774] bridge_slave_0: left promiscuous mode [ 2632.664242][T13774] bridge0: port 1(bridge_slave_0) entered disabled state [ 2633.722770][T13792] netlink: 'syz.3.13659': attribute type 13 has an invalid length. [ 2633.786340][T13792] netlink: 152 bytes leftover after parsing attributes in process `syz.3.13659'. [ 2633.862440][T13792] syz_tun: refused to change device tx_queue_len [ 2633.883106][T13792] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 2634.523759][T17202] Bluetooth: hci2: unexpected subevent 0x01 length: 150 > 18 [ 2635.250030][T13834] netlink: 184 bytes leftover after parsing attributes in process `syz.4.13677'. [ 2635.280836][T13834] team_slave_0: entered allmulticast mode [ 2636.383913][T13861] netlink: 'syz.2.13684': attribute type 10 has an invalid length. [ 2636.424333][T13861] hsr0: left promiscuous mode [ 2636.474291][T13861] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 2636.543197][T13867] netlink: 'syz.4.13687': attribute type 13 has an invalid length. [ 2636.560730][T13867] netlink: 152 bytes leftover after parsing attributes in process `syz.4.13687'. [ 2636.575674][T17202] Bluetooth: hci0: unexpected event 0x04 length: 151 > 10 [ 2636.593462][T13867] syz_tun: refused to change device tx_queue_len [ 2636.622632][T13867] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 2636.734502][T13873] ¥: port 1(team0) entered blocking state [ 2636.769488][T13873] ¥: port 1(team0) entered disabled state [ 2636.775771][T13873] team0: entered allmulticast mode [ 2636.791347][T13873] team_slave_0: entered allmulticast mode [ 2636.797621][T13873] team_slave_1: entered allmulticast mode [ 2636.812889][T13873] team0: entered promiscuous mode [ 2636.818160][T13873] team_slave_0: entered promiscuous mode [ 2636.835928][T13873] team_slave_1: entered promiscuous mode [ 2636.906317][T13880] netlink: 36 bytes leftover after parsing attributes in process `syz.2.13693'. [ 2637.801731][T13901] netlink: 'syz.0.13702': attribute type 27 has an invalid length. [ 2637.821145][T13898] delete_channel: no stack [ 2638.026936][T22718] Bluetooth: hci1: unexpected subevent 0x01 length: 150 > 18 [ 2638.628199][T22718] Bluetooth: hci0: command 0x0406 tx timeout [ 2638.898331][T13924] netlink: 'syz.0.13709': attribute type 39 has an invalid length. [ 2638.939450][T22718] Bluetooth: hci2: command 0x0406 tx timeout [ 2638.971673][T13928] netlink: 'syz.3.13711': attribute type 29 has an invalid length. [ 2639.957240][T13924] hsr_slave_1 (unregistering): left promiscuous mode [ 2640.031800][T13928] netlink: 'syz.3.13711': attribute type 29 has an invalid length. [ 2643.477396][T14019] IPv6: Can't replace route, no match found [ 2645.243239][T17202] Bluetooth: hci1: unexpected event 0x12 length: 15 > 8 [ 2645.703080][T14073] team0: left allmulticast mode [ 2645.715826][T14073] team_slave_0: left allmulticast mode [ 2645.739618][T14073] team_slave_1: left allmulticast mode [ 2645.745512][T14073] team0: left promiscuous mode [ 2645.769296][T14073] team_slave_0: left promiscuous mode [ 2645.776278][T14073] team_slave_1: left promiscuous mode [ 2645.785496][T14073] ¥: port 1(team0) entered disabled state [ 2645.916150][T14075] netlink: 'syz.4.13767': attribute type 12 has an invalid length. [ 2645.956240][T14075] netlink: 132 bytes leftover after parsing attributes in process `syz.4.13767'. [ 2646.179894][T17202] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 2647.713432][T17202] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 2652.227773][ T1295] ieee802154 phy0 wpan0: encryption failed: -22 [ 2652.259271][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 2657.339008][T14274] Dead loop on virtual device ip6_vti0, fix it urgently! [ 2661.674456][T17202] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 2664.852331][T14413] netlink: 'syz.3.13902': attribute type 12 has an invalid length. [ 2664.878494][T14413] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13902'. [ 2665.785352][T14429] netlink: 'syz.2.13908': attribute type 29 has an invalid length. [ 2665.817402][T14429] netlink: 'syz.2.13908': attribute type 29 has an invalid length. [ 2665.842510][T14429] netlink: 'syz.2.13908': attribute type 29 has an invalid length. [ 2666.138218][T14441] netlink: 'syz.3.13913': attribute type 12 has an invalid length. [ 2666.148149][T14441] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13913'. [ 2666.284584][T17202] Bluetooth: hci1: unexpected event 0x12 length: 15 > 8 [ 2666.463345][T14449] ¥: port 1(team0) entered blocking state [ 2666.482320][T14449] ¥: port 1(team0) entered disabled state [ 2666.488492][T14449] team0: entered allmulticast mode [ 2666.509417][T14449] team_slave_0: entered allmulticast mode [ 2666.515308][T14449] team_slave_1: entered allmulticast mode [ 2666.531008][T14449] team0: entered promiscuous mode [ 2666.537178][T14449] team_slave_0: entered promiscuous mode [ 2666.555439][T14449] team_slave_1: entered promiscuous mode [ 2666.787237][T14457] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13918'. [ 2667.417932][T17202] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 2667.621873][T14466] netlink: 'syz.3.13924': attribute type 12 has an invalid length. [ 2667.639402][T14466] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13924'. [ 2667.717838][T14467] syzkaller0: entered promiscuous mode [ 2667.738657][T14467] syzkaller0: entered allmulticast mode [ 2669.998544][T14489] ¥: port 1(team0) entered blocking state [ 2670.009898][T14489] ¥: port 1(team0) entered disabled state [ 2670.016067][T14489] team0: entered allmulticast mode [ 2670.026590][T14489] team_slave_1: entered allmulticast mode [ 2670.035942][T14489] team0: entered promiscuous mode [ 2670.047392][T14489] team_slave_0: entered promiscuous mode [ 2670.053763][T14489] team_slave_1: entered promiscuous mode [ 2670.339344][T17202] Bluetooth: hci2: unexpected event 0x12 length: 15 > 8 [ 2671.026151][T14499] netlink: 'syz.2.13935': attribute type 10 has an invalid length. [ 2671.064423][T14499] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2671.075430][T14499] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2671.105034][T14499] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2671.114130][T14499] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2671.164494][T14499] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2671.212781][T14499] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2671.226293][T14499] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2671.238842][T14499] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2671.262868][T14499] team0: Port device geneve1 added [ 2671.282658][T14523] netlink: 16186 bytes leftover after parsing attributes in process `syz.4.13944'. [ 2671.298656][T14521] netlink: 'syz.0.13943': attribute type 12 has an invalid length. [ 2671.307444][T14521] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13943'. [ 2671.523116][T14527] team0: left allmulticast mode [ 2671.528223][T14527] team_slave_0: left allmulticast mode [ 2671.534299][T14527] team_slave_1: left allmulticast mode [ 2671.541544][T14527] team0: left promiscuous mode [ 2671.546579][T14527] team_slave_0: left promiscuous mode [ 2671.563688][T14527] team_slave_1: left promiscuous mode [ 2671.584006][T14527] ¥: port 1(team0) entered disabled state [ 2672.014328][T17202] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 2672.460666][T14555] team0: left allmulticast mode [ 2672.483031][T14555] team_slave_1: left allmulticast mode [ 2672.489242][T14555] team0: left promiscuous mode [ 2672.495178][T14555] team_slave_0: left promiscuous mode [ 2672.527745][T14555] team_slave_1: left promiscuous mode [ 2672.551191][T14555] ¥: port 1(team0) entered disabled state [ 2673.056618][T14567] netlink: 'syz.3.13964': attribute type 12 has an invalid length. [ 2673.066026][T14567] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13964'. [ 2673.268757][T17202] Bluetooth: hci0: unexpected event 0x12 length: 15 > 8 [ 2673.420482][T14578] ¥: port 1(team0) entered blocking state [ 2673.456739][T14578] ¥: port 1(team0) entered disabled state [ 2673.466946][T14578] team0: entered allmulticast mode [ 2673.475115][T14578] team_slave_0: entered allmulticast mode [ 2673.484334][T14578] team_slave_1: entered allmulticast mode [ 2673.493333][T14578] geneve1: entered allmulticast mode [ 2673.515066][T14578] team0: entered promiscuous mode [ 2673.533684][T14578] team_slave_0: entered promiscuous mode [ 2673.544316][T14578] team_slave_1: entered promiscuous mode [ 2673.552775][T14578] geneve1: entered promiscuous mode [ 2673.731620][T17202] Bluetooth: hci2: unexpected event 0x05 length: 151 > 4 [ 2673.868736][T14595] team0: left allmulticast mode [ 2673.886633][T14595] team_slave_0: left allmulticast mode [ 2673.892797][T14595] team_slave_1: left allmulticast mode [ 2673.898821][T14595] geneve1: left allmulticast mode [ 2673.905991][T14595] team0: left promiscuous mode [ 2673.914107][T14595] team_slave_0: left promiscuous mode [ 2673.924226][T14595] team_slave_1: left promiscuous mode [ 2673.932228][T14595] geneve1: left promiscuous mode [ 2673.940842][T14595] ¥: port 1(team0) entered disabled state [ 2674.815403][T22718] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 2676.916148][T14610] netlink: 'syz.0.13983': attribute type 12 has an invalid length. [ 2676.952831][T14610] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13983'. [ 2677.178855][T14615] ¥: port 1(team0) entered blocking state [ 2677.187722][T14615] ¥: port 1(team0) entered disabled state [ 2677.196728][T14615] team0: entered allmulticast mode [ 2677.204429][T14615] team_slave_0: entered allmulticast mode [ 2677.214906][T14615] team_slave_1: entered allmulticast mode [ 2677.226858][T14615] team0: entered promiscuous mode [ 2677.236132][T14615] team_slave_0: entered promiscuous mode [ 2677.243754][T14615] team_slave_1: entered promiscuous mode [ 2677.620488][T14621] netlink: 'syz.0.13988': attribute type 10 has an invalid length. [ 2677.758034][T14621] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2677.780236][T17202] Bluetooth: hci4: unexpected event 0x12 length: 15 > 8 [ 2677.785553][T14621] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2677.829903][T14621] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2677.853581][T14621] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 2677.910717][T14621] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2677.926042][T14621] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2677.939557][T14621] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2677.949649][T14621] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2677.984128][T14621] team0: Port device geneve1 added [ 2678.139924][T14629] team0: left allmulticast mode [ 2678.145147][T14629] team_slave_0: left allmulticast mode [ 2678.161791][T14629] team_slave_1: left allmulticast mode [ 2678.167946][T14629] team0: left promiscuous mode [ 2678.183970][T14629] team_slave_0: left promiscuous mode [ 2678.192029][T14629] team_slave_1: left promiscuous mode [ 2678.200230][T14629] ¥: port 1(team0) entered disabled state [ 2678.300097][T14637] netlink: 'syz.2.13994': attribute type 12 has an invalid length. [ 2678.308198][T14637] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13994'. [ 2678.578175][T14644] ¥: port 1(team0) entered blocking state [ 2678.584290][T14644] ¥: port 1(team0) entered disabled state [ 2678.590388][T14644] team0: entered allmulticast mode [ 2678.595643][T14644] team_slave_0: entered allmulticast mode [ 2678.605773][T14644] team_slave_1: entered allmulticast mode [ 2678.616929][T14644] geneve1: entered allmulticast mode [ 2678.624225][T14644] team0: entered promiscuous mode [ 2678.629814][T14644] team_slave_0: entered promiscuous mode [ 2678.635774][T14644] team_slave_1: entered promiscuous mode [ 2678.642153][T14644] geneve1: entered promiscuous mode [ 2678.822890][T14649] netlink: 'syz.0.13999': attribute type 10 has an invalid length. [ 2678.902872][T14649] team0: Device hsr_slave_0 failed to register rx_handler [ 2679.092284][T14658] ------------[ cut here ]------------ [ 2679.097828][T14658] backtracing misuse [ 2679.098033][T14658] WARNING: CPU: 0 PID: 14658 at kernel/bpf/verifier.c:4381 __mark_chain_precision+0x59c2/0x60f0 [ 2679.113063][T14658] Modules linked in: [ 2679.117017][T14658] CPU: 0 PID: 14658 Comm: syz.0.14003 Not tainted syzkaller #0 [ 2679.124662][T14658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2679.134889][T14658] RIP: 0010:__mark_chain_precision+0x59c2/0x60f0 [ 2679.141388][T14658] Code: 8c 07 ff ff ff 4c 89 ff e8 2b f7 47 00 e9 fa fe ff ff e8 61 75 ef ff c6 05 b1 02 df 0c 01 48 c7 c7 60 a6 d0 8a e8 0e 42 b9 ff <0f> 0b b8 f2 ff ff ff e9 25 f4 ff ff e8 3d 75 ef ff e9 19 f4 ff ff [ 2679.161178][T14658] RSP: 0018:ffffc9000ca5ed00 EFLAGS: 00010246 [ 2679.167309][T14658] RAX: 32cad57c56e86500 RBX: 0000000000000006 RCX: 0000000000080000 [ 2679.175693][T14658] RDX: ffffc9001158c000 RSI: 00000000000055b3 RDI: 00000000000055b4 [ 2679.183811][T14658] RBP: ffffc9000ca5eef0 R08: ffff8880b8e28c53 R09: 1ffff110171c518a [ 2679.191873][T14658] R10: dffffc0000000000 R11: ffffed10171c518b R12: 0000000000000001 [ 2679.200027][T14658] R13: dffffc0000000000 R14: ffff88806a904150 R15: 0000000000000001 [ 2679.208147][T14658] FS: 00007f37bd1a86c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 2679.217182][T14658] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2679.224305][T14658] CR2: 0000001b32623ffc CR3: 000000006a23e000 CR4: 00000000003506f0 [ 2679.232406][T14658] DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 [ 2679.240500][T14658] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 2679.248552][T14658] Call Trace: [ 2679.251940][T14658] [ 2679.254946][T14658] ? mark_chain_precision+0x20/0x20 [ 2679.260373][T14658] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 2679.265988][T14658] ? print_verifier_state+0x2e70/0x2e70 [ 2679.271692][T14658] ? mark_chain_precision+0x20/0x20 [ 2679.277041][T14658] ? bpf_lsm_capable+0x9/0x10 [ 2679.281859][T14658] ? security_capable+0x89/0xb0 [ 2679.286779][T14658] ? update_loop_inline_state+0x1c2/0x530 [ 2679.292661][T14658] check_helper_call+0x42d3/0x6340 [ 2679.297937][T14658] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 2679.303667][T14658] ? check_kfunc_call+0x4ca0/0x4ca0 [ 2679.308938][T14658] ? verbose+0x11e/0x1a0 [ 2679.313408][T14658] ? bpf_vlog_reset+0x299/0x330 [ 2679.318339][T14658] ? print_insn_state+0x100/0x160 [ 2679.323523][T14658] do_check+0x87fb/0xd0a0 [ 2679.327935][T14658] ? __stack_depot_save+0x1f/0x660 [ 2679.333172][T14658] ? __kasan_kmalloc+0x8f/0xa0 [ 2679.338004][T14658] ? __sys_bpf+0x5ba/0x890 [ 2679.342589][T14658] ? __x64_sys_bpf+0x7c/0x90 [ 2679.347235][T14658] ? do_syscall_64+0x55/0xb0 [ 2679.351990][T14658] ? init_func_state+0x2d10/0x2d10 [ 2679.357170][T14658] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 2679.362868][T14658] ? print_verifier_state+0x2e70/0x2e70 [ 2679.368485][T14658] ? btf_check_subprog_arg_match+0x216/0x2a0 [ 2679.374598][T14658] do_check_common+0xacc/0x1410 [ 2679.379595][T14658] bpf_check+0x65d1/0xec30 [ 2679.384096][T14658] ? __lock_acquire+0x1336/0x7d80 [ 2679.389235][T14658] ? bpf_get_btf_vmlinux+0x20/0x20 [ 2679.394411][T14658] ? __lock_acquire+0x1262/0x7d80 [ 2679.399605][T14658] ? mark_lock+0x94/0x320 [ 2679.404005][T14658] ? __lock_acquire+0x1336/0x7d80 [ 2679.409115][T14658] ? verify_lock_unused+0x140/0x140 [ 2679.414466][T14658] ? verify_lock_unused+0x140/0x140 [ 2679.419835][T14658] ? verify_lock_unused+0x140/0x140 [ 2679.425105][T14658] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 2679.431057][T14658] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 2679.437096][T14658] ? __lock_acquire+0x7d80/0x7d80 [ 2679.442245][T14658] ? lock_chain_count+0x20/0x20 [ 2679.447164][T14658] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 2679.453518][T14658] ? lockdep_hardirqs_on+0x98/0x150 [ 2679.458790][T14658] ? ktime_get_with_offset+0x103/0x330 [ 2679.464391][T14658] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 2679.470747][T14658] ? ktime_get_real_ts64+0x440/0x440 [ 2679.476090][T14658] ? do_raw_spin_unlock+0x121/0x230 [ 2679.481558][T14658] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2679.486647][T14658] bpf_prog_load+0x10fa/0x1610 [ 2679.491528][T14658] ? map_freeze+0x420/0x420 [ 2679.496113][T14658] ? __might_fault+0xaa/0x120 [ 2679.500927][T14658] ? __might_fault+0xc6/0x120 [ 2679.505683][T14658] ? __might_fault+0xaa/0x120 [ 2679.510458][T14658] ? bpf_lsm_bpf+0x9/0x10 [ 2679.514873][T14658] ? security_bpf+0x7e/0xa0 [ 2679.519541][T14658] __sys_bpf+0x5ba/0x890 [ 2679.523848][T14658] ? bpf_link_show_fdinfo+0x390/0x390 [ 2679.529379][T14658] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 2679.535377][T14658] ? lock_chain_count+0x20/0x20 [ 2679.540378][T14658] __x64_sys_bpf+0x7c/0x90 [ 2679.544855][T14658] do_syscall_64+0x55/0xb0 [ 2679.549397][T14658] ? clear_bhb_loop+0x40/0x90 [ 2679.554135][T14658] ? clear_bhb_loop+0x40/0x90 [ 2679.558872][T14658] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2679.564996][T14658] RIP: 0033:0x7f37bc39e159 [ 2679.569573][T14658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2679.589314][T14658] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2679.597802][T14658] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2679.605903][T14658] RDX: 0000000000000080 RSI: 0000200000000300 RDI: 0000000000000005 [ 2679.614004][T14658] RBP: 00007f37bc43503b R08: 0000000000000000 R09: 0000000000000000 [ 2679.622653][T14658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2679.630760][T14658] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2679.638807][T14658] [ 2679.641936][T14658] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2679.649253][T14658] CPU: 0 PID: 14658 Comm: syz.0.14003 Not tainted syzkaller #0 [ 2679.656877][T14658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2679.666986][T14658] Call Trace: [ 2679.670304][T14658] [ 2679.673259][T14658] dump_stack_lvl+0x18c/0x250 [ 2679.677973][T14658] ? show_regs_print_info+0x20/0x20 [ 2679.683201][T14658] ? load_image+0x420/0x420 [ 2679.687738][T14658] panic+0x2ca/0x720 [ 2679.691672][T14658] ? bpf_jit_dump+0xd0/0xd0 [ 2679.696219][T14658] __warn+0x2e0/0x470 [ 2679.700427][T14658] ? __mark_chain_precision+0x59c2/0x60f0 [ 2679.706185][T14658] ? __mark_chain_precision+0x59c2/0x60f0 [ 2679.711936][T14658] report_bug+0x2be/0x4f0 [ 2679.716328][T14658] ? __mark_chain_precision+0x59c2/0x60f0 [ 2679.722079][T14658] ? __mark_chain_precision+0x59c2/0x60f0 [ 2679.727826][T14658] ? __mark_chain_precision+0x59c4/0x60f0 [ 2679.733572][T14658] handle_bug+0xcf/0x120 [ 2679.737841][T14658] exc_invalid_op+0x1a/0x50 [ 2679.742381][T14658] asm_exc_invalid_op+0x1a/0x20 [ 2679.747263][T14658] RIP: 0010:__mark_chain_precision+0x59c2/0x60f0 [ 2679.753626][T14658] Code: 8c 07 ff ff ff 4c 89 ff e8 2b f7 47 00 e9 fa fe ff ff e8 61 75 ef ff c6 05 b1 02 df 0c 01 48 c7 c7 60 a6 d0 8a e8 0e 42 b9 ff <0f> 0b b8 f2 ff ff ff e9 25 f4 ff ff e8 3d 75 ef ff e9 19 f4 ff ff [ 2679.773257][T14658] RSP: 0018:ffffc9000ca5ed00 EFLAGS: 00010246 [ 2679.779353][T14658] RAX: 32cad57c56e86500 RBX: 0000000000000006 RCX: 0000000000080000 [ 2679.787346][T14658] RDX: ffffc9001158c000 RSI: 00000000000055b3 RDI: 00000000000055b4 [ 2679.795340][T14658] RBP: ffffc9000ca5eef0 R08: ffff8880b8e28c53 R09: 1ffff110171c518a [ 2679.803336][T14658] R10: dffffc0000000000 R11: ffffed10171c518b R12: 0000000000000001 [ 2679.811329][T14658] R13: dffffc0000000000 R14: ffff88806a904150 R15: 0000000000000001 [ 2679.819364][T14658] ? mark_chain_precision+0x20/0x20 [ 2679.824602][T14658] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 2679.830178][T14658] ? print_verifier_state+0x2e70/0x2e70 [ 2679.835759][T14658] ? mark_chain_precision+0x20/0x20 [ 2679.840984][T14658] ? bpf_lsm_capable+0x9/0x10 [ 2679.845693][T14658] ? security_capable+0x89/0xb0 [ 2679.850575][T14658] ? update_loop_inline_state+0x1c2/0x530 [ 2679.856327][T14658] check_helper_call+0x42d3/0x6340 [ 2679.861482][T14658] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 2679.867072][T14658] ? check_kfunc_call+0x4ca0/0x4ca0 [ 2679.872305][T14658] ? verbose+0x11e/0x1a0 [ 2679.876587][T14658] ? bpf_vlog_reset+0x299/0x330 [ 2679.881484][T14658] ? print_insn_state+0x100/0x160 [ 2679.886549][T14658] do_check+0x87fb/0xd0a0 [ 2679.890930][T14658] ? __stack_depot_save+0x1f/0x660 [ 2679.896082][T14658] ? __kasan_kmalloc+0x8f/0xa0 [ 2679.900887][T14658] ? __sys_bpf+0x5ba/0x890 [ 2679.905337][T14658] ? __x64_sys_bpf+0x7c/0x90 [ 2679.909953][T14658] ? do_syscall_64+0x55/0xb0 [ 2679.914598][T14658] ? init_func_state+0x2d10/0x2d10 [ 2679.919745][T14658] ? check_func_arg_reg_off+0x2f0/0x2f0 [ 2679.925327][T14658] ? print_verifier_state+0x2e70/0x2e70 [ 2679.930918][T14658] ? btf_check_subprog_arg_match+0x216/0x2a0 [ 2679.936947][T14658] do_check_common+0xacc/0x1410 [ 2679.941854][T14658] bpf_check+0x65d1/0xec30 [ 2679.946318][T14658] ? __lock_acquire+0x1336/0x7d80 [ 2679.951643][T14658] ? bpf_get_btf_vmlinux+0x20/0x20 [ 2679.956877][T14658] ? __lock_acquire+0x1262/0x7d80 [ 2679.961954][T14658] ? mark_lock+0x94/0x320 [ 2679.966339][T14658] ? __lock_acquire+0x1336/0x7d80 [ 2679.971428][T14658] ? verify_lock_unused+0x140/0x140 [ 2679.976691][T14658] ? verify_lock_unused+0x140/0x140 [ 2679.982017][T14658] ? verify_lock_unused+0x140/0x140 [ 2679.987254][T14658] ? pcpu_memcg_post_alloc_hook+0xef/0x3f0 [ 2679.993110][T14658] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 2679.999128][T14658] ? __lock_acquire+0x7d80/0x7d80 [ 2680.004187][T14658] ? lock_chain_count+0x20/0x20 [ 2680.009098][T14658] ? seqcount_lockdep_reader_access+0x12b/0x1d0 [ 2680.016066][T14658] ? lockdep_hardirqs_on+0x98/0x150 [ 2680.021300][T14658] ? ktime_get_with_offset+0x103/0x330 [ 2680.026794][T14658] ? seqcount_lockdep_reader_access+0x191/0x1d0 [ 2680.033065][T14658] ? ktime_get_real_ts64+0x440/0x440 [ 2680.038378][T14658] ? do_raw_spin_unlock+0x121/0x230 [ 2680.043615][T14658] ? bpf_obj_name_cpy+0x194/0x1e0 [ 2680.048668][T14658] bpf_prog_load+0x10fa/0x1610 [ 2680.053483][T14658] ? map_freeze+0x420/0x420 [ 2680.058022][T14658] ? __might_fault+0xaa/0x120 [ 2680.062723][T14658] ? __might_fault+0xc6/0x120 [ 2680.067426][T14658] ? __might_fault+0xaa/0x120 [ 2680.072160][T14658] ? bpf_lsm_bpf+0x9/0x10 [ 2680.076519][T14658] ? security_bpf+0x7e/0xa0 [ 2680.081838][T14658] __sys_bpf+0x5ba/0x890 [ 2680.086122][T14658] ? bpf_link_show_fdinfo+0x390/0x390 [ 2680.091518][T14658] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 2680.097459][T14658] ? lock_chain_count+0x20/0x20 [ 2680.102431][T14658] __x64_sys_bpf+0x7c/0x90 [ 2680.106880][T14658] do_syscall_64+0x55/0xb0 [ 2680.111326][T14658] ? clear_bhb_loop+0x40/0x90 [ 2680.116041][T14658] ? clear_bhb_loop+0x40/0x90 [ 2680.120744][T14658] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2680.126660][T14658] RIP: 0033:0x7f37bc39e159 [ 2680.131102][T14658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2680.150736][T14658] RSP: 002b:00007f37bd1a8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2680.159176][T14658] RAX: ffffffffffffffda RBX: 00007f37bc625fa0 RCX: 00007f37bc39e159 [ 2680.167185][T14658] RDX: 0000000000000080 RSI: 0000200000000300 RDI: 0000000000000005 [ 2680.175189][T14658] RBP: 00007f37bc43503b R08: 0000000000000000 R09: 0000000000000000 [ 2680.183180][T14658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2680.191171][T14658] R13: 00007f37bc626038 R14: 00007f37bc625fa0 R15: 00007ffeece4e908 [ 2680.199189][T14658] [ 2680.202826][T14658] Kernel Offset: disabled [ 2680.207161][T14658] Rebooting in 86400 seconds..