last executing test programs: 4.39076613s ago: executing program 3 (id=9674): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[], 0xfdef) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) 4.274802862s ago: executing program 3 (id=9675): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$ITER_CREATE(0xb, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7902009875f37538e486dd6317ce62667f2c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa88"], 0xfdef) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_config_ext={0x7fffffff, 0xa2e}, 0xc501, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x9800, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x84000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedc0790700117df37538e486dd6317ce2200"], 0xfdef) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0x11, &(0x7f0000000000)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) close(r1) socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0xfd, 0x7, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x8012, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x80581, 0xca, 0x0, 0x0, 0x0, 0x400000, 0x2, 0x0, 0x6, 0x0, 0x8}, 0xffffffffffffffff, 0x0, r2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}, 0x1c0) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x9a) 3.295204882s ago: executing program 0 (id=9678): r0 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x80000005}, {0x2}]}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000680)={0x0, &(0x7f0000000240)=""/129, &(0x7f0000000500)="65517995ef6f18f41594f5635bba7254707d6e2ab1eab4b2550c13fae867e3199a0fd2cd7f7df576ad4c8f8466fbb641dd4a2d445db7a08fb67a7a9fdea6912a7108cd8cc02a65a69910e3773a0b1e38da476af976173c326e35de17ca7482ad73b63bee4efe65f97ee6422bec976e6db99672e9d246e8a30cfbd8a3f916d0e4bd7013da4efdc32d586767aaf245376bc719891fc17401025505a867", 0x0, 0xd, 0x1}, 0x38) sendmsg$inet(r0, &(0x7f00000029c0)={&(0x7f0000000100)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000002780)=[{&(0x7f00000006c0)='{', 0x1}], 0x1}, 0x4000040) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x1, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$kcm(0x10, 0x2, 0x0) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'team0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000001040)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000140)="97", 0xffe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="18f3ffff01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x7b, &(0x7f0000000000)=r4, 0x8) close(r0) 3.187055524s ago: executing program 3 (id=9680): perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_bp={0x0}, 0x11efa, 0x4, 0x9b, 0x4, 0x1000, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="280100000000000001000000"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x88}, 0x0) 3.109626435s ago: executing program 0 (id=9681): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1d, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0500000000f01f00810000007f"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r3, &(0x7f0000000180), 0x0}, 0x20) 3.096029745s ago: executing program 2 (id=9683): r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0xa, 0x2, 0x3a) r3 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r4, &(0x7f0000000040)=ANY=[], 0x101d0) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x104101, 0x4, 0x0, 0x5, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) socketpair(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x0, 0xfffffffffffffe3d}, 0x28) ioctl$PERF_EVENT_IOC_SET_FILTER(r5, 0x89a0, &(0x7f0000000080)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x2, 0x1024, &(0x7f0000001540)=""/4132, 0x0, 0x5}, 0x94) r6 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r6, &(0x7f0000002ec0)={&(0x7f0000001b00)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x18, 0x0, 0x0, 0x0, 0x0, 0x86a9}, 0x20000000) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYRES16=r1], 0xfe33) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xffffff2d, &(0x7f0000000080)=[{&(0x7f0000000040)="c00e020023000b11d25a806f8c6394f90524fc60040f030048000000053582c137153e370248018000f01700d1bd", 0x33fe0}], 0x1}, 0x0) 2.912289837s ago: executing program 1 (id=9684): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[], 0xfdef) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002a80)=""/4096, 0xfdef}], 0x1}, 0x10021) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) 2.725829049s ago: executing program 2 (id=9685): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0xc48}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5, 0x184104, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x4}, 0x100600, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfdd9}, 0x0, 0x0, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x6, 0x20, 0x2, 0x40, 0x0, 0x7fffffffffffffff, 0x8, 0x6, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6, 0x0, @perf_config_ext={0x2ee8, 0x4}, 0x108208, 0x4, 0x4, 0x4, 0x7, 0x1, 0x6, 0x0, 0x5, 0x0, 0x7fffffffffffffff}, 0x0, 0x4, r0, 0x9) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="5c00000011006bec9e3be35c6e17aa31076b876c1d0000007ea20864160af3653c001ac00400020208000200030001001400000007b556a737c160f9555b4755bb05251e618200000051f60a84c9f4d4938037e786a6", 0x56}, {&(0x7f0000000140)="7e3f15d6d2ee", 0x6}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) close(r2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x8982, 0x20000000) r3 = perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x410, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="01f8ffffff8d"}) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x9) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x21, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xbd3, 0x0, 0x0, 0x0, 0x6}, [@btf_id={0x18, 0x9, 0x3, 0x0, 0x4}, @alu={0x7, 0x1, 0xc, 0x9, 0x6, 0x20}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x2}, @alu={0x4, 0x1, 0x4, 0x0, 0xc, 0xffffffffffffffe0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @jmp={0x5, 0x0, 0xa, 0xa, 0x0, 0x2, 0x1}, @map_val={0x18, 0x5, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x3ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xdb}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}}]}, &(0x7f0000000400)='syzkaller\x00', 0x3, 0xf7, &(0x7f0000000500)=""/247, 0x41100, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000640)={0x1, 0x6, 0x9, 0x1c4}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000680)=[{0x2, 0x3, 0x10, 0xb}, {0x5, 0x1, 0x2, 0x9}, {0x1, 0x1, 0xf, 0x5}, {0x5, 0x4, 0x6, 0xd}], 0x10, 0x9}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61123000000000006113100000000000bf2000000000000016000200071b48013d030100000000009500000000000000bc26000000000000bf67000000000000070200000fff07276702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r6}, 0x94) 1.724142511s ago: executing program 0 (id=9686): perf_event_open(&(0x7f0000000380)={0x1, 0x80, 0x0, 0x16, 0x2, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0xca, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x400, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000001000)='ns/pid_for_children\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/cgroup\x00') sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}, 0x140) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000380)='ns/uts\x00') recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85feff0fc9"], 0x0, 0x80, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$kcm(0xa, 0x922000000003, 0x11) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r1, @ANYRES8=r5], 0x12) 1.723817781s ago: executing program 3 (id=9687): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f00000008c0), 0x43) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002a80)=""/4096, 0xfdef}], 0x1}, 0x10021) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) 1.719135861s ago: executing program 1 (id=9688): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x0, 0x0, 0x0}, 0x94) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x310c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_pid(r3, &(0x7f0000000080), 0x12) write$cgroup_int(r3, &(0x7f0000000100)=0x1, 0x12) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000040)="1400000028000b6394f90509a16dd8e500", 0x11}, {&(0x7f0000000100)="c257ed26aafaa5f7f29da173ae949562213b240642f686b3e68fcf1f5d850959cafe82c328c8d9b8807bf49f", 0x2c}], 0x2}, 0x0) close(0xffffffffffffffff) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x89f1, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, 0x0}, 0x20) 1.667085051s ago: executing program 2 (id=9689): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x4080, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x0, 0x4206}, 0x2, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000240)={{r0, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)='%pB \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000280)={r1}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1a, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x5}, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)) socketpair(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f375ffff86dd6317ce62070000000000000000431ccaf57b00000000000000000104"], 0xfe1b) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x0, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="851000000000000018100000", @ANYRES32, @ANYBLOB="f0f605748aed0000000000000c00000045"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x90) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip_vti0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x89f1, &(0x7f0000000080)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x89f2, &(0x7f0000000080)) 1.504034183s ago: executing program 1 (id=9690): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[], 0xfdef) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) 1.494864583s ago: executing program 0 (id=9691): r0 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x80000005}, {0x2}]}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xf, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000680)={0x0, &(0x7f0000000240)=""/129, &(0x7f0000000500)="65517995ef6f18f41594f5635bba7254707d6e2ab1eab4b2550c13fae867e3199a0fd2cd7f7df576ad4c8f8466fbb641dd4a2d445db7a08fb67a7a9fdea6912a7108cd8cc02a65a69910e3773a0b1e38da476af976173c326e35de17ca7482ad73b63bee4efe65f97ee6422bec976e6db99672e9d246e8a30cfbd8a3f916d0e4bd7013da4efdc32d586767aaf245376bc719891fc17401025505a867", 0x0, 0xd, 0x1}, 0x38) sendmsg$inet(r0, &(0x7f00000029c0)={&(0x7f0000000100)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000002780)=[{&(0x7f00000006c0)='{', 0x1}], 0x1}, 0x4000040) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x1, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$kcm(0x10, 0x2, 0x0) ioctl$TUNSETCARRIER(0xffffffffffffffff, 0x400454e2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'team0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x8946, 0x0) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000001040)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000000340)=[{&(0x7f0000000140)="97", 0xffe0}], 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="18f3ffff01"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) recvmsg$unix(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x7b, &(0x7f0000000000)=r4, 0x8) close(r0) 1.440264624s ago: executing program 1 (id=9692): socket$kcm(0x10, 0x2, 0x0) perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b83, 0x2, @perf_bp={0x0, 0x3}, 0x8000, 0x5, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_bp={0x0}, 0x11efa, 0x4, 0x9b, 0x4, 0x1000, 0xfffff271, 0xfffc, 0x0, 0x0, 0x0, 0x8001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socket$kcm(0x10, 0x2, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000740)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x10}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x88}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x0, 0x0, 0x0, &(0x7f0000000000)='GPL\x00'}, 0x80) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'netdevsim0\x00'}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000080)) 1.416180744s ago: executing program 2 (id=9693): perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x9c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x10c002, 0xac5d, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x1c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, @perf_bp={0x0}, 0x10c002, 0xac5d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) perf_event_open(&(0x7f0000000140)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x0, 0x510, 0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x2, @perf_config_ext={0x4, 0xffffffff}, 0x0, 0x10000, 0x9e4, 0x5, 0x8, 0x20005, 0x0, 0x0, 0x0, 0x0, 0x20000006}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x9}, 0xc001, 0x0, 0x0, 0xd, 0x0, 0x7}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000002000000085000000870000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000010b703000000000000850000009b00000095"], &(0x7f0000000080)='syzkaller\x00'}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0) socket$kcm(0x2, 0x5, 0x84) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x402, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3efd7ab4c41335d9, @perf_bp={0x0}, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x3, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) socket$kcm(0x10, 0x2, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0, 0x8}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB="0000e4ffffffffffffff00000000000089090000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/17], 0x48) bpf$OBJ_PIN_MAP(0x9, &(0x7f0000000040)=@generic={0x0, r0}, 0x18) 1.329502975s ago: executing program 0 (id=9694): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1d, 0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0500000000f01f00810000007f"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000080)={r3, &(0x7f0000000180), 0x0}, 0x20) 1.274247516s ago: executing program 1 (id=9695): perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82744, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x6ce29e0b86f4d33f, @perf_bp={0x0}, 0x0, 0xc8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x0, 0x5, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000480)={0x2, 0x80, 0xed, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb30d3dfc956c077c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x104101, 0x4, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x3) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$kcm(0xa, 0x1, 0x106) sendmsg$kcm(r2, &(0x7f0000000140)={&(0x7f0000000080)=@in6={0xa, 0x4e24, 0x2, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7}, 0x80, 0x0}, 0x20000010) sendmsg$kcm(r2, &(0x7f0000000780)={&(0x7f0000000000)=@in6={0xa, 0x4e23, 0x0, @remote, 0x2}, 0x80, 0x0}, 0xe07e872420dfefca) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000002340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r3) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r5, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r6, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) 1.167367057s ago: executing program 2 (id=9696): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[], 0xfdef) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002a80)=""/4096, 0xfdef}], 0x1}, 0x10021) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) 794.234801ms ago: executing program 3 (id=9697): perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000680), 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x29, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff23, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000780)={0x0, 0x0, 0x0}, 0xe07e872420dfefca) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10000005, 0x80100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={0x0, 0x4}, 0x11540}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xb) perf_event_open(&(0x7f0000000100)={0x5, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000300), 0x4}, 0x8002}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x2, 0x7, 0x0, 0x1, 0x10000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r2}, 0x0, &(0x7f0000000180)}, 0x20) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4000}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r3, r2}, 0xc) syz_open_procfs$namespace(0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000071115f00000000008510000002000000850000000000000095000000000000009500a50500000000"], 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030017000b63d25a80648c2594f93824fc60100c024002000009053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0x0, 0x0}, 0x10) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000740)=@generic={&(0x7f0000000700)='./file0\x00', 0x0, 0x18}, 0x18) 790.074101ms ago: executing program 1 (id=9705): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)=ANY=[], 0xfdef) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002a80)=""/4096, 0xfdef}], 0x1}, 0x10021) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) 396.443586ms ago: executing program 3 (id=9698): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x2}, 0x0, 0xc48}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000800)={0x5, 0x80, 0x0, 0x1, 0x0, 0x0, 0x0, 0x5, 0x184104, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x4, 0x4}, 0x100600, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfdd9}, 0x0, 0x0, 0xffffffffffffffff, 0x9) perf_event_open(&(0x7f0000000000)={0x2, 0x80, 0x6, 0x20, 0x2, 0x40, 0x0, 0x7fffffffffffffff, 0x8, 0x6, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6, 0x0, @perf_config_ext={0x2ee8, 0x4}, 0x108208, 0x4, 0x4, 0x4, 0x7, 0x1, 0x6, 0x0, 0x5, 0x0, 0x7fffffffffffffff}, 0x0, 0x4, r0, 0x9) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000001c0)="5c00000011006bec9e3be35c6e17aa31076b876c1d0000007ea20864160af3653c001ac00400020208000200030001001400000007b556a737c160f9555b4755bb05251e618200000051f60a84c9f4d4938037e786a6", 0x56}, {&(0x7f0000000140)="7e3f15d6d2ee", 0x6}], 0x2, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) close(r2) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x8982, 0x20000000) r3 = perf_event_open(&(0x7f00000010c0)={0x2, 0x80, 0xb9, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xc, 0x7}, 0x410, 0x2000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000b40)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x8b04, &(0x7f0000000040)={'wlan1\x00', @random="01f8ffffff8d"}) ioctl$PERF_EVENT_IOC_DISABLE(0xffffffffffffffff, 0x2401, 0x9) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e00000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) perf_event_open(&(0x7f0000000100)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x21, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xbd3, 0x0, 0x0, 0x0, 0x6}, [@btf_id={0x18, 0x9, 0x3, 0x0, 0x4}, @alu={0x7, 0x1, 0xc, 0x9, 0x6, 0x20}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @cb_func={0x18, 0xa, 0x4, 0x0, 0x2}, @alu={0x4, 0x1, 0x4, 0x0, 0xc, 0xffffffffffffffe0, 0x4}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffa}, @jmp={0x5, 0x0, 0xa, 0xa, 0x0, 0x2, 0x1}, @map_val={0x18, 0x5, 0x2, 0x0, r5, 0x0, 0x0, 0x0, 0x3ff}, @initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xdb}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}}]}, &(0x7f0000000400)='syzkaller\x00', 0x3, 0xf7, &(0x7f0000000500)=""/247, 0x41100, 0x10, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000600)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000640)={0x1, 0x6, 0x9, 0x1c4}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000680)=[{0x2, 0x3, 0x10, 0xb}, {0x5, 0x1, 0x2, 0x9}, {0x1, 0x1, 0xf, 0x5}, {0x5, 0x4, 0x6, 0xd}], 0x10, 0x9}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61123000000000006113100000000000bf2000000000000016000200071b48013d030100000000009500000000000000bc26000000000000bf67000000000000070200000fff07276702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, r6}, 0x94) 70.26384ms ago: executing program 2 (id=9699): perf_event_open(&(0x7f0000000380)={0x1, 0x80, 0x0, 0x16, 0x2, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0xca, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x20000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x400, 0x0) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x482, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000001000)='ns/pid_for_children\x00') syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/cgroup\x00') sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0xb, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x40}, 0x140) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) syz_open_procfs$namespace(0x0, &(0x7f0000000380)='ns/uts\x00') recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x18, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="85feff0fc9"], 0x0, 0x80, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b701000000000000850000007500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$kcm(0xa, 0x922000000003, 0x11) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000200)=ANY=[@ANYRES8=r1, @ANYRES8=r5], 0x12) 0s ago: executing program 0 (id=9700): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffefffffffffffff, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000500)={0x2, 0x80, 0x28, 0x1, 0x0, 0x0, 0x0, 0x9, 0x640b9, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x107b7e, 0x2, @perf_config_ext={0x0, 0x3fff8000}, 0x0, 0x32, 0x43a1bd76, 0x7, 0x9, 0x6, 0x2, 0x0, 0x0, 0x0, 0x2009}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6}]}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) perf_event_open$cgroup(&(0x7f00000001c0)={0x4, 0x80, 0x0, 0x81, 0x6, 0xa, 0x0, 0x8, 0x8000, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x9, 0x2, @perf_bp={&(0x7f0000000140), 0x8}, 0x0, 0x1, 0x7fffffff, 0x9, 0x3, 0x7fff, 0x7, 0x0, 0x8, 0x0, 0x100000001}, r0, 0x10, r1, 0x2) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3efd7ab4c41335d9, @perf_bp={0x0, 0xf}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r4 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r4, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f00000008c0), 0x43) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002a80)=""/4096, 0xfdef}], 0x1}, 0x10021) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000440)=""/183}, 0x20) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'ip6gre0\x00', 0x210}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x89f1, &(0x7f0000000080)) kernel console output (not intermixed with test programs): watching+0x15/0xb0 [ 1500.797977][T24368] ? kstrndup+0xbd/0x140 [ 1500.802232][T24368] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1500.807351][T24368] ? __nla_validate+0x50/0x50 [ 1500.812036][T24368] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1500.818373][T24368] ? __nla_parse+0x40/0x50 [ 1500.822801][T24368] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1500.829140][T24368] genl_family_rcv_msg_doit+0x211/0x310 [ 1500.834689][T24368] ? end_current_label_crit_section+0x170/0x170 [ 1500.840937][T24368] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1500.846831][T24368] ? bpf_lsm_capable+0x9/0x10 [ 1500.851509][T24368] ? security_capable+0x89/0xb0 [ 1500.856367][T24368] genl_rcv_msg+0x619/0x7a0 [ 1500.860879][T24368] ? genl_bind+0x360/0x360 [ 1500.865313][T24368] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1500.871656][T24368] ? lockdep_hardirqs_on+0x98/0x150 [ 1500.876950][T24368] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1500.883219][T24368] netlink_rcv_skb+0x241/0x4d0 [ 1500.888001][T24368] ? genl_bind+0x360/0x360 [ 1500.892422][T24368] ? netlink_ack+0x1180/0x1180 [ 1500.897217][T24368] ? __lock_acquire+0x7d40/0x7d40 [ 1500.902242][T24368] ? down_read+0x1ac/0x2e0 [ 1500.906656][T24368] genl_rcv+0x28/0x40 [ 1500.910633][T24368] netlink_unicast+0x751/0x8d0 [ 1500.915405][T24368] netlink_sendmsg+0x8d0/0xbf0 [ 1500.920213][T24368] ? netlink_getsockopt+0x590/0x590 [ 1500.925423][T24368] ? aa_sock_msg_perm+0x94/0x150 [ 1500.930370][T24368] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1500.935657][T24368] ? security_socket_sendmsg+0x80/0xa0 [ 1500.941111][T24368] ? netlink_getsockopt+0x590/0x590 [ 1500.946404][T24368] ____sys_sendmsg+0x5ba/0x960 [ 1500.951174][T24368] ? __asan_memset+0x22/0x40 [ 1500.955775][T24368] ? __sys_sendmsg_sock+0x30/0x30 [ 1500.960802][T24368] ? __import_iovec+0x5f2/0x850 [ 1500.965658][T24368] ? import_iovec+0x73/0xa0 [ 1500.970245][T24368] ___sys_sendmsg+0x2a6/0x360 [ 1500.974922][T24368] ? __sys_sendmsg+0x2a0/0x2a0 [ 1500.979716][T24368] __se_sys_sendmsg+0x1c2/0x2b0 [ 1500.984576][T24368] ? __x64_sys_sendmsg+0x80/0x80 [ 1500.989529][T24368] do_syscall_64+0x55/0xa0 [ 1500.993939][T24368] ? clear_bhb_loop+0x40/0x90 [ 1500.998613][T24368] ? clear_bhb_loop+0x40/0x90 [ 1501.003284][T24368] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1501.009179][T24368] RIP: 0033:0x7fcbc759cdd9 [ 1501.013592][T24368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1501.033372][T24368] RSP: 002b:00007fcbc8391028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1501.041791][T24368] RAX: ffffffffffffffda RBX: 00007fcbc7815fa0 RCX: 00007fcbc759cdd9 [ 1501.049764][T24368] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1501.057819][T24368] RBP: 00007fcbc7632d69 R08: 0000000000000000 R09: 0000000000000000 [ 1501.065785][T24368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1501.073748][T24368] R13: 00007fcbc7816038 R14: 00007fcbc7815fa0 R15: 00007ffc3c2ff8c8 [ 1501.081731][T24368] [ 1502.197457][T24411] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.7188'. [ 1502.671766][T24420] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.7191'. [ 1504.745411][T24421] syzkaller0: entered promiscuous mode [ 1504.751600][T24421] syzkaller0: entered allmulticast mode [ 1507.622782][T24420] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 1507.632385][T24420] CPU: 1 PID: 24420 Comm: syz.1.7191 Not tainted syzkaller #0 [ 1507.640143][T24420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1507.650351][T24420] Call Trace: [ 1507.653835][T24420] [ 1507.656805][T24420] dump_stack_lvl+0x18c/0x250 [ 1507.661655][T24420] ? show_regs_print_info+0x20/0x20 [ 1507.667053][T24420] ? load_image+0x420/0x420 [ 1507.671613][T24420] sysfs_warn_dup+0x8e/0xa0 [ 1507.676155][T24420] sysfs_do_create_link_sd+0xc0/0x110 [ 1507.681562][T24420] device_add_class_symlinks+0x1cf/0x240 [ 1507.687229][T24420] device_add+0x507/0xc20 [ 1507.691586][T24420] wiphy_register+0x1dad/0x2ae0 [ 1507.696636][T24420] ? cfg80211_event_work+0x40/0x40 [ 1507.701775][T24420] ? minstrel_ht_alloc+0x88a/0x990 [ 1507.706920][T24420] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1507.713006][T24420] ieee80211_register_hw+0x3464/0x4250 [ 1507.718515][T24420] ? ieee80211_tasklet_handler+0x20/0x20 [ 1507.724165][T24420] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1507.730082][T24420] ? __debug_object_init+0xec/0x450 [ 1507.735400][T24420] ? __asan_memset+0x22/0x40 [ 1507.740032][T24420] ? __hrtimer_init+0x186/0x270 [ 1507.745066][T24420] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1507.750906][T24420] ? mac80211_hwsim_free+0x220/0x220 [ 1507.756277][T24420] ? rcu_is_watching+0x15/0xb0 [ 1507.761047][T24420] ? kstrndup+0xbd/0x140 [ 1507.765299][T24420] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1507.770591][T24420] ? __nla_validate+0x50/0x50 [ 1507.775276][T24420] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1507.781776][T24420] ? genl_family_rcv_msg_attrs_parse+0xa3/0x290 [ 1507.788033][T24420] ? __nla_parse+0x40/0x50 [ 1507.792449][T24420] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1507.798842][T24420] genl_family_rcv_msg_doit+0x211/0x310 [ 1507.804558][T24420] ? end_current_label_crit_section+0x170/0x170 [ 1507.810809][T24420] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1507.816716][T24420] ? bpf_lsm_capable+0x9/0x10 [ 1507.821588][T24420] ? security_capable+0x89/0xb0 [ 1507.826727][T24420] genl_rcv_msg+0x619/0x7a0 [ 1507.831253][T24420] ? genl_bind+0x360/0x360 [ 1507.835767][T24420] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1507.842116][T24420] netlink_rcv_skb+0x241/0x4d0 [ 1507.846886][T24420] ? genl_bind+0x360/0x360 [ 1507.851310][T24420] ? netlink_ack+0x1180/0x1180 [ 1507.856184][T24420] ? __lock_acquire+0x7d40/0x7d40 [ 1507.861396][T24420] ? down_read+0x1ac/0x2e0 [ 1507.865816][T24420] genl_rcv+0x28/0x40 [ 1507.869807][T24420] netlink_unicast+0x751/0x8d0 [ 1507.875493][T24420] netlink_sendmsg+0x8d0/0xbf0 [ 1507.880373][T24420] ? netlink_getsockopt+0x590/0x590 [ 1507.885869][T24420] ? aa_sock_msg_perm+0x94/0x150 [ 1507.890916][T24420] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1507.896400][T24420] ? security_socket_sendmsg+0x80/0xa0 [ 1507.901975][T24420] ? netlink_getsockopt+0x590/0x590 [ 1507.907207][T24420] ____sys_sendmsg+0x5ba/0x960 [ 1507.912174][T24420] ? __asan_memset+0x22/0x40 [ 1507.916956][T24420] ? __sys_sendmsg_sock+0x30/0x30 [ 1507.922079][T24420] ? __import_iovec+0x5f2/0x850 [ 1507.927552][T24420] ? import_iovec+0x73/0xa0 [ 1507.932152][T24420] ___sys_sendmsg+0x2a6/0x360 [ 1507.936923][T24420] ? __sys_sendmsg+0x2a0/0x2a0 [ 1507.941696][T24420] ? perf_trace_preemptirq_template+0xac/0x330 [ 1507.947897][T24420] __se_sys_sendmsg+0x1c2/0x2b0 [ 1507.952783][T24420] ? __x64_sys_sendmsg+0x80/0x80 [ 1507.957849][T24420] ? lockdep_hardirqs_on+0x98/0x150 [ 1507.963236][T24420] do_syscall_64+0x55/0xa0 [ 1507.967699][T24420] ? clear_bhb_loop+0x40/0x90 [ 1507.972373][T24420] ? clear_bhb_loop+0x40/0x90 [ 1507.977138][T24420] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1507.983045][T24420] RIP: 0033:0x7fda0279cdd9 [ 1507.987463][T24420] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1508.007247][T24420] RSP: 002b:00007fda035f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1508.015765][T24420] RAX: ffffffffffffffda RBX: 00007fda02a15fa0 RCX: 00007fda0279cdd9 [ 1508.024262][T24420] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1508.032232][T24420] RBP: 00007fda02832d69 R08: 0000000000000000 R09: 0000000000000000 [ 1508.040219][T24420] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1508.048362][T24420] R13: 00007fda02a16038 R14: 00007fda02a15fa0 R15: 00007ffd5f546a48 [ 1508.056563][T24420] [ 1508.895026][T24463] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.7208'. [ 1511.734580][T24469] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.7209'. [ 1511.745432][T24474] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.7212'. [ 1511.775320][T24474] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 1511.789538][T24474] CPU: 0 PID: 24474 Comm: syz.1.7212 Not tainted syzkaller #0 [ 1511.797047][T24474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1511.807326][T24474] Call Trace: [ 1511.810620][T24474] [ 1511.813605][T24474] dump_stack_lvl+0x18c/0x250 [ 1511.818813][T24474] ? show_regs_print_info+0x20/0x20 [ 1511.824009][T24474] ? load_image+0x420/0x420 [ 1511.828738][T24474] sysfs_warn_dup+0x8e/0xa0 [ 1511.833270][T24474] sysfs_do_create_link_sd+0xc0/0x110 [ 1511.838659][T24474] device_add_class_symlinks+0x1cf/0x240 [ 1511.844309][T24474] device_add+0x507/0xc20 [ 1511.848663][T24474] wiphy_register+0x1dad/0x2ae0 [ 1511.853533][T24474] ? cfg80211_event_work+0x40/0x40 [ 1511.858648][T24474] ? minstrel_ht_alloc+0x88a/0x990 [ 1511.863796][T24474] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1511.869870][T24474] ieee80211_register_hw+0x3464/0x4250 [ 1511.875335][T24474] ? ieee80211_tasklet_handler+0x20/0x20 [ 1511.880974][T24474] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1511.886976][T24474] ? __debug_object_init+0xec/0x450 [ 1511.892186][T24474] ? __asan_memset+0x22/0x40 [ 1511.896827][T24474] ? __hrtimer_init+0x186/0x270 [ 1511.901710][T24474] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1511.907554][T24474] ? mac80211_hwsim_free+0x220/0x220 [ 1511.912879][T24474] ? rcu_is_watching+0x15/0xb0 [ 1511.917659][T24474] ? kstrndup+0xbd/0x140 [ 1511.921929][T24474] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1511.927154][T24474] ? __nla_validate+0x50/0x50 [ 1511.931850][T24474] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1511.938309][T24474] ? __nla_parse+0x40/0x50 [ 1511.942855][T24474] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1511.949381][T24474] genl_family_rcv_msg_doit+0x211/0x310 [ 1511.954963][T24474] ? end_current_label_crit_section+0x170/0x170 [ 1511.961340][T24474] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1511.967450][T24474] ? bpf_lsm_capable+0x9/0x10 [ 1511.972143][T24474] ? security_capable+0x89/0xb0 [ 1511.977090][T24474] genl_rcv_msg+0x619/0x7a0 [ 1511.981729][T24474] ? genl_bind+0x360/0x360 [ 1511.986449][T24474] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1511.992802][T24474] netlink_rcv_skb+0x241/0x4d0 [ 1511.997577][T24474] ? genl_bind+0x360/0x360 [ 1512.001996][T24474] ? netlink_ack+0x1180/0x1180 [ 1512.006774][T24474] ? __lock_acquire+0x7d40/0x7d40 [ 1512.011817][T24474] ? down_read+0x1ac/0x2e0 [ 1512.016936][T24474] genl_rcv+0x28/0x40 [ 1512.021058][T24474] netlink_unicast+0x751/0x8d0 [ 1512.025920][T24474] netlink_sendmsg+0x8d0/0xbf0 [ 1512.030961][T24474] ? netlink_getsockopt+0x590/0x590 [ 1512.036439][T24474] ? aa_sock_msg_perm+0x94/0x150 [ 1512.041661][T24474] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1512.046955][T24474] ? security_socket_sendmsg+0x80/0xa0 [ 1512.052514][T24474] ? netlink_getsockopt+0x590/0x590 [ 1512.057894][T24474] ____sys_sendmsg+0x5ba/0x960 [ 1512.062671][T24474] ? __asan_memset+0x22/0x40 [ 1512.067349][T24474] ? __sys_sendmsg_sock+0x30/0x30 [ 1512.072373][T24474] ? __import_iovec+0x5f2/0x850 [ 1512.077319][T24474] ? import_iovec+0x73/0xa0 [ 1512.081821][T24474] ___sys_sendmsg+0x2a6/0x360 [ 1512.086501][T24474] ? __sys_sendmsg+0x2a0/0x2a0 [ 1512.091310][T24474] __se_sys_sendmsg+0x1c2/0x2b0 [ 1512.096162][T24474] ? __x64_sys_sendmsg+0x80/0x80 [ 1512.101115][T24474] ? lockdep_hardirqs_on+0x98/0x150 [ 1512.106325][T24474] do_syscall_64+0x55/0xa0 [ 1512.110740][T24474] ? clear_bhb_loop+0x40/0x90 [ 1512.115417][T24474] ? clear_bhb_loop+0x40/0x90 [ 1512.120092][T24474] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1512.125981][T24474] RIP: 0033:0x7fda0279cdd9 [ 1512.130525][T24474] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1512.150412][T24474] RSP: 002b:00007fda035f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1512.158999][T24474] RAX: ffffffffffffffda RBX: 00007fda02a15fa0 RCX: 00007fda0279cdd9 [ 1512.166972][T24474] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 000000000000000a [ 1512.175114][T24474] RBP: 00007fda02832d69 R08: 0000000000000000 R09: 0000000000000000 [ 1512.183083][T24474] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1512.191049][T24474] R13: 00007fda02a16038 R14: 00007fda02a15fa0 R15: 00007ffd5f546a48 [ 1512.199035][T24474] [ 1512.336750][T24479] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.7221'. [ 1513.127987][T24503] syzkaller0: entered promiscuous mode [ 1513.133703][T24503] syzkaller0: entered allmulticast mode [ 1514.522780][T24527] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.7231'. [ 1518.400270][T24516] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1519.292671][T24568] netlink: 'syz.0.7244': attribute type 8 has an invalid length. [ 1519.304746][T24568] netlink: 199848 bytes leftover after parsing attributes in process `syz.0.7244'. [ 1519.419108][T24572] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.7245'. [ 1520.144465][T24578] syzkaller0: entered promiscuous mode [ 1520.158272][T24578] syzkaller0: entered allmulticast mode [ 1522.735327][T24604] netlink: 'syz.3.7256': attribute type 8 has an invalid length. [ 1522.749589][T24604] netlink: 199848 bytes leftover after parsing attributes in process `syz.3.7256'. [ 1524.744330][T24643] netlink: 'syz.1.7270': attribute type 8 has an invalid length. [ 1524.797801][T24643] netlink: 199848 bytes leftover after parsing attributes in process `syz.1.7270'. [ 1525.001697][T24649] netlink: 'syz.3.7272': attribute type 4 has an invalid length. [ 1525.026783][T24649] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7272'. [ 1526.994419][T24690] netlink: 'syz.2.7290': attribute type 8 has an invalid length. [ 1527.004633][T24690] netlink: 199848 bytes leftover after parsing attributes in process `syz.2.7290'. [ 1527.197392][T24694] netlink: 9275 bytes leftover after parsing attributes in process `syz.3.7293'. [ 1527.399409][T24700] syzkaller0: entered promiscuous mode [ 1527.405073][T24700] syzkaller0: entered allmulticast mode [ 1527.951999][T24713] netlink: 'syz.2.7300': attribute type 4 has an invalid length. [ 1527.971575][T24713] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7300'. [ 1530.998716][T24749] netlink: 9275 bytes leftover after parsing attributes in process `syz.2.7315'. [ 1531.167596][T24756] netlink: 'syz.2.7319': attribute type 1 has an invalid length. [ 1531.180455][T24756] netlink: 'syz.2.7319': attribute type 2 has an invalid length. [ 1531.216480][T24756] netlink: 11254 bytes leftover after parsing attributes in process `syz.2.7319'. [ 1532.837104][T24788] netlink: 9275 bytes leftover after parsing attributes in process `syz.1.7329'. [ 1533.144290][T24798] netlink: 121460 bytes leftover after parsing attributes in process `syz.1.7332'. [ 1533.226135][T24798] netlink: 21068 bytes leftover after parsing attributes in process `syz.1.7332'. [ 1533.251874][T24798] tipc: Started in network mode [ 1533.271075][T24798] tipc: Node identity b, cluster identity 73 [ 1533.285845][T24798] tipc: Node number set to 11 [ 1533.332766][T24801] netlink: 'syz.0.7335': attribute type 4 has an invalid length. [ 1533.363937][T24801] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7335'. [ 1533.804321][T24819] netlink: 9275 bytes leftover after parsing attributes in process `syz.0.7341'. [ 1534.135973][T24827] netlink: 'syz.0.7343': attribute type 39 has an invalid length. [ 1534.707032][T24838] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1534.886714][T24843] netlink: 'syz.1.7349': attribute type 4 has an invalid length. [ 1534.894824][T24843] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7349'. [ 1535.703339][T24863] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1535.958100][T24873] netlink: 9275 bytes leftover after parsing attributes in process `syz.2.7360'. [ 1536.142175][T24877] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7362'. [ 1537.364349][T24910] netlink: 9275 bytes leftover after parsing attributes in process `syz.3.7374'. [ 1537.427704][T24906] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1537.611629][T24919] netlink: 'syz.3.7378': attribute type 1 has an invalid length. [ 1537.619786][T24919] netlink: 'syz.3.7378': attribute type 2 has an invalid length. [ 1537.628137][T24919] netlink: 11254 bytes leftover after parsing attributes in process `syz.3.7378'. [ 1538.545982][T24960] netlink: 'syz.1.7394': attribute type 1 has an invalid length. [ 1538.564158][T24960] netlink: 'syz.1.7394': attribute type 2 has an invalid length. [ 1538.572735][T24960] netlink: 11254 bytes leftover after parsing attributes in process `syz.1.7394'. [ 1538.872025][T24967] netlink: 121460 bytes leftover after parsing attributes in process `syz.3.7398'. [ 1538.908379][T24967] netlink: 21068 bytes leftover after parsing attributes in process `syz.3.7398'. [ 1538.918342][T24967] tipc: Started in network mode [ 1538.923310][T24967] tipc: Node identity b, cluster identity 73 [ 1538.930518][T24967] tipc: Node number set to 11 [ 1539.420243][T24989] netlink: 'syz.1.7406': attribute type 39 has an invalid length. [ 1540.095195][T25007] netlink: 121460 bytes leftover after parsing attributes in process `syz.2.7413'. [ 1540.120008][T25007] netlink: 21068 bytes leftover after parsing attributes in process `syz.2.7413'. [ 1540.150955][T25007] tipc: Started in network mode [ 1540.175840][T25007] tipc: Node identity b, cluster identity 73 [ 1540.202519][T25007] tipc: Node number set to 11 [ 1540.701344][T25027] netlink: 'syz.3.7423': attribute type 39 has an invalid length. [ 1541.707671][T15734] Bluetooth: hci3: unexpected subevent 0x0c length: 150 > 5 [ 1542.546906][T25065] netlink: 'syz.2.7438': attribute type 39 has an invalid length. [ 1543.348362][T15734] Bluetooth: hci0: unexpected subevent 0x0c length: 150 > 5 [ 1543.453871][T25075] netlink: 'syz.3.7442': attribute type 2 has an invalid length. [ 1543.477451][T25075] netlink: 'syz.3.7442': attribute type 8 has an invalid length. [ 1543.496651][T25075] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7442'. [ 1543.935356][T25085] netlink: 'syz.3.7446': attribute type 4 has an invalid length. [ 1544.068333][T25085] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.7446'. [ 1544.760266][T25094] syzkaller0: entered promiscuous mode [ 1544.772000][T25094] syzkaller0: entered allmulticast mode [ 1546.321017][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.327800][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1547.747879][T25116] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7456'. [ 1549.066263][T25156] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7470'. [ 1550.671767][T25191] netlink: 'syz.1.7479': attribute type 2 has an invalid length. [ 1550.698040][T25191] netlink: 'syz.1.7479': attribute type 8 has an invalid length. [ 1550.711742][T25191] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7479'. [ 1551.877714][T25204] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7484'. [ 1553.601584][T25233] netlink: 'syz.3.7496': attribute type 10 has an invalid length. [ 1553.628596][T25233] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7496'. [ 1555.477138][T25259] netlink: 'syz.2.7507': attribute type 4 has an invalid length. [ 1555.485350][T25259] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7507'. [ 1556.607382][T25278] netlink: 'syz.0.7514': attribute type 2 has an invalid length. [ 1556.621862][T25278] netlink: 'syz.0.7514': attribute type 8 has an invalid length. [ 1556.631199][T25278] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7514'. [ 1557.064151][T25288] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1557.091770][T25288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1557.115829][T25288] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1557.142692][T25288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1557.174179][T25288] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1557.206196][T25288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1557.387590][T25302] netlink: 'syz.0.7525': attribute type 10 has an invalid length. [ 1557.524075][T25302] netlink: 'syz.0.7525': attribute type 3 has an invalid length. [ 1557.537692][T25306] netlink: 'syz.2.7526': attribute type 2 has an invalid length. [ 1557.554307][T25302] netlink: 'syz.0.7525': attribute type 1 has an invalid length. [ 1557.563136][T25306] netlink: 'syz.2.7526': attribute type 8 has an invalid length. [ 1557.573846][T25302] netlink: 193404 bytes leftover after parsing attributes in process `syz.0.7525'. [ 1557.576311][T25306] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7526'. [ 1557.886470][T25315] netlink: 'syz.2.7527': attribute type 10 has an invalid length. [ 1557.934171][T25315] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7527'. [ 1559.353246][T25344] netlink: 'syz.0.7538': attribute type 2 has an invalid length. [ 1559.402962][T25344] netlink: 'syz.0.7538': attribute type 8 has an invalid length. [ 1559.436383][T25344] netlink: 132 bytes leftover after parsing attributes in process `syz.0.7538'. [ 1560.395844][T25070] page_pool_release_retry() stalled pool shutdown 1 inflight 60 sec [ 1560.431846][T25359] mac80211_hwsim hwsim34 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1560.614765][T25367] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7545'. [ 1561.009453][T25378] netlink: 2 bytes leftover after parsing attributes in process `syz.1.7547'. [ 1561.824759][T25389] validate_nla: 3 callbacks suppressed [ 1561.824782][T25389] netlink: 'syz.1.7553': attribute type 3 has an invalid length. [ 1562.000500][T25389] netlink: 'syz.1.7553': attribute type 1 has an invalid length. [ 1562.105906][T25389] netlink: 193404 bytes leftover after parsing attributes in process `syz.1.7553'. [ 1563.388558][T25415] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.7562'. [ 1563.624569][T25422] netlink: 'syz.3.7564': attribute type 2 has an invalid length. [ 1563.655823][T25422] netlink: 'syz.3.7564': attribute type 8 has an invalid length. [ 1563.673901][T25422] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7564'. [ 1563.707791][T25420] netlink: 'syz.0.7563': attribute type 10 has an invalid length. [ 1563.735971][T25420] netlink: 2 bytes leftover after parsing attributes in process `syz.0.7563'. [ 1563.755088][T25426] mac80211_hwsim hwsim93 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1564.222166][T25441] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.7574'. [ 1564.482363][T25446] netlink: 4595 bytes leftover after parsing attributes in process `syz.0.7576'. [ 1565.149682][T25453] netlink: 'syz.3.7578': attribute type 2 has an invalid length. [ 1565.191911][T25453] netlink: 'syz.3.7578': attribute type 8 has an invalid length. [ 1565.205027][T25453] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7578'. [ 1565.577583][T25465] netlink: 'syz.0.7580': attribute type 10 has an invalid length. [ 1565.596083][T25465] netlink: 2 bytes leftover after parsing attributes in process `syz.0.7580'. [ 1566.127800][T25479] netlink: 'syz.2.7587': attribute type 9 has an invalid length. [ 1566.138011][T25479] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.7587'. [ 1566.392704][T25482] netlink: 'syz.0.7588': attribute type 21 has an invalid length. [ 1566.438146][T25482] netlink: 168 bytes leftover after parsing attributes in process `syz.0.7588'. [ 1566.595974][T25485] batadv0: entered promiscuous mode [ 1566.601338][T25485] batadv0: entered allmulticast mode [ 1566.623138][T25485] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1566.834203][T25493] validate_nla: 1 callbacks suppressed [ 1566.834241][T25493] netlink: 'syz.2.7593': attribute type 10 has an invalid length. [ 1566.921934][T25496] netlink: 'syz.2.7593': attribute type 9 has an invalid length. [ 1566.954578][T25495] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1567.094998][T25498] netlink: 'syz.2.7593': attribute type 9 has an invalid length. [ 1568.270097][T25515] netlink: 'syz.3.7600': attribute type 21 has an invalid length. [ 1568.298304][T25515] __nla_validate_parse: 3 callbacks suppressed [ 1568.298337][T25515] netlink: 168 bytes leftover after parsing attributes in process `syz.3.7600'. [ 1568.343249][T25515] netlink: 'syz.3.7600': attribute type 10 has an invalid length. [ 1568.360248][T25515] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7600'. [ 1568.385969][T25515] batadv0: entered promiscuous mode [ 1568.392024][T25515] batadv0: entered allmulticast mode [ 1568.441317][T25515] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1568.540285][T25526] IPv6: …: Disabled Multicast RS [ 1568.779612][T25532] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.7605'. [ 1569.284066][T25546] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.7620'. [ 1570.312719][T25563] netlink: 'syz.1.7615': attribute type 21 has an invalid length. [ 1570.348173][T25563] netlink: 168 bytes leftover after parsing attributes in process `syz.1.7615'. [ 1570.374977][T25563] netlink: 'syz.1.7615': attribute type 10 has an invalid length. [ 1570.385035][T25563] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7615'. [ 1570.396897][T25563] batadv0: entered promiscuous mode [ 1570.403124][T25563] batadv0: entered allmulticast mode [ 1570.427125][T25563] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1570.596137][T25572] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7621'. [ 1570.694563][T25569] netlink: 'syz.3.7618': attribute type 9 has an invalid length. [ 1570.745474][T25569] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7618'. [ 1571.315628][T25581] netlink: 180 bytes leftover after parsing attributes in process `syz.0.7624'. [ 1571.423907][T25585] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.7625'. [ 1572.008116][T25595] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1573.599402][T25615] IPv6: …: Disabled Multicast RS [ 1573.913697][T25621] netlink: 'syz.0.7636': attribute type 9 has an invalid length. [ 1573.935626][T25621] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7636'. [ 1575.236359][T25647] netlink: 'syz.2.7642': attribute type 21 has an invalid length. [ 1575.290612][T25647] netlink: 168 bytes leftover after parsing attributes in process `syz.2.7642'. [ 1575.472905][T25648] netlink: 'syz.2.7642': attribute type 10 has an invalid length. [ 1575.510655][T25648] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7642'. [ 1575.605842][T25648] batadv0: entered promiscuous mode [ 1575.634615][T25648] batadv0: entered allmulticast mode [ 1575.693854][T25648] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1576.375202][T25670] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7646'. [ 1576.466903][T25671] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1578.023309][T25692] netlink: 'syz.1.7659': attribute type 10 has an invalid length. [ 1578.053717][T25693] netlink: 'syz.1.7659': attribute type 9 has an invalid length. [ 1578.084863][T25693] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.7659'. [ 1578.733896][T25694] netlink: 'syz.1.7659': attribute type 9 has an invalid length. [ 1578.778636][T25694] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.7659'. [ 1578.857577][T25701] netlink: 'syz.3.7662': attribute type 9 has an invalid length. [ 1578.872202][T25701] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7662'. [ 1580.026072][T25722] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1580.063543][T25724] netlink: 'syz.3.7670': attribute type 17 has an invalid length. [ 1580.085844][T25724] netlink: 152 bytes leftover after parsing attributes in process `syz.3.7670'. [ 1580.133282][T25724] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1581.764313][T25743] netlink: 9286 bytes leftover after parsing attributes in process `syz.3.7677'. [ 1582.009792][T25746] netlink: 'syz.2.7678': attribute type 10 has an invalid length. [ 1583.120473][T25763] netlink: 'syz.2.7684': attribute type 17 has an invalid length. [ 1583.129085][T25763] netlink: 152 bytes leftover after parsing attributes in process `syz.2.7684'. [ 1583.157528][T25763] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1583.231013][T25767] netlink: 63503 bytes leftover after parsing attributes in process `syz.1.7686'. [ 1584.448255][T25792] netlink: 'syz.3.7694': attribute type 10 has an invalid length. [ 1584.527432][T25795] netlink: 'syz.3.7694': attribute type 9 has an invalid length. [ 1584.540935][T25795] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7694'. [ 1585.176024][T25798] netlink: 'syz.3.7694': attribute type 9 has an invalid length. [ 1585.184489][T25798] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7694'. [ 1585.662137][T25816] netlink: 63503 bytes leftover after parsing attributes in process `syz.3.7701'. [ 1585.847230][T25827] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7703'. [ 1586.023343][T25833] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1586.470251][T25838] netlink: 9286 bytes leftover after parsing attributes in process `syz.2.7709'. [ 1586.923700][T25843] netlink: 'syz.3.7711': attribute type 10 has an invalid length. [ 1588.111553][T25874] netlink: 'syz.2.7720': attribute type 29 has an invalid length. [ 1588.148379][T25874] netlink: 'syz.2.7720': attribute type 29 has an invalid length. [ 1588.229643][T25878] netlink: 'syz.2.7720': attribute type 29 has an invalid length. [ 1588.290967][T25874] netlink: 'syz.2.7720': attribute type 29 has an invalid length. [ 1588.355891][T25878] netlink: 'syz.2.7720': attribute type 29 has an invalid length. [ 1588.387449][T25874] netlink: 'syz.2.7720': attribute type 29 has an invalid length. [ 1588.501390][T25880] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1590.023093][T25898] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1590.045886][T25898] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.063897][T25898] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1590.081332][T25898] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.092541][T25898] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1590.107506][T25898] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1590.906440][T25922] netlink: 'syz.0.7737': attribute type 10 has an invalid length. [ 1590.938665][T25923] netlink: 9286 bytes leftover after parsing attributes in process `syz.1.7738'. [ 1590.992919][T25924] netlink: 'syz.0.7737': attribute type 9 has an invalid length. [ 1591.034716][T25924] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7737'. [ 1591.442224][T25925] netlink: 'syz.0.7737': attribute type 9 has an invalid length. [ 1591.465977][T25925] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7737'. [ 1591.560197][T25933] netlink: 'syz.1.7740': attribute type 10 has an invalid length. [ 1592.167309][T25945] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1593.647678][T25968] syz.3.7751[25968] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1593.648133][T25968] syz.3.7751[25968] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1594.069905][T25979] netlink: 63503 bytes leftover after parsing attributes in process `syz.2.7757'. [ 1595.108700][T25995] netlink: 'syz.3.7762': attribute type 10 has an invalid length. [ 1595.169874][T25995] netlink: 'syz.3.7762': attribute type 9 has an invalid length. [ 1595.189903][T25995] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7762'. [ 1595.522847][T25998] netlink: 'syz.3.7762': attribute type 9 has an invalid length. [ 1595.560778][T25998] netlink: 209836 bytes leftover after parsing attributes in process `syz.3.7762'. [ 1595.647705][T26008] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.7767'. [ 1595.660754][T26008] bridge_slave_1: default FDB implementation only supports local addresses [ 1596.072450][T26018] syzkaller0: entered promiscuous mode [ 1596.078526][T26018] syzkaller0: entered allmulticast mode [ 1597.498861][T26052] syz.2.7777[26052] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1597.499367][T26052] syz.2.7777[26052] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1597.878441][T26058] netlink: 'syz.0.7779': attribute type 10 has an invalid length. [ 1597.928010][T26059] netlink: 'syz.0.7779': attribute type 9 has an invalid length. [ 1597.936915][T26059] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7779'. [ 1598.025866][T26058] netlink: 'syz.0.7779': attribute type 9 has an invalid length. [ 1598.062608][T26058] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7779'. [ 1599.250011][T26077] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1599.285515][T26077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1599.311921][T26077] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1599.322941][T26077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1599.333854][T26077] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1599.344355][T26077] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1599.609861][T26088] syz.1.7794[26088] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1599.610432][T26088] syz.1.7794[26088] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1599.929941][T26097] netlink: 208064 bytes leftover after parsing attributes in process `syz.1.7800'. [ 1600.844968][T26118] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1600.884819][T26118] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1600.914223][T26118] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1600.958267][T26118] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1601.006233][T26118] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1601.043266][T26118] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1602.429503][T26145] netlink: 'syz.0.7816': attribute type 9 has an invalid length. [ 1602.437622][T26145] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.7816'. [ 1603.572433][T26160] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1603.593253][T26160] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1603.605253][T26160] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1603.622606][T26160] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1603.634502][T26160] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1603.666445][T26160] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1603.689793][T26165] syzkaller0: entered promiscuous mode [ 1603.695384][T26165] syzkaller0: entered allmulticast mode [ 1603.899961][T26171] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.7823'. [ 1604.338640][T26178] netlink: 212424 bytes leftover after parsing attributes in process `syz.2.7827'. [ 1604.604104][T26189] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1604.619886][T26189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1604.642531][T26189] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1604.654617][T26189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1604.670804][T26189] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1604.682220][T26189] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1605.168127][T26197] netlink: 'syz.0.7835': attribute type 4 has an invalid length. [ 1605.196594][T26197] netlink: 152 bytes leftover after parsing attributes in process `syz.0.7835'. [ 1605.316874][T26200] syzkaller0: entered promiscuous mode [ 1605.323005][T26200] syzkaller0: entered allmulticast mode [ 1605.330707][T26202] netlink: 208064 bytes leftover after parsing attributes in process `syz.3.7837'. [ 1605.911609][T26217] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1605.966354][T26217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.085913][T26217] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1606.115854][T26217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.132808][T26217] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1606.151582][T26217] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1606.561319][T26232] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.7848'. [ 1606.580839][T26232] bridge_slave_1: default FDB implementation only supports local addresses [ 1606.798430][T26238] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.7850'. [ 1607.301626][T26254] syzkaller0: entered promiscuous mode [ 1607.311511][T26254] syzkaller0: entered allmulticast mode [ 1607.790855][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.797548][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.801565][T26262] netlink: 'syz.2.7860': attribute type 9 has an invalid length. [ 1607.823607][T26262] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.7860'. [ 1609.069511][T26285] netlink: 208064 bytes leftover after parsing attributes in process `syz.0.7866'. [ 1609.607982][T26291] netlink: 'syz.1.7869': attribute type 10 has an invalid length. [ 1609.626239][T26291] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7869'. [ 1610.309053][T26301] netlink: 'syz.1.7872': attribute type 9 has an invalid length. [ 1610.334187][T26301] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.7872'. [ 1612.081253][T26329] netlink: 'syz.2.7882': attribute type 10 has an invalid length. [ 1612.125694][T26329] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7882'. [ 1612.553609][T26337] netlink: 212424 bytes leftover after parsing attributes in process `syz.3.7886'. [ 1612.621234][T26340] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1612.700861][T26340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1612.768726][T26340] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1612.845966][T26340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1612.915696][T26340] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1612.985692][T26340] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1613.578937][T26364] netlink: 'syz.2.7893': attribute type 4 has an invalid length. [ 1613.599519][T26364] netlink: 152 bytes leftover after parsing attributes in process `syz.2.7893'. [ 1613.730881][T26367] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1613.742973][T26367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1613.761476][T26367] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1613.801960][T26367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1613.814844][T26367] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1613.844491][T26367] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1613.879470][T26376] netlink: 'syz.1.7897': attribute type 33 has an invalid length. [ 1613.905231][T26378] netlink: 'syz.0.7899': attribute type 153 has an invalid length. [ 1613.923203][T26376] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7897'. [ 1613.927107][T26371] delete_channel: no stack [ 1613.935712][T26378] netlink: 128124 bytes leftover after parsing attributes in process `syz.0.7899'. [ 1615.488308][T26410] delete_channel: no stack [ 1615.714662][T26408] netlink: 'syz.3.7908': attribute type 10 has an invalid length. [ 1615.748234][T26420] netlink: 'syz.1.7911': attribute type 153 has an invalid length. [ 1615.750910][T26408] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7908'. [ 1615.760577][T26420] netlink: 128124 bytes leftover after parsing attributes in process `syz.1.7911'. [ 1616.289448][T26434] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.7917'. [ 1617.184430][T26460] netlink: 'syz.3.7923': attribute type 153 has an invalid length. [ 1617.204671][T26460] netlink: 128124 bytes leftover after parsing attributes in process `syz.3.7923'. [ 1617.224824][T26452] netlink: 'syz.1.7921': attribute type 10 has an invalid length. [ 1617.307264][T26453] netlink: 'syz.2.7922': attribute type 10 has an invalid length. [ 1617.315398][T26453] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7922'. [ 1617.916721][T26483] netlink: 'syz.0.7933': attribute type 33 has an invalid length. [ 1617.947955][T26483] netlink: 152 bytes leftover after parsing attributes in process `syz.0.7933'. [ 1618.195734][T26484] netlink: 'syz.1.7930': attribute type 10 has an invalid length. [ 1618.220255][T26484] netlink: 2 bytes leftover after parsing attributes in process `syz.1.7930'. [ 1618.822295][T26499] netlink: 'syz.3.7944': attribute type 10 has an invalid length. [ 1618.845661][T26499] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7944'. [ 1619.663162][T26509] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.7936'. [ 1619.700990][T26508] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1619.720673][T26508] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1619.732248][T26508] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1619.748141][T26508] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1619.760742][T26508] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1619.777524][T26508] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1620.325996][T26512] netlink: 'syz.0.7935': attribute type 10 has an invalid length. [ 1620.334697][T26512] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7935'. [ 1620.418284][T26512] batman_adv: batadv0: Adding interface: veth1_virt_wifi [ 1620.452986][T26512] batman_adv: batadv0: The MTU of interface veth1_virt_wifi is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1620.525817][T26512] batman_adv: batadv0: Interface activated: veth1_virt_wifi [ 1620.741221][T26532] netlink: 'syz.2.7945': attribute type 33 has an invalid length. [ 1620.767189][T26532] netlink: 152 bytes leftover after parsing attributes in process `syz.2.7945'. [ 1620.931575][T26533] netlink: 'syz.0.7947': attribute type 10 has an invalid length. [ 1620.945846][T26533] netlink: 2 bytes leftover after parsing attributes in process `syz.0.7947'. [ 1623.246227][T26556] netlink: 'syz.0.7954': attribute type 10 has an invalid length. [ 1623.298133][T26556] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7954'. [ 1623.757005][T26572] netlink: 'syz.1.7959': attribute type 10 has an invalid length. [ 1624.227637][T26578] netlink: 'syz.3.7960': attribute type 33 has an invalid length. [ 1624.265945][T26578] netlink: 152 bytes leftover after parsing attributes in process `syz.3.7960'. [ 1624.516979][T26583] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7962'. [ 1624.544853][T26583] tc_dump_action: action bad kind [ 1625.341742][T26593] netlink: 'syz.3.7966': attribute type 10 has an invalid length. [ 1626.025091][T26606] netlink: 'syz.3.7970': attribute type 10 has an invalid length. [ 1626.146510][T26609] netlink: 'syz.0.7971': attribute type 10 has an invalid length. [ 1626.792064][T26625] netlink: 'syz.1.7980': attribute type 33 has an invalid length. [ 1626.820985][T26625] netlink: 152 bytes leftover after parsing attributes in process `syz.1.7980'. [ 1626.893512][T26626] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1626.918785][T26626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1626.939068][T26626] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1626.961848][T26626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1626.974445][T26626] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1626.985282][T26626] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1627.028699][T26630] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1627.456107][T26639] netlink: 'syz.0.7982': attribute type 10 has an invalid length. [ 1627.898408][T26648] netlink: 'syz.0.7986': attribute type 10 has an invalid length. [ 1628.882793][T26664] netlink: 'syz.3.7992': attribute type 33 has an invalid length. [ 1628.901635][T26664] netlink: 152 bytes leftover after parsing attributes in process `syz.3.7992'. [ 1628.965072][T26669] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1628.997253][T26672] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.7999'. [ 1629.033330][T26669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1629.065765][T26669] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1629.095954][T26669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1629.135991][T26669] batman_adv: The newly added mac address (00:20:10:00:00:00) already exists on: ipvlan1 [ 1629.184658][T26669] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1629.668343][T26681] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8005'. [ 1629.685780][T26681] tc_dump_action: action bad kind [ 1629.786798][T26683] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1630.059016][T26687] netlink: 'syz.2.7997': attribute type 10 has an invalid length. [ 1631.451841][T26710] netlink: 'syz.2.8003': attribute type 10 has an invalid length. [ 1633.180940][T26722] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.8004'. [ 1633.243888][T26722] bridge_slave_1: default FDB implementation only supports local addresses [ 1633.473499][T26727] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8018'. [ 1633.528924][T26727] tc_dump_action: action bad kind [ 1633.700106][T26714] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.8004'. [ 1633.895056][T26714] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô!' [ 1633.966024][T26714] CPU: 1 PID: 26714 Comm: syz.1.8004 Not tainted syzkaller #0 [ 1633.973668][T26714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1633.984050][T26714] Call Trace: [ 1633.987442][T26714] [ 1633.990458][T26714] dump_stack_lvl+0x18c/0x250 [ 1633.995181][T26714] ? show_regs_print_info+0x20/0x20 [ 1634.000500][T26714] ? load_image+0x420/0x420 [ 1634.005155][T26714] sysfs_warn_dup+0x8e/0xa0 [ 1634.009862][T26714] sysfs_do_create_link_sd+0xc0/0x110 [ 1634.015275][T26714] device_add_class_symlinks+0x1cf/0x240 [ 1634.020964][T26714] device_add+0x507/0xc20 [ 1634.025333][T26714] wiphy_register+0x1dad/0x2ae0 [ 1634.030439][T26714] ? cfg80211_event_work+0x40/0x40 [ 1634.035827][T26714] ? minstrel_ht_alloc+0x88a/0x990 [ 1634.041086][T26714] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1634.047370][T26714] ieee80211_register_hw+0x3464/0x4250 [ 1634.053002][T26714] ? ieee80211_tasklet_handler+0x20/0x20 [ 1634.058879][T26714] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1634.064986][T26714] ? __debug_object_init+0xec/0x450 [ 1634.070313][T26714] ? __asan_memset+0x22/0x40 [ 1634.074973][T26714] ? __hrtimer_init+0x186/0x270 [ 1634.080065][T26714] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1634.086060][T26714] ? mac80211_hwsim_free+0x220/0x220 [ 1634.091412][T26714] ? rcu_is_watching+0x15/0xb0 [ 1634.096478][T26714] ? kstrndup+0xbd/0x140 [ 1634.100794][T26714] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1634.106043][T26714] ? __nla_validate+0x50/0x50 [ 1634.111032][T26714] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1634.117792][T26714] ? __nla_parse+0x40/0x50 [ 1634.122293][T26714] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1634.128929][T26714] genl_family_rcv_msg_doit+0x211/0x310 [ 1634.134799][T26714] ? end_current_label_crit_section+0x170/0x170 [ 1634.141458][T26714] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1634.147499][T26714] ? bpf_lsm_capable+0x9/0x10 [ 1634.152401][T26714] ? security_capable+0x89/0xb0 [ 1634.157374][T26714] genl_rcv_msg+0x619/0x7a0 [ 1634.162639][T26714] ? genl_bind+0x360/0x360 [ 1634.167755][T26714] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1634.174220][T26714] ? trace_event_raw_event_lock_acquire+0x2c0/0x2c0 [ 1634.180964][T26714] netlink_rcv_skb+0x241/0x4d0 [ 1634.186384][T26714] ? genl_bind+0x360/0x360 [ 1634.191002][T26714] ? netlink_ack+0x1180/0x1180 [ 1634.195848][T26714] ? __lock_acquire+0x7d40/0x7d40 [ 1634.200985][T26714] ? net_generic+0x1e/0x240 [ 1634.205612][T26714] ? down_read+0x1ac/0x2e0 [ 1634.210244][T26714] genl_rcv+0x28/0x40 [ 1634.214427][T26714] netlink_unicast+0x751/0x8d0 [ 1634.219611][T26714] netlink_sendmsg+0x8d0/0xbf0 [ 1634.224491][T26714] ? perf_trace_lock+0x304/0x3b0 [ 1634.230061][T26714] ? netlink_getsockopt+0x590/0x590 [ 1634.235401][T26714] ? aa_sock_msg_perm+0x94/0x150 [ 1634.240663][T26714] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1634.246854][T26714] ? security_socket_sendmsg+0x80/0xa0 [ 1634.252331][T26714] ? netlink_getsockopt+0x590/0x590 [ 1634.257561][T26714] ____sys_sendmsg+0x5ba/0x960 [ 1634.262655][T26714] ? __asan_memset+0x22/0x40 [ 1634.267356][T26714] ? __sys_sendmsg_sock+0x30/0x30 [ 1634.272442][T26714] ? __import_iovec+0x5f2/0x850 [ 1634.277818][T26714] ? import_iovec+0x73/0xa0 [ 1634.282989][T26714] ___sys_sendmsg+0x2a6/0x360 [ 1634.287901][T26714] ? __sys_sendmsg+0x2a0/0x2a0 [ 1634.292887][T26714] ? debug_mutex_init+0x38/0x70 [ 1634.298474][T26714] __se_sys_sendmsg+0x1c2/0x2b0 [ 1634.303495][T26714] ? __x64_sys_sendmsg+0x80/0x80 [ 1634.308600][T26714] ? lockdep_hardirqs_on+0x98/0x150 [ 1634.313925][T26714] do_syscall_64+0x55/0xa0 [ 1634.318537][T26714] ? clear_bhb_loop+0x40/0x90 [ 1634.323278][T26714] ? clear_bhb_loop+0x40/0x90 [ 1634.328186][T26714] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1634.334241][T26714] RIP: 0033:0x7fda0279cdd9 [ 1634.338698][T26714] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1634.358998][T26714] RSP: 002b:00007fda035f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1634.368505][T26714] RAX: ffffffffffffffda RBX: 00007fda02a15fa0 RCX: 00007fda0279cdd9 [ 1634.376623][T26714] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 1634.385315][T26714] RBP: 00007fda02832d69 R08: 0000000000000000 R09: 0000000000000000 [ 1634.394124][T26714] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1634.402341][T26714] R13: 00007fda02a16038 R14: 00007fda02a15fa0 R15: 00007ffd5f546a48 [ 1634.410680][T26714] [ 1634.500976][T26731] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.8007'. [ 1637.110663][T26753] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1637.609277][T26766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8024'. [ 1637.637396][T26764] netlink: 'syz.2.8023': attribute type 21 has an invalid length. [ 1637.658244][T26764] netlink: 168 bytes leftover after parsing attributes in process `syz.2.8023'. [ 1637.696156][T26764] netlink: 184 bytes leftover after parsing attributes in process `syz.2.8023'. [ 1637.737806][T26764] netlink: 'syz.2.8023': attribute type 10 has an invalid length. [ 1637.750576][T26764] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8023'. [ 1637.801613][T26764] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1637.829115][T26769] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.8025'. [ 1638.013262][T26773] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8026'. [ 1638.191006][T15734] Bluetooth: hci3: unexpected event 0x14 length: 15 > 6 [ 1639.105177][T26785] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8038'. [ 1639.368657][T26787] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1639.474063][T26796] mac80211_hwsim hwsim3 wlan0: entered promiscuous mode [ 1639.488027][T26796] mac80211_hwsim hwsim3 wlan0: entered allmulticast mode [ 1639.884537][T26804] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.8036'. [ 1640.050854][T26810] netlink: 'syz.3.8037': attribute type 21 has an invalid length. [ 1640.061606][T26810] netlink: 168 bytes leftover after parsing attributes in process `syz.3.8037'. [ 1640.105147][T26813] netlink: 184 bytes leftover after parsing attributes in process `syz.3.8037'. [ 1640.144313][T26810] netlink: 'syz.3.8037': attribute type 10 has an invalid length. [ 1640.153136][T26810] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8037'. [ 1640.168151][T26810] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1641.708241][T26833] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1642.210520][T26844] netlink: 'syz.1.8050': attribute type 21 has an invalid length. [ 1642.226644][T26844] netlink: 168 bytes leftover after parsing attributes in process `syz.1.8050'. [ 1642.258695][T26844] netlink: 184 bytes leftover after parsing attributes in process `syz.1.8050'. [ 1642.416702][T26844] netlink: 'syz.1.8050': attribute type 10 has an invalid length. [ 1642.425366][T26844] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8050'. [ 1642.494521][T26844] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1642.623146][T26854] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8054'. [ 1642.667762][T26855] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.8055'. [ 1643.454362][T26868] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1644.043848][T26887] netlink: 'syz.0.8064': attribute type 21 has an invalid length. [ 1644.073987][T26891] netlink: 'syz.0.8064': attribute type 10 has an invalid length. [ 1644.092527][T26891] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1644.124983][T26888] __nla_validate_parse: 2 callbacks suppressed [ 1644.125004][T26888] netlink: 184 bytes leftover after parsing attributes in process `syz.0.8064'. [ 1644.299572][T26894] mac80211_hwsim hwsim14 wlan0: entered promiscuous mode [ 1644.314269][T26894] mac80211_hwsim hwsim14 wlan0: entered allmulticast mode [ 1644.436111][T26893] netlink: 'syz.1.8066': attribute type 10 has an invalid length. [ 1644.701038][T26906] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.8071'. [ 1645.366231][T26919] netlink: 'syz.0.8075': attribute type 9 has an invalid length. [ 1646.948567][T26936] netlink: 'syz.0.8079': attribute type 10 has an invalid length. [ 1647.055877][T26944] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8082'. [ 1647.422042][T26959] netlink: 'syz.2.8088': attribute type 9 has an invalid length. [ 1647.571070][T26961] netlink: 'syz.3.8090': attribute type 21 has an invalid length. [ 1647.625728][T26961] netlink: 168 bytes leftover after parsing attributes in process `syz.3.8090'. [ 1647.687529][T26964] netlink: 184 bytes leftover after parsing attributes in process `syz.3.8090'. [ 1647.748090][T26961] netlink: 'syz.3.8090': attribute type 10 has an invalid length. [ 1647.790655][T26961] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8090'. [ 1647.833598][T26961] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1648.086876][T26966] netlink: 'syz.1.8093': attribute type 10 has an invalid length. [ 1649.092627][T26978] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8096'. [ 1650.646566][T27007] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8103'. [ 1651.443180][T15734] Bluetooth: hci3: unexpected event 0x1c length: 15 > 5 [ 1652.745870][T27045] netlink: 'syz.1.8117': attribute type 9 has an invalid length. [ 1652.789541][T27051] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 1652.863850][T27051] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 1654.046967][T27070] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.8134'. [ 1657.018536][T27120] netlink: 'syz.3.8145': attribute type 9 has an invalid length. [ 1661.123565][T27177] mac80211_hwsim hwsim13 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1662.878025][T27220] netlink: 'syz.1.8177': attribute type 10 has an invalid length. [ 1663.438570][T27239] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.8183'. [ 1663.925965][T27250] netlink: 'syz.0.8186': attribute type 9 has an invalid length. [ 1665.834392][T27264] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.8192'. [ 1665.844605][T27264] bridge_slave_1: default FDB implementation only supports local addresses [ 1666.127185][T27272] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.8196'. [ 1666.554858][T27285] netdevsim netdevsim0: Direct firmware load for Ö failed with error -2 [ 1666.587709][T27285] netdevsim netdevsim0: Falling back to sysfs fallback for: Ö [ 1667.992934][T27318] netlink: 'syz.1.8210': attribute type 39 has an invalid length. [ 1668.130360][T27321] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.8211'. [ 1669.201237][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1669.215645][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1669.289817][T27330] netdevsim netdevsim2: Direct firmware load for Ö failed with error -2 [ 1669.299273][T27330] netdevsim netdevsim2: Falling back to sysfs fallback for: Ö [ 1670.377240][T27351] netlink: 208064 bytes leftover after parsing attributes in process `syz.2.8222'. [ 1670.396174][T27351] smc: net device  applied user defined pnetid CONFIG [ 1671.087693][T27367] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.8226'. [ 1672.086077][T27375] netlink: 144 bytes leftover after parsing attributes in process `syz.3.8231'. [ 1673.129212][T27399] netlink: 'syz.3.8241': attribute type 39 has an invalid length. [ 1673.233271][T27402] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8242'. [ 1674.877954][T27441] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.8257'. [ 1675.328169][T27449] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.8261'. [ 1676.151108][T27473] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8270'. [ 1676.961935][T27486] netlink: 'syz.0.8274': attribute type 39 has an invalid length. [ 1678.022164][T27517] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8286'. [ 1678.149643][T27523] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.8289'. [ 1678.494175][T27529] netlink: 'syz.2.8291': attribute type 39 has an invalid length. [ 1678.799862][T27539] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1678.825413][T27539] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1678.853093][T27539] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1678.862406][T27539] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1678.880456][T27539] batman_adv: batadv0: Interface deactivated: ipvlan1 [ 1678.889645][T27539] batman_adv: batadv0: Removing interface: ipvlan1 [ 1679.311241][T27556] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.8300'. [ 1679.526768][T27561] syzkaller0: entered promiscuous mode [ 1679.534314][T27561] syzkaller0: entered allmulticast mode [ 1682.232566][T27585] Ÿë: port 1(gretap0) entered blocking state [ 1682.260261][T27585] Ÿë: port 1(gretap0) entered disabled state [ 1682.293657][T27585] gretap0: entered allmulticast mode [ 1682.338684][T27585] gretap0: entered promiscuous mode [ 1682.384761][T27588] Ÿë: port 2(veth0_to_team) entered blocking state [ 1682.422644][T27588] Ÿë: port 2(veth0_to_team) entered disabled state [ 1682.438318][T27588] veth0_to_team: entered allmulticast mode [ 1682.446525][T27588] veth0_to_team: entered promiscuous mode [ 1683.132209][T27613] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1683.142276][T27613] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1683.165938][T27613] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1683.174271][T27613] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1683.190394][T27613] batman_adv: batadv0: Interface deactivated: ipvlan1 [ 1683.201088][T27613] batman_adv: batadv0: Removing interface: ipvlan1 [ 1684.157586][T27623] netlink: 'syz.1.8324': attribute type 10 has an invalid length. [ 1685.360220][T27652] netlink: 'syz.0.8345': attribute type 9 has an invalid length. [ 1686.840356][T27661] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1686.870268][T27662] netlink: 209852 bytes leftover after parsing attributes in process `syz.2.8338'. [ 1686.881095][T27661] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1686.929385][T27661] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1686.950074][T27661] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1686.983689][T27661] batman_adv: batadv0: Interface deactivated: ipvlan1 [ 1686.998860][T27661] batman_adv: batadv0: Removing interface: ipvlan1 [ 1687.461287][T27673] netdevsim netdevsim2: Direct firmware load for .net/syz1 failed with error -2 [ 1687.471728][T27673] netdevsim netdevsim2: Falling back to sysfs fallback for: .net/syz1 [ 1687.650186][T27677] netlink: 144 bytes leftover after parsing attributes in process `syz.1.8346'. [ 1687.964913][T27675] netlink: 'syz.3.8344': attribute type 10 has an invalid length. [ 1687.980331][T27675] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1688.424477][T27690] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8359'. [ 1689.086040][T27696] Ÿë: port 1(gretap0) entered blocking state [ 1689.092820][T27696] Ÿë: port 1(gretap0) entered disabled state [ 1689.104838][T27696] gretap0: entered allmulticast mode [ 1689.130063][T27696] gretap0: entered promiscuous mode [ 1689.182997][T27700] Ÿë: port 2(veth0_to_team) entered blocking state [ 1689.212101][T27700] Ÿë: port 2(veth0_to_team) entered disabled state [ 1689.238552][T27700] veth0_to_team: entered allmulticast mode [ 1689.281614][T27700] veth0_to_team: entered promiscuous mode [ 1689.308180][T27703] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1689.337662][T27703] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1689.366902][T27703] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1689.393982][T27703] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1689.439017][T27703] batman_adv: batadv0: Interface deactivated: veth1_virt_wifi [ 1689.472881][T27703] batman_adv: batadv0: Removing interface: veth1_virt_wifi [ 1689.518656][T27703] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 1689.533588][T27703] batman_adv: batadv0: Removing interface: virt_wifi0 [ 1689.577447][T27703] batman_adv: batadv0: Interface deactivated: ipvlan1 [ 1689.585199][T27703] batman_adv: batadv0: Removing interface: ipvlan1 [ 1690.950842][T27714] netlink: 'syz.0.8357': attribute type 10 has an invalid length. [ 1690.965229][T27714] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1691.147321][T27730] netlink: 'syz.0.8365': attribute type 9 has an invalid length. [ 1694.062774][T27754] netlink: 'syz.2.8374': attribute type 10 has an invalid length. [ 1694.128917][T27754] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1695.160600][T27778] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.8384'. [ 1696.224977][T27784] netlink: 'syz.0.8385': attribute type 10 has an invalid length. [ 1696.233311][T27784] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1696.522491][T27792] netlink: 'syz.3.8389': attribute type 9 has an invalid length. [ 1696.764805][T27796] pim6reg1: entered promiscuous mode [ 1696.798875][T27796] pim6reg1: entered allmulticast mode [ 1697.882147][T27809] netlink: 'syz.2.8393': attribute type 10 has an invalid length. [ 1698.204867][T27819] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.8395'. [ 1698.318479][T27823] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.8397'. [ 1698.512462][T27820] netlink: 'syz.0.8396': attribute type 10 has an invalid length. [ 1698.555794][T27820] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1699.149835][T27833] netlink: 'syz.1.8400': attribute type 9 has an invalid length. [ 1702.018558][T27859] netlink: 'syz.0.8408': attribute type 10 has an invalid length. [ 1702.026712][T27859] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1702.349030][T27873] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.8410'. [ 1702.996177][T27878] netlink: 'syz.2.8414': attribute type 9 has an invalid length. [ 1703.998650][T27894] mac80211_hwsim hwsim34 wlan1: entered allmulticast mode [ 1704.173799][T27900] pim6reg1: entered promiscuous mode [ 1704.196116][T27900] pim6reg1: entered allmulticast mode [ 1704.362861][T27904] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.8425'. [ 1704.797789][T27915] netlink: 'syz.0.8429': attribute type 9 has an invalid length. [ 1707.050774][T27935] pim6reg1: entered promiscuous mode [ 1707.178187][T27935] pim6reg1: entered allmulticast mode [ 1707.538672][T27943] netlink: 'syz.3.8441': attribute type 9 has an invalid length. [ 1710.066866][T27972] pim6reg1: entered promiscuous mode [ 1710.093811][T27972] pim6reg1: entered allmulticast mode [ 1710.487381][T27984] netlink: 'syz.1.8455': attribute type 4 has an invalid length. [ 1710.521740][T27984] netlink: 152 bytes leftover after parsing attributes in process `syz.1.8455'. [ 1710.857312][T27988] netlink: 'syz.1.8456': attribute type 9 has an invalid length. [ 1711.536775][T27993] netlink: 'syz.2.8459': attribute type 9 has an invalid length. [ 1712.966215][T27999] netlink: 'syz.3.8462': attribute type 10 has an invalid length. [ 1712.976084][T27999] team0: Device ipvlan1 is up. Set it down before adding it as a team port [ 1713.130684][T28010] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.8464'. [ 1715.037773][T28027] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.8471'. [ 1715.347589][T28042] netlink: 'syz.2.8477': attribute type 9 has an invalid length. [ 1715.583554][T28045] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8476'. [ 1716.360236][T28053] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8480'. [ 1716.377292][T28053] netlink: 'syz.3.8480': attribute type 12 has an invalid length. [ 1716.400720][T28053] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8480'. [ 1718.340856][T28084] netlink: 'syz.1.8491': attribute type 33 has an invalid length. [ 1718.368476][T28084] netlink: 152 bytes leftover after parsing attributes in process `syz.1.8491'. [ 1718.411236][T28084] A link change request failed with some changes committed already. Interface ..ãc¤± may have been left with an inconsistent configuration, please check. [ 1718.895799][T28099] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.8495'. [ 1719.787248][T28125] netlink: 'syz.0.8504': attribute type 33 has an invalid length. [ 1719.795133][T28125] netlink: 152 bytes leftover after parsing attributes in process `syz.0.8504'. [ 1719.879726][T28122] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.8502'. [ 1719.906267][T28125] A link change request failed with some changes committed already. Interface ..ãc¤± may have been left with an inconsistent configuration, please check. [ 1720.238111][T28132] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8507'. [ 1720.324990][T28133] netlink: 'syz.1.8507': attribute type 12 has an invalid length. [ 1720.347180][T28133] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8507'. [ 1720.777625][T28143] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8512'. [ 1721.713602][T28155] netlink: 'syz.3.8517': attribute type 10 has an invalid length. [ 1721.722345][T28155] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8517'. [ 1721.842157][T28159] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8519'. [ 1721.868554][T28159] netlink: 'syz.0.8519': attribute type 12 has an invalid length. [ 1721.895768][T28159] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8519'. [ 1721.905420][T28162] netlink: 'syz.2.8518': attribute type 33 has an invalid length. [ 1721.919841][T28162] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8518'. [ 1721.990742][T28162] A link change request failed with some changes committed already. Interface ..ãc¤± may have been left with an inconsistent configuration, please check. [ 1722.541248][T28166] netlink: 'syz.3.8521': attribute type 9 has an invalid length. [ 1724.168997][T28188] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8531'. [ 1724.190013][T28188] netlink: 'syz.2.8531': attribute type 12 has an invalid length. [ 1724.198369][T28188] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8531'. [ 1724.440234][T28194] netlink: 'syz.2.8533': attribute type 10 has an invalid length. [ 1724.463481][T28194] netlink: 55 bytes leftover after parsing attributes in process `syz.2.8533'. [ 1726.791267][T28229] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.8553'. [ 1727.017552][T28241] netlink: 'syz.0.8547': attribute type 10 has an invalid length. [ 1727.057077][T28241] netlink: 55 bytes leftover after parsing attributes in process `syz.0.8547'. [ 1727.943399][T28246] netlink: 'syz.3.8551': attribute type 33 has an invalid length. [ 1727.959256][T28246] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8551'. [ 1727.999841][T28246] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1728.028329][T28250] netlink: 'syz.1.8552': attribute type 9 has an invalid length. [ 1728.329193][T28262] netlink: 'syz.3.8557': attribute type 10 has an invalid length. [ 1728.337559][T28262] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8557'. [ 1728.347030][T28262] ipvlan1: entered promiscuous mode [ 1728.352530][T28262] ipvlan1: entered allmulticast mode [ 1728.362175][T28262] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1728.719244][T28273] netlink: 'syz.2.8562': attribute type 9 has an invalid length. [ 1729.032247][T28279] netlink: 'syz.3.8564': attribute type 33 has an invalid length. [ 1729.067344][T28279] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8564'. [ 1729.283750][T28279] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1730.641290][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1730.648059][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1730.723689][T28296] netlink: 199836 bytes leftover after parsing attributes in process `syz.0.8568'. [ 1730.904940][T28300] netlink: 'syz.3.8569': attribute type 10 has an invalid length. [ 1730.948463][T28300] netlink: 55 bytes leftover after parsing attributes in process `syz.3.8569'. [ 1731.946619][T28312] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.8573'. [ 1732.021121][T28312] netlink: 'syz.0.8573': attribute type 10 has an invalid length. [ 1732.646605][T28319] netlink: 'syz.1.8575': attribute type 33 has an invalid length. [ 1732.685785][T28319] netlink: 152 bytes leftover after parsing attributes in process `syz.1.8575'. [ 1732.793345][T28319] A link change request failed with some changes committed already. Interface ..ãc¤± may have been left with an inconsistent configuration, please check. [ 1733.342771][T28342] netlink: 'syz.1.8582': attribute type 10 has an invalid length. [ 1733.363369][T28342] netlink: 55 bytes leftover after parsing attributes in process `syz.1.8582'. [ 1733.767269][T28352] netlink: 'syz.3.8586': attribute type 9 has an invalid length. [ 1733.804460][T28349] netlink: 'syz.0.8584': attribute type 10 has an invalid length. [ 1733.903185][T28349] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8584'. [ 1734.009402][T28349] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1734.907547][T28363] netlink: 'syz.3.8590': attribute type 33 has an invalid length. [ 1734.920401][T28363] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8590'. [ 1734.957429][T28363] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1735.631312][T28386] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8597'. [ 1735.818781][T28396] netlink: 'syz.3.8599': attribute type 10 has an invalid length. [ 1735.875627][T28396] netlink: 55 bytes leftover after parsing attributes in process `syz.3.8599'. [ 1735.942835][T28398] netlink: 'syz.2.8601': attribute type 10 has an invalid length. [ 1735.992525][T28398] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8601'. [ 1736.617500][T28408] netlink: 'syz.1.8604': attribute type 33 has an invalid length. [ 1736.645827][T28408] netlink: 152 bytes leftover after parsing attributes in process `syz.1.8604'. [ 1736.665367][T28408] A link change request failed with some changes committed already. Interface ..ãc¤± may have been left with an inconsistent configuration, please check. [ 1737.007950][T28420] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.8609'. [ 1737.183240][T28420] netlink: 'syz.2.8609': attribute type 10 has an invalid length. [ 1737.618943][T28427] netlink: 'syz.3.8612': attribute type 2 has an invalid length. [ 1737.630083][T28432] netlink: 'syz.0.8611': attribute type 10 has an invalid length. [ 1737.652296][T28427] netlink: 'syz.3.8612': attribute type 1 has an invalid length. [ 1737.655661][T28432] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8611'. [ 1737.669587][T28432] ipvlan1: entered promiscuous mode [ 1737.672507][T28427] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8612'. [ 1737.676060][T28432] ipvlan1: entered allmulticast mode [ 1737.690109][T28432] veth0_vlan: entered allmulticast mode [ 1737.697260][T28432] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1737.838581][T28435] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8614'. [ 1737.867661][T28435] netlink: 'syz.2.8614': attribute type 12 has an invalid length. [ 1737.875787][T28435] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8614'. [ 1737.885258][T28437] netlink: 'syz.3.8615': attribute type 33 has an invalid length. [ 1737.894236][T28437] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8615'. [ 1737.911612][T28437] A link change request failed with some changes committed already. Interface wlan1 may have been left with an inconsistent configuration, please check. [ 1738.167101][T28447] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.8616'. [ 1738.177351][T28443] netlink: 'syz.0.8624': attribute type 33 has an invalid length. [ 1738.190352][T28443] netlink: 152 bytes leftover after parsing attributes in process `syz.0.8624'. [ 1738.251763][T28443] A link change request failed with some changes committed already. Interface ..ãc¤± may have been left with an inconsistent configuration, please check. [ 1739.997746][T28477] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8626'. [ 1740.160710][T28480] netlink: 'syz.0.8627': attribute type 3 has an invalid length. [ 1740.169370][T28480] netlink: 181400 bytes leftover after parsing attributes in process `syz.0.8627'. [ 1742.139747][T28517] validate_nla: 1 callbacks suppressed [ 1742.139784][T28517] netlink: 'syz.2.8642': attribute type 2 has an invalid length. [ 1742.181545][T28517] netlink: 'syz.2.8642': attribute type 1 has an invalid length. [ 1742.195764][T28517] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8642'. [ 1742.470003][T28526] netlink: 'syz.2.8646': attribute type 2 has an invalid length. [ 1742.495549][T28526] netlink: 119 bytes leftover after parsing attributes in process `syz.2.8646'. [ 1745.383333][T28591] netlink: 132 bytes leftover after parsing attributes in process `syz.3.8671'. [ 1745.439497][T28592] netlink: 'syz.1.8669': attribute type 10 has an invalid length. [ 1745.458906][T28592] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8669'. [ 1745.648092][T28598] netlink: 'syz.2.8673': attribute type 153 has an invalid length. [ 1745.661371][T28598] netlink: 128124 bytes leftover after parsing attributes in process `syz.2.8673'. [ 1746.994032][T28619] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8682'. [ 1747.376573][T28637] netlink: 'syz.1.8689': attribute type 39 has an invalid length. [ 1748.463276][T28650] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8695'. [ 1748.528550][T28653] netlink: 209844 bytes leftover after parsing attributes in process `syz.1.8696'. [ 1748.825033][T28663] netlink: 'syz.2.8701': attribute type 10 has an invalid length. [ 1749.245142][T28679] veth1_to_bond: left allmulticast mode [ 1749.432015][T28686] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8709'. [ 1750.644570][T28703] netlink: 'syz.3.8715': attribute type 2 has an invalid length. [ 1750.653128][T28703] netlink: 119 bytes leftover after parsing attributes in process `syz.3.8715'. [ 1751.222101][T28724] veth1_to_bond: left allmulticast mode [ 1751.453646][T28728] bridge_slave_0: left allmulticast mode [ 1752.795864][T28775] netlink: 'syz.2.8744': attribute type 39 has an invalid length. [ 1754.491331][T28800] bridge_slave_0: left allmulticast mode [ 1755.363010][T28809] netlink: 'syz.0.8764': attribute type 10 has an invalid length. [ 1755.634759][T28813] bridge_slave_0: left allmulticast mode [ 1755.650485][T28820] netlink: 'syz.0.8758': attribute type 39 has an invalid length. [ 1755.972225][T28827] netlink: 'syz.1.8760': attribute type 2 has an invalid length. [ 1756.002991][T28827] netlink: 119 bytes leftover after parsing attributes in process `syz.1.8760'. [ 1756.662524][T28838] netlink: 'syz.2.8769': attribute type 9 has an invalid length. [ 1756.686463][T28838] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.8769'. [ 1756.934761][T28841] netlink: 'syz.2.8769': attribute type 9 has an invalid length. [ 1756.975901][T28841] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.8769'. [ 1757.248242][T28848] mac80211_hwsim hwsim38 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1757.276973][T28846] netlink: 'syz.3.8771': attribute type 10 has an invalid length. [ 1757.340410][T28848] netlink: 'syz.1.8772': attribute type 3 has an invalid length. [ 1757.369074][T28848] netlink: 16066 bytes leftover after parsing attributes in process `syz.1.8772'. [ 1757.415024][T28851] pim6reg1: left promiscuous mode [ 1757.421285][T28851] pim6reg1: left allmulticast mode [ 1757.612655][T28859] pim6reg1: left promiscuous mode [ 1757.618079][T28859] pim6reg1: left allmulticast mode [ 1757.639839][T28861] netlink: 'syz.3.8776': attribute type 39 has an invalid length. [ 1758.865847][T28886] syzkaller0: entered promiscuous mode [ 1758.877802][T28886] syzkaller0: entered allmulticast mode [ 1760.980230][T28900] pim6reg1: left promiscuous mode [ 1760.985310][T28900] pim6reg1: left allmulticast mode [ 1761.449476][T28917] netlink: 'syz.2.8797': attribute type 39 has an invalid length. [ 1762.914808][T28935] delete_channel: no stack [ 1764.395266][T28978] pim6reg1: left promiscuous mode [ 1764.405780][T28978] pim6reg1: left allmulticast mode [ 1765.838821][T29016] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.8828'. [ 1765.867006][T29016] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 1765.876036][T29016] CPU: 1 PID: 29016 Comm: syz.1.8828 Not tainted syzkaller #0 [ 1765.883630][T29016] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1765.893810][T29016] Call Trace: [ 1765.897137][T29016] [ 1765.900092][T29016] dump_stack_lvl+0x18c/0x250 [ 1765.904828][T29016] ? show_regs_print_info+0x20/0x20 [ 1765.910071][T29016] ? load_image+0x420/0x420 [ 1765.914724][T29016] sysfs_warn_dup+0x8e/0xa0 [ 1765.919265][T29016] sysfs_do_create_link_sd+0xc0/0x110 [ 1765.924669][T29016] device_add_class_symlinks+0x1cf/0x240 [ 1765.930342][T29016] device_add+0x507/0xc20 [ 1765.934728][T29016] wiphy_register+0x1dad/0x2ae0 [ 1765.939619][T29016] ? cfg80211_event_work+0x40/0x40 [ 1765.944736][T29016] ? minstrel_ht_alloc+0x88a/0x990 [ 1765.949861][T29016] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1765.955941][T29016] ieee80211_register_hw+0x3464/0x4250 [ 1765.961415][T29016] ? ieee80211_tasklet_handler+0x20/0x20 [ 1765.967044][T29016] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1765.972943][T29016] ? __debug_object_init+0xec/0x450 [ 1765.978150][T29016] ? __asan_memset+0x22/0x40 [ 1765.982742][T29016] ? __hrtimer_init+0x186/0x270 [ 1765.987601][T29016] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1765.993345][T29016] ? mac80211_hwsim_free+0x220/0x220 [ 1765.998632][T29016] ? rcu_is_watching+0x15/0xb0 [ 1766.003397][T29016] ? kstrndup+0xbd/0x140 [ 1766.007651][T29016] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1766.012860][T29016] ? __nla_validate+0x50/0x50 [ 1766.017545][T29016] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1766.023965][T29016] ? __nla_parse+0x40/0x50 [ 1766.028384][T29016] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1766.034808][T29016] genl_family_rcv_msg_doit+0x211/0x310 [ 1766.040363][T29016] ? end_current_label_crit_section+0x170/0x170 [ 1766.046611][T29016] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1766.052506][T29016] ? bpf_lsm_capable+0x9/0x10 [ 1766.057279][T29016] ? security_capable+0x89/0xb0 [ 1766.062146][T29016] genl_rcv_msg+0x619/0x7a0 [ 1766.066654][T29016] ? genl_bind+0x360/0x360 [ 1766.071069][T29016] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1766.077410][T29016] netlink_rcv_skb+0x241/0x4d0 [ 1766.082185][T29016] ? genl_bind+0x360/0x360 [ 1766.086603][T29016] ? netlink_ack+0x1180/0x1180 [ 1766.091472][T29016] ? __lock_acquire+0x7d40/0x7d40 [ 1766.096492][T29016] ? net_generic+0x1e/0x240 [ 1766.101082][T29016] ? down_read+0x1ac/0x2e0 [ 1766.105501][T29016] genl_rcv+0x28/0x40 [ 1766.109488][T29016] netlink_unicast+0x751/0x8d0 [ 1766.114256][T29016] netlink_sendmsg+0x8d0/0xbf0 [ 1766.119028][T29016] ? netlink_getsockopt+0x590/0x590 [ 1766.124228][T29016] ? aa_sock_msg_perm+0x94/0x150 [ 1766.129178][T29016] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1766.134460][T29016] ? security_socket_sendmsg+0x80/0xa0 [ 1766.139915][T29016] ? netlink_getsockopt+0x590/0x590 [ 1766.145114][T29016] ____sys_sendmsg+0x5ba/0x960 [ 1766.149889][T29016] ? __asan_memset+0x22/0x40 [ 1766.154480][T29016] ? __sys_sendmsg_sock+0x30/0x30 [ 1766.159763][T29016] ? __import_iovec+0x5f2/0x850 [ 1766.164618][T29016] ? import_iovec+0x73/0xa0 [ 1766.169295][T29016] ___sys_sendmsg+0x2a6/0x360 [ 1766.174067][T29016] ? __sys_sendmsg+0x2a0/0x2a0 [ 1766.178868][T29016] __se_sys_sendmsg+0x1c2/0x2b0 [ 1766.183718][T29016] ? __x64_sys_sendmsg+0x80/0x80 [ 1766.188664][T29016] ? lockdep_hardirqs_on+0x98/0x150 [ 1766.193872][T29016] do_syscall_64+0x55/0xa0 [ 1766.198380][T29016] ? clear_bhb_loop+0x40/0x90 [ 1766.203059][T29016] ? clear_bhb_loop+0x40/0x90 [ 1766.207830][T29016] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1766.213747][T29016] RIP: 0033:0x7fda0279cdd9 [ 1766.218158][T29016] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1766.237860][T29016] RSP: 002b:00007fda035f7028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1766.246273][T29016] RAX: ffffffffffffffda RBX: 00007fda02a15fa0 RCX: 00007fda0279cdd9 [ 1766.254240][T29016] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 1766.262208][T29016] RBP: 00007fda02832d69 R08: 0000000000000000 R09: 0000000000000000 [ 1766.270181][T29016] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1766.278244][T29016] R13: 00007fda02a16038 R14: 00007fda02a15fa0 R15: 00007ffd5f546a48 [ 1766.286753][T29016] [ 1769.440259][T29075] syzkaller0: entered promiscuous mode [ 1769.453939][T29075] syzkaller0: entered allmulticast mode [ 1772.239596][T29092] netlink: 'syz.1.8854': attribute type 10 has an invalid length. [ 1772.248447][T29092] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8854'. [ 1772.542178][T29100] mac80211_hwsim hwsim34 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1772.561574][T29100] netlink: 'syz.0.8857': attribute type 3 has an invalid length. [ 1772.580216][T29100] netlink: 16066 bytes leftover after parsing attributes in process `syz.0.8857'. [ 1773.169324][T29116] syzkaller0: entered promiscuous mode [ 1773.175135][T29116] syzkaller0: entered allmulticast mode [ 1773.434284][T29128] netlink: 209852 bytes leftover after parsing attributes in process `syz.3.8869'. [ 1775.344891][T29128] sysfs: cannot create duplicate filename '/class/ieee80211/!!ô' [ 1775.355850][T29128] CPU: 1 PID: 29128 Comm: syz.3.8869 Not tainted syzkaller #0 [ 1775.363459][T29128] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1775.373544][T29128] Call Trace: [ 1775.376845][T29128] [ 1775.379841][T29128] dump_stack_lvl+0x18c/0x250 [ 1775.384579][T29128] ? show_regs_print_info+0x20/0x20 [ 1775.389819][T29128] ? load_image+0x420/0x420 [ 1775.394345][T29128] sysfs_warn_dup+0x8e/0xa0 [ 1775.398857][T29128] sysfs_do_create_link_sd+0xc0/0x110 [ 1775.404248][T29128] device_add_class_symlinks+0x1cf/0x240 [ 1775.409911][T29128] device_add+0x507/0xc20 [ 1775.414264][T29128] wiphy_register+0x1dad/0x2ae0 [ 1775.419133][T29128] ? cfg80211_event_work+0x40/0x40 [ 1775.424243][T29128] ? minstrel_ht_alloc+0x88a/0x990 [ 1775.429360][T29128] ? ieee80211_init_rate_ctrl_alg+0x562/0x5e0 [ 1775.435430][T29128] ieee80211_register_hw+0x3464/0x4250 [ 1775.440914][T29128] ? ieee80211_tasklet_handler+0x20/0x20 [ 1775.446561][T29128] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1775.452481][T29128] ? __debug_object_init+0xec/0x450 [ 1775.457729][T29128] ? __asan_memset+0x22/0x40 [ 1775.462326][T29128] ? __hrtimer_init+0x186/0x270 [ 1775.467201][T29128] mac80211_hwsim_new_radio+0x2a00/0x4d10 [ 1775.472968][T29128] ? mac80211_hwsim_free+0x220/0x220 [ 1775.478271][T29128] ? rcu_is_watching+0x15/0xb0 [ 1775.483046][T29128] ? kstrndup+0xbd/0x140 [ 1775.487296][T29128] hwsim_new_radio_nl+0xdc9/0x1a90 [ 1775.492413][T29128] ? __nla_validate+0x50/0x50 [ 1775.497093][T29128] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1775.503439][T29128] ? __nla_parse+0x40/0x50 [ 1775.507884][T29128] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 1775.514239][T29128] genl_family_rcv_msg_doit+0x211/0x310 [ 1775.519791][T29128] ? end_current_label_crit_section+0x170/0x170 [ 1775.526050][T29128] ? genl_family_rcv_msg_dumpit+0x310/0x310 [ 1775.531950][T29128] ? bpf_lsm_capable+0x9/0x10 [ 1775.536634][T29128] ? security_capable+0x89/0xb0 [ 1775.541496][T29128] genl_rcv_msg+0x619/0x7a0 [ 1775.546010][T29128] ? genl_bind+0x360/0x360 [ 1775.550510][T29128] ? lockdep_hardirqs_on_prepare+0x40d/0x770 [ 1775.556501][T29128] ? hwsim_tx_info_frame_received_nl+0xd60/0xd60 [ 1775.562845][T29128] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1775.569073][T29128] netlink_rcv_skb+0x241/0x4d0 [ 1775.573872][T29128] ? genl_bind+0x360/0x360 [ 1775.578570][T29128] ? netlink_ack+0x1180/0x1180 [ 1775.583358][T29128] ? __lock_acquire+0x7d40/0x7d40 [ 1775.588397][T29128] ? down_read+0x1ac/0x2e0 [ 1775.592816][T29128] genl_rcv+0x28/0x40 [ 1775.596890][T29128] netlink_unicast+0x751/0x8d0 [ 1775.601663][T29128] netlink_sendmsg+0x8d0/0xbf0 [ 1775.606438][T29128] ? netlink_getsockopt+0x590/0x590 [ 1775.611815][T29128] ? aa_sock_msg_perm+0x94/0x150 [ 1775.616766][T29128] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1775.622054][T29128] ? security_socket_sendmsg+0x80/0xa0 [ 1775.627506][T29128] ? netlink_getsockopt+0x590/0x590 [ 1775.632767][T29128] ____sys_sendmsg+0x5ba/0x960 [ 1775.637533][T29128] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1775.643694][T29128] ? __asan_memset+0x22/0x40 [ 1775.648284][T29128] ? __sys_sendmsg_sock+0x30/0x30 [ 1775.653303][T29128] ? __import_iovec+0x5f2/0x850 [ 1775.658156][T29128] ? import_iovec+0x73/0xa0 [ 1775.662657][T29128] ___sys_sendmsg+0x2a6/0x360 [ 1775.667335][T29128] ? __sys_sendmsg+0x2a0/0x2a0 [ 1775.672129][T29128] __se_sys_sendmsg+0x1c2/0x2b0 [ 1775.676978][T29128] ? __x64_sys_sendmsg+0x80/0x80 [ 1775.682011][T29128] ? lockdep_hardirqs_on+0x98/0x150 [ 1775.687211][T29128] do_syscall_64+0x55/0xa0 [ 1775.691622][T29128] ? clear_bhb_loop+0x40/0x90 [ 1775.696296][T29128] ? clear_bhb_loop+0x40/0x90 [ 1775.700989][T29128] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1775.706893][T29128] RIP: 0033:0x7f30b059cdd9 [ 1775.711303][T29128] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1775.731344][T29128] RSP: 002b:00007f30b14eb028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1775.739786][T29128] RAX: ffffffffffffffda RBX: 00007f30b0815fa0 RCX: 00007f30b059cdd9 [ 1775.747754][T29128] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000008 [ 1775.755726][T29128] RBP: 00007f30b0632d69 R08: 0000000000000000 R09: 0000000000000000 [ 1775.763695][T29128] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1775.771667][T29128] R13: 00007f30b0816038 R14: 00007f30b0815fa0 R15: 00007ffd7ef6fd18 [ 1775.779649][T29128] [ 1775.787360][T29132] netlink: 'syz.1.8870': attribute type 10 has an invalid length. [ 1775.795275][T29132] netlink: 40 bytes leftover after parsing attributes in process `syz.1.8870'. [ 1775.815818][T29132] ipvlan1: entered promiscuous mode [ 1775.821093][T29132] ipvlan1: entered allmulticast mode [ 1775.836791][T29132] A link change request failed with some changes committed already. Interface ipvlan1 may have been left with an inconsistent configuration, please check. [ 1775.869608][T29135] mac80211_hwsim hwsim93 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1775.905157][T29135] netlink: 'syz.2.8871': attribute type 3 has an invalid length. [ 1775.924310][T29135] netlink: 16066 bytes leftover after parsing attributes in process `syz.2.8871'. [ 1777.429192][T29164] netlink: 'syz.2.8881': attribute type 21 has an invalid length. [ 1777.468040][T29164] netlink: 156 bytes leftover after parsing attributes in process `syz.2.8881'. [ 1777.513232][T29164] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8881'. [ 1777.678910][T29175] tap1: tun_chr_ioctl cmd 35108 [ 1778.342007][T29192] netlink: 'syz.2.8889': attribute type 29 has an invalid length. [ 1778.352477][T29189] netlink: 14 bytes leftover after parsing attributes in process `syz.0.8888'. [ 1778.366428][T29192] netlink: 'syz.2.8889': attribute type 29 has an invalid length. [ 1778.414980][T29192] netlink: 'syz.2.8889': attribute type 2 has an invalid length. [ 1778.435601][T29192] netlink: 'syz.2.8889': attribute type 8 has an invalid length. [ 1778.443412][T29192] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8889'. [ 1778.461144][T29192] netlink: 'syz.2.8889': attribute type 2 has an invalid length. [ 1778.469221][T29192] netlink: 'syz.2.8889': attribute type 8 has an invalid length. [ 1778.477600][T29192] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8889'. [ 1778.598259][T29202] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.8899'. [ 1778.611552][T29202] bridge_slave_1: default FDB implementation only supports local addresses [ 1778.639438][T29203] netlink: 'syz.1.8900': attribute type 29 has an invalid length. [ 1778.649617][T29203] netlink: 'syz.1.8900': attribute type 29 has an invalid length. [ 1778.703102][T29203] netlink: 'syz.1.8900': attribute type 2 has an invalid length. [ 1778.734301][T29203] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8900'. [ 1778.760916][T29209] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8900'. [ 1778.777542][T29207] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8892'. [ 1778.793158][T29207] team0: entered promiscuous mode [ 1778.798943][T29207] team_slave_0: entered promiscuous mode [ 1778.804971][T29207] team_slave_1: entered promiscuous mode [ 1778.811501][T29207] mac80211_hwsim hwsim13 wlan1: entered promiscuous mode [ 1778.819212][T29207] hsr_slave_0: entered promiscuous mode [ 1778.825872][T29207] team0: entered allmulticast mode [ 1778.831672][T29207] team_slave_0: entered allmulticast mode [ 1778.840304][T29207] team_slave_1: entered allmulticast mode [ 1778.847232][T29207] mac80211_hwsim hwsim13 wlan1: entered allmulticast mode [ 1778.855606][T29207] hsr_slave_0: entered allmulticast mode [ 1778.884548][T29207] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1778.931370][T29210] netlink: 61967 bytes leftover after parsing attributes in process `syz.0.8893'. [ 1779.529359][T29237] bridge_slave_1: default FDB implementation only supports local addresses [ 1779.682839][T29245] team0: entered promiscuous mode [ 1779.691201][T29245] team_slave_0: entered promiscuous mode [ 1779.699607][T29245] team_slave_1: entered promiscuous mode [ 1779.717088][T29245] mac80211_hwsim hwsim15 ..ãc¤±: entered promiscuous mode [ 1779.740003][T29245] hsr_slave_0: entered promiscuous mode [ 1779.748552][T29245] team0: entered allmulticast mode [ 1779.754020][T29245] team_slave_0: entered allmulticast mode [ 1779.760687][T29245] team_slave_1: entered allmulticast mode [ 1779.767486][T29245] mac80211_hwsim hwsim15 ..ãc¤±: entered allmulticast mode [ 1779.776531][T29245] hsr_slave_0: entered allmulticast mode [ 1779.789420][T29245] 8021q: adding VLAN 0 to HW filter on device team0 [ 1779.833761][T29245] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1783.084001][T29276] __nla_validate_parse: 4 callbacks suppressed [ 1783.084061][T29276] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.8917'. [ 1783.111916][T29276] bridge_slave_1: default FDB implementation only supports local addresses [ 1783.127048][T29282] validate_nla: 11 callbacks suppressed [ 1783.127065][T29282] netlink: 'syz.0.8916': attribute type 29 has an invalid length. [ 1783.128125][T29278] netlink: 'syz.2.8918': attribute type 4 has an invalid length. [ 1783.148617][T29278] netlink: 152 bytes leftover after parsing attributes in process `syz.2.8918'. [ 1783.161149][T29282] netlink: 'syz.0.8916': attribute type 29 has an invalid length. [ 1783.172167][T29280] tap1: tun_chr_ioctl cmd 35108 [ 1783.177461][T29282] netlink: 'syz.0.8916': attribute type 2 has an invalid length. [ 1783.195526][T29282] netlink: 'syz.0.8916': attribute type 8 has an invalid length. [ 1783.203757][T29282] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8916'. [ 1783.229089][T29283] netlink: 'syz.0.8916': attribute type 2 has an invalid length. [ 1783.245784][T29283] netlink: 'syz.0.8916': attribute type 8 has an invalid length. [ 1783.265622][T29283] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8916'. [ 1783.328051][T29287] netlink: 'syz.2.8922': attribute type 1 has an invalid length. [ 1783.345710][T29287] netlink: 'syz.2.8922': attribute type 3 has an invalid length. [ 1783.365326][T29287] netlink: 132 bytes leftover after parsing attributes in process `syz.2.8922'. [ 1783.379658][T29287] netlink: 'syz.2.8922': attribute type 10 has an invalid length. [ 1783.388108][T29287] netlink: 168 bytes leftover after parsing attributes in process `syz.2.8922'. [ 1783.556589][T29293] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8931'. [ 1783.571310][T29293] netlink: 132 bytes leftover after parsing attributes in process `syz.0.8931'. [ 1783.958637][T29310] tap3: tun_chr_ioctl cmd 35108 [ 1784.122456][T29314] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.8930'. [ 1784.164459][T29314] bridge_slave_1: default FDB implementation only supports local addresses [ 1784.641348][T29332] netlink: 152 bytes leftover after parsing attributes in process `syz.3.8941'. [ 1784.938545][T29340] bridge_slave_1: default FDB implementation only supports local addresses [ 1785.006788][T29342] tap4: tun_chr_ioctl cmd 35108 [ 1786.448253][T29374] bridge_slave_1: default FDB implementation only supports local addresses [ 1787.359495][T29397] wg2: entered promiscuous mode [ 1787.385390][T29397] wg2: entered allmulticast mode [ 1788.112410][T29417] __nla_validate_parse: 8 callbacks suppressed [ 1788.112430][T29417] netlink: 14 bytes leftover after parsing attributes in process `syz.3.8972'. [ 1788.195344][T29419] validate_nla: 11 callbacks suppressed [ 1788.202146][T29419] netlink: 'syz.1.8973': attribute type 10 has an invalid length. [ 1788.211230][T29419] netlink: 2 bytes leftover after parsing attributes in process `syz.1.8973'. [ 1788.222965][T29413] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.8971'. [ 1788.238882][T29413] bridge_slave_1: default FDB implementation only supports local addresses [ 1788.570340][T29425] netlink: 61967 bytes leftover after parsing attributes in process `syz.3.8977'. [ 1788.845142][T29429] mac80211_hwsim hwsim34 wlan1: entered promiscuous mode [ 1789.458799][T29439] netlink: 'syz.1.8980': attribute type 1 has an invalid length. [ 1789.483058][T29439] netlink: 'syz.1.8980': attribute type 3 has an invalid length. [ 1789.495792][T29439] netlink: 132 bytes leftover after parsing attributes in process `syz.1.8980'. [ 1789.521252][T29439] netlink: 'syz.1.8980': attribute type 10 has an invalid length. [ 1789.529913][T29439] netlink: 168 bytes leftover after parsing attributes in process `syz.1.8980'. [ 1789.806660][T29447] mac80211_hwsim hwsim38 wlan1: entered promiscuous mode [ 1789.835748][T29447] mac80211_hwsim hwsim38 wlan1: entered allmulticast mode [ 1790.505325][T29453] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.8986'. [ 1790.563229][T29453] bridge_slave_1: default FDB implementation only supports local addresses [ 1791.057429][T29471] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.9000'. [ 1791.071050][T29471] bridge_slave_1: default FDB implementation only supports local addresses [ 1791.162764][T29470] wg2: entered promiscuous mode [ 1791.174133][T29470] wg2: entered allmulticast mode [ 1791.231669][T29475] netlink: 61967 bytes leftover after parsing attributes in process `syz.1.8991'. [ 1791.385595][T29481] netlink: 1047 bytes leftover after parsing attributes in process `syz.0.9004'. [ 1791.395234][T29481] bridge_slave_1: default FDB implementation only supports local addresses [ 1792.120624][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1792.127461][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1792.226076][T29506] wg2: entered promiscuous mode [ 1792.231176][T29506] wg2: entered allmulticast mode [ 1792.333554][T29508] netlink: 'syz.3.9007': attribute type 1 has an invalid length. [ 1792.353651][T29508] netlink: 'syz.3.9007': attribute type 3 has an invalid length. [ 1792.399929][T29508] netlink: 'syz.3.9007': attribute type 10 has an invalid length. [ 1792.787694][T29519] bridge_slave_1: default FDB implementation only supports local addresses [ 1793.738708][T29541] wg2: entered promiscuous mode [ 1793.756569][T29541] wg2: entered allmulticast mode [ 1793.848186][T29545] __nla_validate_parse: 5 callbacks suppressed [ 1793.848266][T29545] netlink: 14 bytes leftover after parsing attributes in process `syz.2.9020'. [ 1794.065538][T29549] wg2: left promiscuous mode [ 1794.071219][T29549] wg2: left allmulticast mode [ 1794.100627][T29553] mac80211_hwsim hwsim93 wlan1: entered promiscuous mode [ 1794.110498][T29553] mac80211_hwsim hwsim93 wlan1: entered allmulticast mode [ 1794.136939][T29549] wg2: entered promiscuous mode [ 1794.143191][T29549] wg2: entered allmulticast mode [ 1795.342095][T29577] netlink: 14 bytes leftover after parsing attributes in process `syz.3.9032'. [ 1795.708901][T29586] wg2: left promiscuous mode [ 1795.727492][T29586] wg2: left allmulticast mode [ 1795.766127][T29591] wg2: entered promiscuous mode [ 1795.771050][T29591] wg2: entered allmulticast mode [ 1795.923571][T29596] netlink: 'syz.3.9040': attribute type 2 has an invalid length. [ 1796.099726][T29598] netlink: 'syz.1.9041': attribute type 10 has an invalid length. [ 1796.109300][T29598] netlink: 2 bytes leftover after parsing attributes in process `syz.1.9041'. [ 1796.255370][T29602] netlink: 14 bytes leftover after parsing attributes in process `syz.2.9044'. [ 1797.133219][T29616] netlink: 4068 bytes leftover after parsing attributes in process `syz.2.9047'. [ 1797.457101][T29626] netlink: 'syz.1.9052': attribute type 2 has an invalid length. [ 1797.628549][T29630] netlink: 'syz.1.9056': attribute type 1 has an invalid length. [ 1797.675816][T29630] netlink: 'syz.1.9056': attribute type 3 has an invalid length. [ 1797.693059][T29630] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9056'. [ 1797.713707][T29638] netlink: 'syz.1.9056': attribute type 10 has an invalid length. [ 1797.736693][T29638] netlink: 168 bytes leftover after parsing attributes in process `syz.1.9056'. [ 1797.777917][T29632] netlink: 'syz.3.9055': attribute type 10 has an invalid length. [ 1797.786476][T29632] netlink: 2 bytes leftover after parsing attributes in process `syz.3.9055'. [ 1799.503498][T29671] netlink: 'syz.2.9067': attribute type 1 has an invalid length. [ 1799.525776][T29671] netlink: 'syz.2.9067': attribute type 3 has an invalid length. [ 1799.533786][T29671] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9067'. [ 1799.566045][T29671] netlink: 'syz.2.9067': attribute type 10 has an invalid length. [ 1799.575358][T29671] netlink: 168 bytes leftover after parsing attributes in process `syz.2.9067'. [ 1799.819085][T29677] netlink: 2 bytes leftover after parsing attributes in process `syz.2.9069'. [ 1800.326482][T29690] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.9077'. [ 1800.896498][T29696] wg2: left promiscuous mode [ 1800.912125][T29696] wg2: left allmulticast mode [ 1800.977327][T29698] wg2: entered promiscuous mode [ 1800.995643][T29698] wg2: entered allmulticast mode [ 1801.002579][T29699] validate_nla: 3 callbacks suppressed [ 1801.002623][T29699] netlink: 'syz.0.9082': attribute type 1 has an invalid length. [ 1801.030874][T29699] netlink: 'syz.0.9082': attribute type 3 has an invalid length. [ 1801.060215][T29699] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9082'. [ 1801.084561][T29702] netlink: 'syz.2.9083': attribute type 2 has an invalid length. [ 1801.103488][T29699] netlink: 'syz.0.9082': attribute type 10 has an invalid length. [ 1801.113041][T29699] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9082'. [ 1802.147830][T29727] netlink: 'syz.3.9094': attribute type 10 has an invalid length. [ 1802.172719][T29727] mac80211_hwsim hwsim13 wlan1: left promiscuous mode [ 1802.185926][T29727] mac80211_hwsim hwsim13 wlan1: left allmulticast mode [ 1802.198333][T29727] team0: Port device wlan1 removed [ 1802.230283][T29729] netlink: 'syz.1.9095': attribute type 1 has an invalid length. [ 1802.252764][T29729] netlink: 'syz.1.9095': attribute type 3 has an invalid length. [ 1802.278627][T29729] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9095'. [ 1802.312267][T29729] netlink: 'syz.1.9095': attribute type 10 has an invalid length. [ 1802.330596][T29729] netlink: 168 bytes leftover after parsing attributes in process `syz.1.9095'. [ 1802.519607][T29738] netlink: 'syz.1.9098': attribute type 2 has an invalid length. [ 1802.831793][T29749] netlink: 'syz.2.9102': attribute type 10 has an invalid length. [ 1803.208316][T29762] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9107'. [ 1803.228100][T29762] netlink: 168 bytes leftover after parsing attributes in process `syz.3.9107'. [ 1804.161982][T29779] wg2: left promiscuous mode [ 1804.180837][T29779] wg2: left allmulticast mode [ 1804.256449][T29782] wg2: entered promiscuous mode [ 1804.266318][T29782] wg2: entered allmulticast mode [ 1805.228773][T29808] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1805.237298][T29808] IPv6: NLM_F_CREATE should be set when creating new route [ 1806.000863][T29824] wg2: left promiscuous mode [ 1806.015617][T29824] wg2: left allmulticast mode [ 1806.054985][T29825] wg2: entered promiscuous mode [ 1806.063830][T29825] wg2: entered allmulticast mode [ 1806.337718][T15734] Bluetooth: hci3: Malformed HCI Event: 0x22 [ 1806.521366][T29839] __nla_validate_parse: 1 callbacks suppressed [ 1806.521419][T29839] netlink: 14 bytes leftover after parsing attributes in process `syz.3.9135'. [ 1806.783529][T29846] validate_nla: 9 callbacks suppressed [ 1806.783566][T29846] netlink: 'syz.2.9137': attribute type 1 has an invalid length. [ 1806.822502][T29846] netlink: 'syz.2.9137': attribute type 3 has an invalid length. [ 1806.849774][T29846] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9137'. [ 1806.907222][T29846] netlink: 'syz.2.9137': attribute type 10 has an invalid length. [ 1806.958420][T29846] netlink: 168 bytes leftover after parsing attributes in process `syz.2.9137'. [ 1807.725270][T29859] netlink: 'syz.0.9143': attribute type 29 has an invalid length. [ 1807.755068][T29861] netlink: 'syz.1.9142': attribute type 10 has an invalid length. [ 1807.823069][T29859] netlink: 'syz.0.9143': attribute type 29 has an invalid length. [ 1807.900360][T29863] netlink: 'syz.0.9143': attribute type 29 has an invalid length. [ 1807.917688][T29859] netlink: 'syz.0.9143': attribute type 29 has an invalid length. [ 1807.964099][T29863] netlink: 'syz.0.9143': attribute type 29 has an invalid length. [ 1808.244093][T29873] netlink: 'syz.1.9148': attribute type 1 has an invalid length. [ 1808.268714][T29873] netlink: 132 bytes leftover after parsing attributes in process `syz.1.9148'. [ 1808.304276][T29873] netlink: 168 bytes leftover after parsing attributes in process `syz.1.9148'. [ 1808.401491][T29875] team0: Port device ..ãc¤± removed [ 1808.460159][T29876] netlink: 178584 bytes leftover after parsing attributes in process `syz.2.9149'. [ 1808.475451][T29876] netlink: zone id is out of range [ 1808.480993][T29876] netlink: zone id is out of range [ 1808.489937][T29876] netlink: zone id is out of range [ 1808.496856][T29876] netlink: zone id is out of range [ 1808.508466][T29876] netlink: zone id is out of range [ 1808.514967][T29876] netlink: zone id is out of range [ 1808.524194][T29876] netlink: zone id is out of range [ 1808.535781][T29876] netlink: zone id is out of range [ 1808.543995][T29876] netlink: zone id is out of range [ 1808.550598][T29876] netlink: zone id is out of range [ 1809.116905][T29886] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.9152'. [ 1809.146022][T29886] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.9152'. [ 1809.181085][T29882] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.9152'. [ 1809.271725][T29886] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.9152'. [ 1812.244274][T29932] __nla_validate_parse: 3 callbacks suppressed [ 1812.244292][T29932] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.9168'. [ 1812.284579][T29932] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.9168'. [ 1812.299689][T29929] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.9168'. [ 1812.329503][T29929] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.9168'. [ 1812.330085][T29934] validate_nla: 12 callbacks suppressed [ 1812.330099][T29934] netlink: 'syz.3.9169': attribute type 29 has an invalid length. [ 1812.401218][T29934] netlink: 'syz.3.9169': attribute type 29 has an invalid length. [ 1812.418193][T29932] netlink: 'syz.2.9168': attribute type 10 has an invalid length. [ 1812.428768][T29932] netlink: 40 bytes leftover after parsing attributes in process `syz.2.9168'. [ 1812.446009][T29937] netlink: 'syz.3.9169': attribute type 29 has an invalid length. [ 1812.458720][T29934] netlink: 'syz.3.9169': attribute type 29 has an invalid length. [ 1812.492873][T29934] netlink: 'syz.3.9169': attribute type 29 has an invalid length. [ 1812.538967][T29941] netlink: 'syz.0.9172': attribute type 1 has an invalid length. [ 1812.549029][T29941] netlink: 'syz.0.9172': attribute type 3 has an invalid length. [ 1812.559350][T29941] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9172'. [ 1812.582527][T29941] netlink: 'syz.0.9172': attribute type 10 has an invalid length. [ 1812.595786][T29941] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9172'. [ 1812.835608][T29949] netlink: 'syz.0.9184': attribute type 1 has an invalid length. [ 1812.857419][T29949] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9184'. [ 1812.892267][T29949] netlink: 168 bytes leftover after parsing attributes in process `syz.0.9184'. [ 1813.226655][T29966] veth0_vlan: left allmulticast mode [ 1813.328204][T29966] veth0_vlan: left promiscuous mode [ 1813.381521][T29966] veth0_vlan: entered promiscuous mode [ 1813.434532][T29966] team0: Device veth0_vlan failed to register rx_handler [ 1814.228329][T29986] netlink: 4083 bytes leftover after parsing attributes in process `syz.0.9186'. [ 1814.328118][T29975] net_ratelimit: 386 callbacks suppressed [ 1814.328137][T29975] A link change request failed with some changes committed already. Interface veth1_virt_wifi may have been left with an inconsistent configuration, please check. [ 1815.501190][T30010] veth0_vlan: left promiscuous mode [ 1815.575056][T30010] veth0_vlan: entered promiscuous mode [ 1815.600264][T30010] team0: Device veth0_vlan failed to register rx_handler [ 1815.774612][T30010] syz.0.9199 (30010) used greatest stack depth: 18408 bytes left [ 1816.943721][T30049] veth0_vlan: left promiscuous mode [ 1816.992013][T30049] veth0_vlan: entered promiscuous mode [ 1817.018386][T30049] team0: Device veth0_vlan failed to register rx_handler [ 1817.267449][T30049] syz.3.9215 (30049) used greatest stack depth: 17768 bytes left [ 1818.079729][T30080] __nla_validate_parse: 6 callbacks suppressed [ 1818.079751][T30080] netlink: 14568 bytes leftover after parsing attributes in process `syz.3.9224'. [ 1818.369272][T30082] netlink: 196 bytes leftover after parsing attributes in process `syz.2.9225'. [ 1820.134112][T30114] netlink: 14568 bytes leftover after parsing attributes in process `syz.2.9236'. [ 1820.333533][T30121] validate_nla: 6 callbacks suppressed [ 1820.333551][T30121] netlink: 'syz.1.9238': attribute type 9 has an invalid length. [ 1820.358423][T30121] netlink: 399 bytes leftover after parsing attributes in process `syz.1.9238'. [ 1820.372788][T30123] netlink: 196 bytes leftover after parsing attributes in process `syz.0.9237'. [ 1822.190593][T30171] netlink: 'syz.2.9252': attribute type 9 has an invalid length. [ 1822.198751][T30171] netlink: 399 bytes leftover after parsing attributes in process `syz.2.9252'. [ 1822.246106][T30166] netlink: 14568 bytes leftover after parsing attributes in process `syz.0.9251'. [ 1822.575192][T30174] netlink: 'syz.3.9253': attribute type 9 has an invalid length. [ 1822.596717][T30174] netlink: 61951 bytes leftover after parsing attributes in process `syz.3.9253'. [ 1822.748439][T30181] netlink: 196 bytes leftover after parsing attributes in process `syz.3.9257'. [ 1823.472026][T30203] netlink: 'syz.3.9266': attribute type 9 has an invalid length. [ 1823.523236][T30205] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1823.544495][T30203] netlink: 399 bytes leftover after parsing attributes in process `syz.3.9266'. [ 1824.185171][T30213] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.9265'. [ 1824.225852][T30213] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.9265'. [ 1824.233488][T30222] netlink: 196 bytes leftover after parsing attributes in process `syz.2.9272'. [ 1824.269138][T30209] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.9265'. [ 1824.287337][T30213] netlink: 4083 bytes leftover after parsing attributes in process `syz.1.9265'. [ 1824.349770][T30209] netlink: 'syz.1.9265': attribute type 10 has an invalid length. [ 1824.363019][T30209] netlink: 40 bytes leftover after parsing attributes in process `syz.1.9265'. [ 1825.086667][T30240] netlink: 'syz.2.9280': attribute type 2 has an invalid length. [ 1825.094711][T30240] netlink: 'syz.2.9280': attribute type 8 has an invalid length. [ 1825.105629][T30240] netlink: 132 bytes leftover after parsing attributes in process `syz.2.9280'. [ 1825.201765][T30240] netlink: 40 bytes leftover after parsing attributes in process `syz.2.9280'. [ 1825.736129][T30261] netlink: 'syz.0.9284': attribute type 9 has an invalid length. [ 1825.743947][T30261] netlink: 399 bytes leftover after parsing attributes in process `syz.0.9284'. [ 1826.494436][T30274] netlink: 'syz.0.9292': attribute type 9 has an invalid length. [ 1827.217692][T30292] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1827.704117][T30302] netlink: 'syz.2.9301': attribute type 10 has an invalid length. [ 1827.802575][T30302] veth0_vlan: left promiscuous mode [ 1827.863448][T30302] veth0_vlan: entered promiscuous mode [ 1827.977196][T30302] team0: Device veth0_vlan failed to register rx_handler [ 1828.504572][T30308] netlink: 'syz.1.9302': attribute type 9 has an invalid length. [ 1829.404254][T30335] netlink: 'syz.2.9314': attribute type 10 has an invalid length. [ 1829.432309][T30335] veth0_vlan: left promiscuous mode [ 1829.472684][T30335] veth0_vlan: entered promiscuous mode [ 1829.511341][T30335] team0: Device veth0_vlan failed to register rx_handler [ 1829.887161][T30341] netlink: 'syz.0.9324': attribute type 10 has an invalid length. [ 1829.903839][T30341] veth0_vlan: left promiscuous mode [ 1829.935535][T30341] veth0_vlan: entered promiscuous mode [ 1829.962725][T30341] team0: Device veth0_vlan failed to register rx_handler [ 1830.097333][T30342] netlink: 'syz.2.9316': attribute type 9 has an invalid length. [ 1830.116943][T30342] __nla_validate_parse: 2 callbacks suppressed [ 1830.116960][T30342] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.9316'. [ 1830.241905][T30349] netlink: 'syz.2.9329': attribute type 10 has an invalid length. [ 1830.258982][T30349] veth0_vlan: left promiscuous mode [ 1830.273503][T30349] veth0_vlan: entered promiscuous mode [ 1830.286164][T30349] team0: Device veth0_vlan failed to register rx_handler [ 1830.905288][T30371] netlink: 'syz.2.9328': attribute type 7 has an invalid length. [ 1830.914990][T30371] netlink: 'syz.2.9328': attribute type 6 has an invalid length. [ 1831.072835][T30374] netlink: 'syz.3.9330': attribute type 9 has an invalid length. [ 1831.092258][T30374] netlink: 61951 bytes leftover after parsing attributes in process `syz.3.9330'. [ 1831.733405][T30388] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9336'. [ 1832.238372][T30404] netlink: 'syz.2.9342': attribute type 9 has an invalid length. [ 1832.254463][T30404] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.9342'. [ 1832.465291][T30412] netlink: 'syz.2.9353': attribute type 9 has an invalid length. [ 1832.478607][T30412] netlink: 61951 bytes leftover after parsing attributes in process `syz.2.9353'. [ 1833.622939][T30425] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9348'. [ 1833.832207][T30430] netlink: 'syz.0.9352': attribute type 10 has an invalid length. [ 1834.563553][T30442] netlink: 'syz.1.9359': attribute type 9 has an invalid length. [ 1834.594307][T30442] netlink: 61951 bytes leftover after parsing attributes in process `syz.1.9359'. [ 1835.214310][T30454] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9361'. [ 1835.937313][T30470] netlink: 'syz.1.9370': attribute type 9 has an invalid length. [ 1835.945212][T30470] netlink: 61951 bytes leftover after parsing attributes in process `syz.1.9370'. [ 1836.348084][T30483] netlink: 'syz.1.9375': attribute type 7 has an invalid length. [ 1836.368951][T30483] netlink: 'syz.1.9375': attribute type 6 has an invalid length. [ 1837.010680][T30498] syzkaller0: entered promiscuous mode [ 1837.028522][T30498] syzkaller0: entered allmulticast mode [ 1839.508184][T30523] netlink: 'syz.2.9387': attribute type 10 has an invalid length. [ 1839.945823][T30537] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9392'. [ 1841.058258][T30548] netlink: 'syz.3.9399': attribute type 10 has an invalid length. [ 1841.175086][T30552] syzkaller0: entered promiscuous mode [ 1841.189496][T30552] syzkaller0: entered allmulticast mode [ 1843.793923][T30560] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9403'. [ 1844.945883][T30590] netlink: 'syz.1.9410': attribute type 10 has an invalid length. [ 1845.112421][T30597] mac80211_hwsim hwsim13 wlan1: entered promiscuous mode [ 1845.149641][T30597] mac80211_hwsim hwsim13 wlan1: entered allmulticast mode [ 1845.221574][T30600] netlink: 16410 bytes leftover after parsing attributes in process `syz.1.9414'. [ 1845.384200][T30603] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1845.833712][T30613] syzkaller0: entered promiscuous mode [ 1845.840227][T30613] syzkaller0: entered allmulticast mode [ 1847.983271][T30627] netlink: 'syz.3.9424': attribute type 10 has an invalid length. [ 1848.238737][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1848.493893][T30642] netlink: 16410 bytes leftover after parsing attributes in process `syz.2.9431'. [ 1848.726343][T30653] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1848.746850][T30658] netlink: 'syz.2.9435': attribute type 10 has an invalid length. [ 1850.909940][T30705] netlink: 'syz.3.9456': attribute type 21 has an invalid length. [ 1850.952016][T30705] netlink: 132 bytes leftover after parsing attributes in process `syz.3.9456'. [ 1852.308144][T30739] netlink: 'syz.3.9468': attribute type 10 has an invalid length. [ 1852.342224][T30739] wg1: entered promiscuous mode [ 1852.352879][T30739] wg1: entered allmulticast mode [ 1852.368938][T30739] team0: Device wg1 is of different type [ 1853.195962][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1853.218426][T30772] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9482'. [ 1853.543803][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.552696][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 1854.047799][T30795] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1854.236911][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1854.483196][T29902] wlan1: Creating new IBSS network, BSSID b6:e8:76:4b:b4:81 [ 1856.534366][T30834] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1857.423156][T30865] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1857.556008][T30861] netlink: 'syz.3.9519': attribute type 10 has an invalid length. [ 1858.236276][T29902] wlan1: Trigger new scan to find an IBSS to join [ 1858.276327][T30896] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1858.311207][T30898] netlink: 'syz.0.9534': attribute type 10 has an invalid length. [ 1858.353626][T30898] team0: Device wg1 is of different type [ 1858.973774][T30911] netlink: 'syz.2.9540': attribute type 10 has an invalid length. [ 1859.991186][T30928] mac80211_hwsim hwsim93 wlan1: left promiscuous mode [ 1860.219633][T30939] netlink: 'syz.1.9547': attribute type 10 has an invalid length. [ 1862.238268][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1863.156250][T29902] wlan1: Creating new IBSS network, BSSID d6:be:64:2a:9e:38 [ 1863.196447][T29902] wlan1: Trigger new scan to find an IBSS to join [ 1863.989405][T31044] netlink: 'syz.3.9592': attribute type 10 has an invalid length. [ 1864.395345][T29902] wlan1: Trigger new scan to find an IBSS to join [ 1865.657401][T31072] netlink: 'syz.0.9603': attribute type 10 has an invalid length. [ 1865.737766][T31081] netlink: 'syz.2.9605': attribute type 10 has an invalid length. [ 1866.256364][ T41] wlan1: Trigger new scan to find an IBSS to join [ 1867.533030][T31112] netlink: 'syz.0.9619': attribute type 10 has an invalid length. [ 1869.093025][T31140] netlink: 'syz.1.9631': attribute type 10 has an invalid length. [ 1869.195743][ T12] wlan1: Creating new IBSS network, BSSID 26:bc:b4:78:e1:13 [ 1869.275582][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1869.366547][T31151] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1869.836412][T31150] netlink: 'syz.1.9632': attribute type 10 has an invalid length. [ 1870.225920][T29902] wlan1: Creating new IBSS network, BSSID 00:00:00:08:00:00 [ 1870.448634][T31174] netlink: 'syz.3.9644': attribute type 10 has an invalid length. [ 1870.668961][T31185] netlink: 'syz.2.9649': attribute type 10 has an invalid length. [ 1871.282234][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1871.312667][T15734] Bluetooth: hci3: unexpected event 0x16 length: 15 > 6 [ 1871.474541][T31209] netlink: 'syz.1.9661': attribute type 10 has an invalid length. [ 1871.506879][T31206] netlink: 'syz.2.9660': attribute type 10 has an invalid length. [ 1871.672766][T15734] Bluetooth: hci3: unexpected event 0x1d length: 15 > 5 [ 1872.002112][T31227] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.9669'. [ 1872.235770][T29902] wlan1: Trigger new scan to find an IBSS to join [ 1874.421087][T31260] netlink: 'syz.2.9683': attribute type 3 has an invalid length. [ 1874.429483][T31260] netlink: 130984 bytes leftover after parsing attributes in process `syz.2.9683'. [ 1875.683054][T15734] Bluetooth: hci0: unexpected event 0x1d length: 15 > 5 [ 1876.235722][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1876.249724][ T12] wlan1: Trigger new scan to find an IBSS to join [ 1876.691585][T31300] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.9697'. [ 1877.277656][T29902] wlan1: Creating new IBSS network, BSSID 7a:62:62:4b:21:a3 [ 1877.286870][ T2944] wlan1: Creating new IBSS network, BSSID 5a:8b:61:ac:c5:e2 [ 1877.313825][T29902] ------------[ cut here ]------------ [ 1877.319810][T29902] WARNING: CPU: 0 PID: 29902 at net/wireless/ibss.c:37 __cfg80211_ibss_joined+0x3d2/0x440 [ 1877.329955][T29902] Modules linked in: [ 1877.333894][T29902] CPU: 0 PID: 29902 Comm: kworker/u4:5 Not tainted syzkaller #0 [ 1877.341669][T29902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1877.351865][T29902] Workqueue: cfg80211 cfg80211_event_work [ 1877.357831][T29902] RIP: 0010:__cfg80211_ibss_joined+0x3d2/0x440 [ 1877.364043][T29902] Code: 00 00 00 48 3b 84 24 80 00 00 00 75 5c 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 a7 98 a0 f7 0f 0b eb bb e8 9e 98 a0 f7 <0f> 0b 4c 8b 6c 24 18 eb ad e8 90 98 a0 f7 0f 0b e9 e0 fd ff ff e8 [ 1877.383815][T29902] RSP: 0018:ffffc90015907a20 EFLAGS: 00010293 [ 1877.390137][T29902] RAX: ffffffff89e68962 RBX: dffffc0000000000 RCX: ffff88802d425a00 [ 1877.398307][T29902] RDX: 0000000000000000 RSI: ffffffff8acac9e0 RDI: ffffffff8b1c8fa0 [ 1877.406740][T29902] RBP: ffffc90015907af8 R08: ffffffff911c656f R09: 1ffffffff2238cad [ 1877.414768][T29902] R10: dffffc0000000000 R11: fffffbfff2238cae R12: ffff88805b900c90 [ 1877.422883][T29902] R13: 1ffff92002b20f4c R14: ffff88805344b5f8 R15: 000000000000001f [ 1877.430982][T29902] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1877.440491][T29902] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1877.447296][T29902] CR2: 000000110c2df838 CR3: 000000004cdd1000 CR4: 00000000003506f0 [ 1877.455324][T29902] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1877.463705][T29902] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [ 1877.471923][T29902] Call Trace: [ 1877.475295][T29902] [ 1877.478332][T29902] ? mutex_lock_nested+0x20/0x20 [ 1877.483384][T29902] ? trace_rdev_return_void+0x1c0/0x1c0 [ 1877.489034][T29902] cfg80211_process_wdev_events+0x3bc/0x550 [ 1877.495091][T29902] cfg80211_process_rdev_events+0xa1/0x110 [ 1877.501354][T29902] cfg80211_event_work+0x2f/0x40 [ 1877.506495][T29902] ? process_scheduled_works+0x96f/0x15d0 [ 1877.512345][T29902] process_scheduled_works+0xa5d/0x15d0 [ 1877.518086][T29902] ? worker_attach_to_pool+0x380/0x380 [ 1877.523775][T29902] ? assign_work+0x3d2/0x5d0 [ 1877.528666][T29902] worker_thread+0xa55/0xfc0 [ 1877.533288][T29902] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1877.539259][T29902] ? _raw_spin_unlock+0x40/0x40 [ 1877.544140][T29902] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 1877.550132][T29902] kthread+0x2fa/0x390 [ 1877.554216][T29902] ? pr_cont_work+0x560/0x560 [ 1877.558998][T29902] ? kthread_blkcg+0xd0/0xd0 [ 1877.563630][T29902] ret_from_fork+0x48/0x80 [ 1877.568146][T29902] ? kthread_blkcg+0xd0/0xd0 [ 1877.572767][T29902] ret_from_fork_asm+0x11/0x20 [ 1877.577643][T29902] [ 1877.580693][T29902] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1877.588139][T29902] CPU: 0 PID: 29902 Comm: kworker/u4:5 Not tainted syzkaller #0 [ 1877.595767][T29902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 1877.605824][T29902] Workqueue: cfg80211 cfg80211_event_work [ 1877.611817][T29902] Call Trace: [ 1877.615091][T29902] [ 1877.618035][T29902] dump_stack_lvl+0x18c/0x250 [ 1877.622835][T29902] ? show_regs_print_info+0x20/0x20 [ 1877.628044][T29902] ? load_image+0x420/0x420 [ 1877.632570][T29902] panic+0x2dc/0x730 [ 1877.636579][T29902] ? bpf_jit_dump+0xd0/0xd0 [ 1877.641104][T29902] ? ret_from_fork_asm+0x11/0x20 [ 1877.646054][T29902] __warn+0x2e0/0x470 [ 1877.650131][T29902] ? __cfg80211_ibss_joined+0x3d2/0x440 [ 1877.655675][T29902] ? __cfg80211_ibss_joined+0x3d2/0x440 [ 1877.661241][T29902] report_bug+0x2be/0x4f0 [ 1877.665625][T29902] ? __cfg80211_ibss_joined+0x3d2/0x440 [ 1877.671192][T29902] ? __cfg80211_ibss_joined+0x3d2/0x440 [ 1877.676747][T29902] ? __cfg80211_ibss_joined+0x3d4/0x440 [ 1877.682295][T29902] handle_bug+0xcf/0x120 [ 1877.686620][T29902] exc_invalid_op+0x1a/0x50 [ 1877.691124][T29902] asm_exc_invalid_op+0x1a/0x20 [ 1877.695990][T29902] RIP: 0010:__cfg80211_ibss_joined+0x3d2/0x440 [ 1877.702145][T29902] Code: 00 00 00 48 3b 84 24 80 00 00 00 75 5c 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 a7 98 a0 f7 0f 0b eb bb e8 9e 98 a0 f7 <0f> 0b 4c 8b 6c 24 18 eb ad e8 90 98 a0 f7 0f 0b e9 e0 fd ff ff e8 [ 1877.721852][T29902] RSP: 0018:ffffc90015907a20 EFLAGS: 00010293 [ 1877.727924][T29902] RAX: ffffffff89e68962 RBX: dffffc0000000000 RCX: ffff88802d425a00 [ 1877.735893][T29902] RDX: 0000000000000000 RSI: ffffffff8acac9e0 RDI: ffffffff8b1c8fa0 [ 1877.743948][T29902] RBP: ffffc90015907af8 R08: ffffffff911c656f R09: 1ffffffff2238cad [ 1877.752171][T29902] R10: dffffc0000000000 R11: fffffbfff2238cae R12: ffff88805b900c90 [ 1877.760155][T29902] R13: 1ffff92002b20f4c R14: ffff88805344b5f8 R15: 000000000000001f [ 1877.768143][T29902] ? __cfg80211_ibss_joined+0x3d2/0x440 [ 1877.773713][T29902] ? mutex_lock_nested+0x20/0x20 [ 1877.778652][T29902] ? trace_rdev_return_void+0x1c0/0x1c0 [ 1877.784208][T29902] cfg80211_process_wdev_events+0x3bc/0x550 [ 1877.790115][T29902] cfg80211_process_rdev_events+0xa1/0x110 [ 1877.795919][T29902] cfg80211_event_work+0x2f/0x40 [ 1877.800850][T29902] ? process_scheduled_works+0x96f/0x15d0 [ 1877.806565][T29902] process_scheduled_works+0xa5d/0x15d0 [ 1877.812127][T29902] ? worker_attach_to_pool+0x380/0x380 [ 1877.817584][T29902] ? assign_work+0x3d2/0x5d0 [ 1877.822318][T29902] worker_thread+0xa55/0xfc0 [ 1877.826903][T29902] ? _raw_spin_unlock_irqrestore+0xc5/0x120 [ 1877.832791][T29902] ? _raw_spin_unlock+0x40/0x40 [ 1877.837813][T29902] ? _raw_spin_unlock_irqrestore+0x86/0x120 [ 1877.843729][T29902] kthread+0x2fa/0x390 [ 1877.847796][T29902] ? pr_cont_work+0x560/0x560 [ 1877.852468][T29902] ? kthread_blkcg+0xd0/0xd0 [ 1877.857052][T29902] ret_from_fork+0x48/0x80 [ 1877.861462][T29902] ? kthread_blkcg+0xd0/0xd0 [ 1877.866051][T29902] ret_from_fork_asm+0x11/0x20 [ 1877.870823][T29902] [ 1877.874180][T29902] Kernel Offset: disabled [ 1877.878580][T29902] Rebooting in 86400 seconds..